US 9,104,870 B1Grant
Detecting malware
Issue Date:2015-08-11
•20 Claims
•5 Drawing Sheets
Abstract
An example of candidate malware is data that potentially includes one or more malicious elements. Candidate malware is received. The received candidate malware is analyzed using a virtual machine. A determination is made that the candidate malware has attempted to perform an anti-virtual machine action. Output that indicates that the candidate malware is malicious is generated.
Metadata
Assignee
- Palo Alto Networks, Inc.
Inventors
- Bo Qu
- Xinran Wang
- Kyle Sanders
Application Information
Application Number:US 13/631,654
Filing Date:2012-09-28
Priority Date:2012-09-28
Art Unit:2495
Classifications
IPC:
G06F11/00G06F17/30G06F21/56
Field of Search:
G06F 21/563H04L 63/1441H04L 63/145H04L 63/14
Patent Drawings (5 sheets)
Description
Background of the Invention
[0001] Nefarious individuals attempt to compromise computer systems in a variety of ways. As an example, such individuals may embed or otherwise include malicious software (“malware”) in email attachments and transmit or cause them to be transmitted to unsuspecting users. An administrator of the recipient computer system can attempt to prevent compromise by blocking all downloads of all attachments by the computer system. However, such a policy will also prevent legitimate attachments from being available to the user. As an alternate approach, the administrator can require that a security scan be performed prior to the download of an attachment. Unfortunately, malware authors are crafting increasingly sophisticated malware that is increasingly able to evade detection. Accordingly, there exists an ongoing need for improved techniques to detect malware and prevent its harm.
Brief Summary of the Invention
[0002] Candidate malware potentially includes one or more malicious elements. The candidate malware is analyzed using a virtual machine. If the candidate malware attempts to perform an anti-virtual machine action during analysis, a conclusion is made that the candidate malware is malicious.
Brief Description of the Drawings
[0003] Various embodiments of the invention are disclosed in the following detailed description and the accompanying drawings.
[0004] FIG. 1 illustrates an example of an environment in which malware is detected and prevented from causing harm.
[0005] FIG. 2 illustrates an embodiment of a data appliance.
[0006] FIG. 3 illustrates an embodiment of a process for detecting an anti-virtual machine action.
[0007] FIG. 4 illustrates an example of code which can be used to determine whether a process is executing in a virtual environment.
Detailed Description
[0008] The invention can be implemented in numerous ways, including as a process; an apparatus; a system; a composition of matter; a computer program product embodied on a computer readable storage medium; and/or a processor, such as a processor configured to execute instructions stored on and/or provided by a memory coupled to the processor. In this specification, these implementations, or any other form that the invention may take, may be referred to as techniques. In general, the order of the steps of disclosed processes may be altered within the scope of the invention. Unless stated otherwise, a component such as a processor or a memory described as being configured to perform a task may be implemented as a general component that is temporarily configured to perform the task at a given time or a specific component that is manufactured to perform the task. As used herein, the term ‘processor’ refers to one or more devices, circuits, and/or processing cores configured to process data, such as computer program instructions.
[0009] A detailed description of one or more embodiments of the invention is provided below along with accompanying figures that illustrate the principles of the invention. The invention is described in connection with such embodiments, but the invention is not limited to any embodiment. The scope of the invention is limited only by the claims and the invention encompasses numerous alternatives, modifications and equivalents. Numerous specific details are set forth in the following description in order to provide a thorough understanding of the invention. These details are provided for the purpose of example and the invention may be practiced according to the claims without some or all of these specific details. For the purpose of clarity, technical material that is known in the technical fields related to the invention has not been described in detail so that the invention is not unnecessarily obscured.
[0010] FIG. 1 illustrates an example of an environment in which malware is detected and prevented from causing harm. In particular, a variety of attempts by a malicious individual to propagate malware (such as malware 130) via system 120 are described, as are techniques for thwarting that propagation.
[0011] In the example shown in FIG. 1 , client devices 104-108 are a laptop computer, a desktop computer, and a tablet (respectively) present in an enterprise network 110. Data appliance 102 is configured to enforce policies regarding communications between clients, such as clients 104 and 106, and nodes outside of enterprise network 110 (e.g., reachable via external network 118). Examples of such policies include ones governing traffic shaping, quality of service, and routing of traffic. Other examples of policies include security policies such as ones requiring the scanning for threats in incoming (and/or outgoing) email attachments, website downloads, files exchanged through instant messaging programs, and/or other file transfers. In some embodiments, appliance 102 is also configured to enforce policies with respect to traffic that stays within enterprise network 110.
[0012] Appliance 102 can take a variety of forms. For example, appliance 102 can be a dedicated device or set of devices. The functionality provided by appliance 102 can also be integrated into or executed as software on a general purpose computer, a computer server, a gateway, and/or a network/routing device. For example, in some embodiments services provided by data appliance 102 are instead (or in addition) provided to client 104 by software executing on client 104.
[0013] Whenever appliance 102 is described as performing a task, a single component, a subset of components, or all components of appliance 102 may cooperate to perform the task. Similarly, whenever a component of appliance 102 is described as performing a task, a subcomponent may perform the task and/or the component may perform the task in conjunction with other components. In various embodiments, portions of appliance 102 are provided by one or more third parties. Depending on factors such as the amount of computing resources available to appliance 102, various logical components and/or features of appliance 102 may be omitted and the techniques described herein adapted accordingly. Similarly, additional logical components/features can be added to system 102 as applicable.
[0014] As will be described in more detail below, appliance 102 can be configured to work in cooperation with one or more virtual machine servers (112, 124) to perform malware analysis/prevention. As one example, data appliance 102 can be configured to provide a copy of malware 130 to one or more of the virtual machine servers for real-time analysis. As another example, service 122 can provide a list of signatures of known-malicious documents to appliance 102 as part of a subscription. Those signatures can be generated by service 122 in conjunction with the techniques described herein.
[0015] An example of a virtual machine server is a physical machine comprising commercially available server-class hardware (e.g., a multi-core processor, 4+ Gigabytes of RAM, and one or more Gigabit network interface adapters) that runs commercially available virtualization software, such as VMware ESXi, Citrix XenServer, or Microsoft Hyper-V. The virtual machine servers may be separate from, but in communication with, data appliance 102, as shown in FIG. 1 . A virtual machine server may also perform some or all of the functions of data appliance 102, and a separate data appliance 102 is omitted as applicable. Further, a virtual machine server may be under the control of the same entity that administers data appliance 102 (e.g., virtual machine server 112); the virtual machine server may also be provided by a third party (e.g., virtual machine server 124, which can be configured to provide services to appliance 102 via third party service 122). In some embodiments, data appliance 102 is configured to use one or the other of virtual machine servers 112 and 124 for malware analysis. In other embodiments, data appliance 102 is configured to use the services of both servers (and/or additional servers not pictured).
[0016] FIG. 2 illustrates an embodiment of a data appliance. The example shown is a representation of physical components that are included in appliance 102, in some embodiments. Specifically, appliance 102 includes a high performance multi-core CPU 202 and RAM 204. Appliance 102 also includes a storage 210 (such as one or more hard disks), which is used to store policy and other configuration information, as well as URL information. Data appliance 102 can also include one or more optional hardware accelerators. For example, data appliance 102 can include a cryptographic engine 206 configured to perform encryption and decryption operations, and one or more FPGAs 208 configured to perform matching, act as network processors, and/or perform other tasks.
[0017] Using Virtual Machines to Analyze Attachments
[0018] A virtual machine (VM) can be used to perform behavior profiling (e.g., in a VM sandbox environment) using various heuristic-based analysis techniques that can be performed in real-time during a file transfer (e.g., during a file/attachment download). As one example, suppose a malicious user of system 120 sends an email message to a user of client 104 that includes a malicious attachment. The attachment may be an executable (e.g., having a .exe extension) and may also be a document (e.g., a .doc or .pdf file). The message is received by data appliance 102, which determines whether a signature for the attachment is present on data appliance 102. A signature, if present, can indicate that the attachment is known to be safe, and can also indicate that the attachment is known to be malicious. If no signature for the attachment is found, data appliance 102 is configured to provide the attachment to a virtual machine server, such as virtual machine server 112, for analysis.
[0019] Virtual machine server 112 is configured to execute (or open, as applicable) the attachment in one or more virtual machines 114-116. The virtual machines may all execute the same operating system (e.g., Microsoft Windows) or may execute different operating systems or versions thereof (e.g., with VM 116 emulating an Android operating system). In some embodiments, the VM(s) chosen to analyze the attachment are selected to match the operating system of the intended recipient of the attachment being analyzed (e.g., the operating system of client 104). Observed behaviors resulting from executing/opening the attachment (such as changes to certain platform, software, or registry settings) are logged and analyzed for indications that the attachment is malicious. In some embodiments the log analysis is performed by the VM server (e.g., VM server 112). In other embodiments, the analysis is performed at least in part by appliance 102. The malware analysis and enforcement functionality illustrated in FIG. 1 as being provided by data appliance 102 and VM server 112 is also referred to herein as being provided by malware analysis system 132. As explained above, portions of malware analysis system 132 may be provided by multiple distinct devices, but may also be provided on a single platform, as applicable.
[0020] If the attachment is determined to be malicious, appliance 102 can automatically block the file download based on the analysis result. Further, a signature can be generated and distributed (e.g., to other data appliances) to automatically block future file transfer requests to download the file determined to be malicious.
[0021] Detecting Anti-Virtual Machine Actions
[0022] Malware authors use increasingly sophisticated techniques when crafting their malware so that it avoids detection by security systems. One such technique is to have the malware attempt to determine whether it is executing in a virtual machine environment, and if so, to stop executing or otherwise not engage in malicious activities.
[0023] In various embodiments, malware analysis system 132 is configured to detect attempts (e.g., by an attachment executing in a virtual machine) to detect that it is executing within a virtual machine environment. Any such attempts (also referred to herein as “anti-virtual machine actions”) are treated as malicious actions and will result in the attachment being classified as malicious. A variety of techniques for detecting anti-virtual machine actions will be described in conjunction with FIG. 3 .
[0024] FIG. 3 illustrates an embodiment of a process for detecting an anti-virtual machine action. In various embodiments, process 300 is performed by malware analysis system 132. The process begins at 302 when candidate malware is received. As one example, candidate malware is received at 302 when an email (including an attachment) is received by data appliance 102 from system 120. As another example, data appliance 102 can be configured to transmit the attachment to service 122 for analysis. In that scenario, the candidate is received by service 122 at 302.
[0025] At 304, the candidate malware is analyzed using one or more virtual machines. For example, the candidate malware can be executed in virtual machine 114 and any behaviors logged for analysis by system 132. As another example, the candidate malware can be executed in virtual machines 126-128 and analyzed by service 122.
[0026] The following are examples of anti-virtual machine actions:
-
- [0027] The candidate malware attempts to check the product ID of a Microsoft Windows install.
- [0028] The candidate malware attempts to check the computer name.
- [0029] The candidate malware attempts to check the name of hardware, such as the name of a harddrive (e.g., because a virtual machine will by default have a harddrive name indicative of the fact that it is a virtual machine).
- [0030] The candidate malware attempts to check a MAC address (e.g., because a virtual machine will by default have a MAC that conforms to a specific pattern).
[0031] Additional anti-virtual machine actions are discussed below.
[0032] At 306, a determination is made as to whether anti-virtual machine actions (such as, but not limited to those described herein) have taken place. And, if so, at 308, output is generated that indicates that the candidate malware is malicious. As one example, at 308 a signature for the attachment is generated (e.g., as an MD5 hash-based signature). As another example, instead of or in addition to generating a signature, an alert is generated that instructs data appliance 102 not to provide the attachment to client 104.
[0033] In various embodiments, system 132 is configured to thwart anti-virtual machine actions. For example, virtual machine server 112 can be configured to provide virtual machines such as virtual machine 114 with randomized product IDs. As another example, the computer name associated with virtual machine 114 can be randomized. As yet another example, the computer name associated with virtual machine 114 can be set to a very common name, such as “HOME” or “WORKGROUP.” As yet another example, the harddrive name can be randomized or set to a very common name. As yet another example, the MAC address can be randomized.
[0034] VM-Specific Opcodes
[0035] An additional way that malware can attempt to ascertain whether it is being run in a virtual machine is by attempting to use a specific sequence of opcodes that are only supported in given virtualized environments. Illustrated in FIG. 4 is an example of code, which if included in malware, could be used by the malware to detect whether or not the malware is being executed in a VMware environment.
[0036] In some embodiments, system 132 is configured to perform static analysis of candidate malware. In particular, it is configured to look for the presence in the candidate malware of functions/methods/opcodes that are only supported in virtualized environments.
[0037] In addition to or instead of performing such static analysis, system 132 can also be configured to apply one or more hotpatches to a virtual machine such as virtual machine 114. As one example, a hotpatch can be used to hook the hypervisor layer to return a FAIL (or a random string) instead of revealing to the malware that it is executing in a virtualized environment (e.g., because a string containing “vmware” would otherwise be returned). As another example, the hotpatch can be used to implement detailed logging (e.g., to obtain a detailed call graph).
[0038] Sophisticated malware might attempt to detect whether hotpatches have been applied (i.e., the running environment has been hooked). As an example, suppose the malware calls “LoadLibraryA” and “GetProcAddress” to get the original binary code from system files, and compares it with the version that is in memory (e.g., using memcmp). In some embodiments, system 132 is configured to monitor for such function calls. For example, which API calls are being made can be logged and analyzed. If calls indicative of attempts to detect API hooking are observed, the candidate malware is deemed to be taking anti-virtual machine actions and is flagged as malicious accordingly. Further, system 132 can be configured to thwart hotpatch detection by allowing a portion of memory to be writable and executable, but not readable.
[0039] In the event that malware determines it is operating in a hooked environment, it might simply cease executing. It may also attempt to restore the hooked portion back to its original state. Any such restore attempts can be monitored for by system 132 and, if observed, treated as anti-virtual machine actions. In some embodiments, system 132 is configured to take steps to counteract any efforts by malware to revert hooked portions. As one example, a standalone thread can be used to periodically check that hotpatches that ought to have been applied are still present. A second approach is to perform on-demand checking. For example, whenever the function “WriteFile” is called, system 132 can perform a check that “CreateFileA”/“CreateFileW” is restored.
[0040] Sleep
[0041] One additional approach that malware might use to attempt to evade detection while executing in a virtualized environment is the use of a sleep function. Specifically, the malware may attempt to sleep for an extended period of time—either through repeated sleep calls or through a single, lengthy sleep. In some embodiments, system 132 is configured to modify the behavior of the sleep function through API-hooking. For example, a maximum sleep duration can be specified. As another example, repeated calls to sleep can be marked as suspicious and/or subsequent sleeps can be ignored.
[0042] Although the foregoing embodiments have been described in some detail for purposes of clarity of understanding, the invention is not limited to the details provided. There are many alternative ways of implementing the invention. The disclosed embodiments are illustrative and not restrictive.
Claims
What is claimed is:
1. A system, comprising:
a processor configured to:
receive a candidate malware potentially including one or more malicious elements;
analyze the candidate malware using a virtual machine, including by:
evaluating one or more actions taken by the candidate malware, when executing in the virtual machine, to determine whether the candidate malware is attempting to take an anti-virtual machine action;
determine that at least one action taken by the candidate malware when executing in the virtual machine is an anti-virtual machine action, comprising an attempt to check that the candidate malware is running in a virtualized environment; and
in response to the determination, generate as output an alert that the candidate malware is malicious; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 wherein generating the alert includes generating a signature associated with the candidate malware that indicates that the candidate malware is malicious.
3. The system of claim 1 wherein the anti-virtual machine action comprises an attempt by the candidate malware to ascertain a product identifier of an operating system.
4. The system of claim 1 wherein the processor is further configured to generate a random product identifier for use by the virtual machine.
5. The system of claim 1 wherein the anti-virtual machine action comprises an attempt by the candidate malware to ascertain a computer name.
6. The system of claim 1 wherein the processor is further configured to generate a random computer name for use by the virtual machine.
7. The system of claim 1 wherein the anti-virtual machine action comprises an attempt by the candidate malware to ascertain an identifier of a hard drive.
8. The system of claim 1 wherein the processor is further configured to generate a random hard drive identifier for use by the virtual machine.
9. The system of claim 1 wherein the anti-virtual machine action comprises an attempt by the candidate malware to ascertain a MAC address.
10. The system of claim 1 wherein the processor is further configured to generate a random MAC address for use by the virtual machine.
11. The system of claim 1 wherein the processor is further configured to determine whether the candidate malware includes at least one virtualized environment-specific opcode.
12. The system of claim 1 wherein the processor is further configured to apply one or more hotpatches.
13. The system of claim 1 wherein the anti-virtual machine action comprises an attempt to detect hotpatching.
14. The system of claim 1 wherein the anti-virtual machine action comprises an attempt to revert a hotpatch.
15. The system of claim 1 wherein the processor is further configured to confirm that a previously applied hotpatch is still in effect.
16. The system of claim 1 wherein the anti-virtual machine action comprises one or more sleep actions.
17. A method, comprising:
receiving a candidate malware potentially including one or more malicious elements;
analyzing the candidate malware using a virtual machine, including by:
evaluating one or more actions taken by the candidate malware, when executing in the virtual machine, to determine whether the candidate malware is attempting to take an anti-virtual machine action;
determining, that at least one action taken by the candidate malware when executing in the virtual machine is an anti-virtual machine action, comprising an attempt to check that the candidate malware is running in a virtualized environment; and
in response to the determination, generating as output an alert that the candidate malware is malicious.
18. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
receiving a candidate malware potentially including one or more malicious elements;
analyzing the candidate malware using a virtual machine, including by:
evaluating one or more actions taken by the candidate malware, when executing in the virtual machine, to determine whether the candidate malware is attempting to take an anti-virtual machine action;
determining, that at least one action taken by the candidate malware when executing in the virtual machine is an anti-virtual machine action, comprising an attempt to check that the candidate malware is running in a virtualized environment; and
in response to the determination, generating as output an alert that the candidate malware is malicious.
19. The method of claim 17 wherein the anti-virtual machine action comprises an attempt by the candidate malware to ascertain a product identifier of an operating system.
20. The method of claim 17 wherein the anti-virtual machine action comprises an attempt by the candidate malware to ascertain a computer name.
Patent Citations (126)
| Patent | Date | Inventor | Cited By |
|---|---|---|---|
| US5983348(A) | 1999-11-01 | Ji | Applicant |
| US7409718(B1) | 2008-08-01 | Hong et al. | Examiner |
| US7496963(B2) | 2009-02-01 | Shipp | Examiner |
| US7568233(B1) | 2009-07-01 | Szor et al. | Examiner |
| US7649838(B2) | 2010-01-01 | Fishteyn et al. | Applicant |
| US7664855(B1) | 2010-02-01 | Freed et al. | Applicant |
| US7779472(B1) | 2010-08-01 | Lou | Examiner |
| US7870610(B1) | 2011-01-01 | Mitchell et al. | Applicant |
| US7958555(B1) | 2011-06-01 | Chen et al. | Applicant |
| US8011010(B2) | 2011-08-01 | Michael et al. | Examiner |
| US8141132(B2) | 2012-03-01 | Oliver et al. | Applicant |
| US8201246(B1) | 2012-06-01 | Wu et al. | Examiner |
| US8209680(B1) | 2012-06-01 | Le et al. | Examiner |
| US8225317(B1) | 2012-07-01 | Chiueh et al. | Examiner |
| US8260914(B1) | 2012-09-01 | Ranjan | Applicant |
| US8291468(B1) | 2012-10-01 | Chickering | Applicant |
| US8316440(B1) | 2012-11-01 | Hsieh et al. | Applicant |
| US8321936(B1) | 2012-11-01 | Green et al. | Examiner |
| US8359651(B1) | 2013-01-01 | Wu et al. | Applicant |
| US8370938(B1) | 2013-02-01 | Daswani et al. | Applicant |
| US8402543(B1) | 2013-03-01 | Ranjan et al. | Applicant |
| US8407324(B2) | 2013-03-01 | McDougal | Applicant |
| US8438639(B2) | 2013-05-01 | Lee et al. | Applicant |
| US8443363(B1) | 2013-05-01 | Brennan et al. | Examiner |
| US8443449(B1) | 2013-05-01 | Fan et al. | Applicant |
| US8464341(B2) | 2013-06-01 | Cohen | Examiner |
| US8479295(B2) | 2013-07-01 | Sahita et al. | Applicant |
| US8484732(B1) | 2013-07-01 | Chen et al. | Examiner |
| US8484739(B1) | 2013-07-01 | Seshadri | Applicant |
| US8510827(B1) | 2013-08-01 | Leake et al. | Applicant |
| US8516591(B2) | 2013-08-01 | Fly et al. | Applicant |
| US8521667(B2) | 2013-08-01 | Zhu et al. | Applicant |
| US8539577(B1) | 2013-09-01 | Stewart et al. | Applicant |
| US8572740(B2) | 2013-10-01 | Mashevsky et al. | Applicant |
| US8578481(B2) | 2013-11-01 | Rowley | Applicant |
| US8584239(B2) | 2013-11-01 | Aziz et al. | Applicant |
| US8646088(B2) | 2014-02-01 | Pistoia et al. | Applicant |
| US8656491(B1) | 2014-02-01 | Daswani et al. | Applicant |
| US8677487(B2) | 2014-03-01 | Balupari et al. | Applicant |
| US8683584(B1) | 2014-03-01 | Daswani et al. | Applicant |
| US8707441(B1) | 2014-04-01 | Cidambi et al. | Applicant |
| US8756691(B2) | 2014-06-01 | Nachenberg | Applicant |
| US8838570(B1) | 2014-09-01 | English | Applicant |
| US9003526(B2) | 2015-04-01 | El-Moussa | Applicant |
| US2004/0030913(A1) | 2004-02-01 | Liang et al. | Examiner |
| US2004/0107416(A1) | 2004-06-01 | Buban et al. | Examiner |
| US2005/0177602(A1) | 2005-08-01 | Kaler et al. | Applicant |
| US2006/0168024(A1) | 2006-07-01 | Mehr et al. | Applicant |
| US2007/0050850(A1) | 2007-03-01 | Katoh et al. | Examiner |
| US2007/0192857(A1) | 2007-08-01 | Ben-Itzhak | Examiner |
| US2007/0261112(A1) | 2007-11-01 | Todd et al. | Applicant |
| US2008/0016552(A1) | 2008-01-01 | Hart | Applicant |
| US2008/0177755(A1) | 2008-07-01 | Stern et al. | Examiner |
| US2008/0177994(A1) | 2008-07-01 | Mayer | Applicant |
| US2008/0209562(A1) | 2008-08-01 | Szor | Examiner |
| US2008/0229393(A1) | 2008-09-01 | Congdon | Examiner |
| US2008/0256633(A1) | 2008-10-01 | Arnold et al. | Examiner |
| US2008/0263658(A1) | 2008-10-01 | Michael et al. | Examiner |
| US2008/0263659(A1) | 2008-10-01 | Alme | Examiner |
| US2008/0320594(A1) | 2008-12-01 | Jiang | Examiner |
| US2009/0019547(A1) | 2009-01-01 | Palliyil et al. | Examiner |
| US2009/0055928(A1) | 2009-02-01 | Kang et al. | Applicant |
| US2009/0144826(A2) | 2009-06-01 | Piccard | Applicant |
| US2009/0150419(A1) | 2009-06-01 | Kim et al. | Examiner |
| US2009/0241190(A1) | 2009-09-01 | Todd et al. | Examiner |
| US2009/0282485(A1) | 2009-11-01 | Bennett | Examiner |
| US2009/0288167(A1) | 2009-11-01 | Freericks et al. | Examiner |
| US2010/0043072(A1) | 2010-02-01 | Rothwell | Applicant |
| US2010/0077481(A1) | 2010-03-01 | Polyakov et al. | Applicant |
| US2010/0107252(A1) | 2010-04-01 | Mertoguno | Applicant |
| US2010/0115586(A1) | 2010-05-01 | Raghavan et al. | Applicant |
| US2010/0154059(A1) | 2010-06-01 | McNamee et al. | Examiner |
| US2010/0162350(A1) | 2010-06-01 | Jeong et al. | Applicant |
| US2010/0175132(A1) | 2010-07-01 | Zawadowskiy et al. | Examiner |
| US2011/0041179(A1) | 2011-02-01 | St. Hlberg | Applicant |
| US2011/0055923(A1) | 2011-03-01 | Thomas | Applicant |
| US2011/0090911(A1) | 2011-04-01 | Hao et al. | Examiner |
| US2011/0099620(A1) | 2011-04-01 | Stavrou et al. | Applicant |
| US2011/0167495(A1) | 2011-07-01 | Antonakakis et al. | Applicant |
| US2011/0173698(A1) | 2011-07-01 | Polyakov et al. | Examiner |
| US2011/0185425(A1) | 2011-07-01 | Lee et al. | Applicant |
| US2011/0252474(A1) | 2011-10-01 | Ward et al. | Applicant |
| US2011/0271342(A1) | 2011-11-01 | Chung et al. | Examiner |
| US2011/0296412(A1) | 2011-12-01 | Banga et al. | Applicant |
| US2011/0296486(A1) | 2011-12-01 | Burch et al. | Applicant |
| US2012/0084860(A1) | 2012-04-01 | Cao et al. | Applicant |
| US2012/0089700(A1) | 2012-04-01 | Safruti et al. | Applicant |
| US2012/0096549(A1) | 2012-04-01 | Amini et al. | Applicant |
| US2012/0117650(A1) | 2012-05-01 | Nachenberg | Applicant |
| US2012/0117652(A1) | 2012-05-01 | Manni et al. | Examiner |
| US2012/0192274(A1) | 2012-07-01 | Odom et al. | Examiner |
| US2012/0233691(A1) | 2012-09-01 | Jiang | Applicant |
| US2012/0240224(A1) | 2012-09-01 | Payne et al. | Applicant |
| US2012/0255018(A1) | 2012-10-01 | Sallam | Examiner |
| US2012/0255019(A1) | 2012-10-01 | McNamee et al. | Examiner |
| US2012/0255021(A1) | 2012-10-01 | Sallam | Examiner |
| US2012/0255031(A1) | 2012-10-01 | Sallam | Examiner |
| US2012/0278889(A1) | 2012-11-01 | El-Moussa | Applicant |
| US2012/0291131(A1) | 2012-11-01 | Turkulainen et al. | Examiner |
| US2013/0014259(A1) | 2013-01-01 | Gribble et al. | Examiner |
| US2013/0047147(A1) | 2013-02-01 | McNeill | Examiner |
| US2013/0055394(A1) | 2013-02-01 | Beresnevichiene et al. | Examiner |
| US2013/0091350(A1) | 2013-04-01 | Gluck | Examiner |
| US2013/0091570(A1) | 2013-04-01 | McCorkendale et al. | Examiner |
| US2013/0104230(A1) | 2013-04-01 | Tang et al. | Applicant |
| US2013/0145002(A1) | 2013-06-01 | Kannan et al. | Examiner |
| US2013/0145008(A1) | 2013-06-01 | Kannan et al. | Examiner |
| US2013/0152200(A1) | 2013-06-01 | Alme et al. | Examiner |
| US2013/0227165(A1) | 2013-08-01 | Liu | Applicant |
| US2013/0246685(A1) | 2013-09-01 | Bhargava et al. | Examiner |
| US2013/0298184(A1) | 2013-11-01 | Ermagan et al. | Applicant |
| US2013/0298192(A1) | 2013-11-01 | Kumar et al. | Applicant |
| US2013/0298230(A1) | 2013-11-01 | Kumar et al. | Applicant |
| US2013/0298242(A1) | 2013-11-01 | Kumar et al. | Applicant |
| US2013/0298243(A1) | 2013-11-01 | Kumar et al. | Applicant |
| US2013/0298244(A1) | 2013-11-01 | Kumar et al. | Applicant |
| US2013/0326625(A1) | 2013-12-01 | Anderson et al. | Applicant |
| US2014/0059641(A1) | 2014-02-01 | Chapman et al. | Applicant |
| US2014/0096131(A1) | 2014-04-01 | Sonnek et al. | Examiner |
| US2014/0283037(A1) | 2014-09-01 | Sikorski et al. | Examiner |
| US2014/0380474(A1) | 2014-12-01 | Paithane et al. | Examiner |
| US2015/0058984(A1) | 2015-02-01 | Shen et al. | Examiner |
| WO2012134584 | 2012-10-01 | Applicant | |
| WO2013067505 | 2013-05-01 | Applicant | |
| WO2013067508 | 2013-05-01 | Applicant | |
| WO2013134206 | 2013-09-01 | Applicant |
Non-Patent Literature (50)
- Sun et al, Malware Virtualization-resitant behavior detection, 2011 IEEE, pp. 912-917.Examiner
- Wagener et al., “An Instrumented Analysis of Unknown Software and Malware Driven by Free Libre Open Source Software”, Signal Image Technology and Internet Based Systems, 2008. SITIS'08. IEEE International Conference on. IEEE, 2008.Applicant
- Davidoff et al., “Chapter 12: Malware Forensics”, Network Forensics: Tracking Hackers Through Cyberspace, Pearson Education Inc., Jun. 2012, 60 pages.Applicant
- van der Heide et al., “DNS Anomaly Detection,” System and Network Engineering Research Group, University of Amsterdam, Feb. 6, 2011, 20 pages.Applicant
- Sikorski et al., “Chapter 14: Malware-Focused Network Signatures,” Practical Malware Anlaysis, No Starch Press, Feb. 2012, 13 pages.Applicant
- Zang et al., “Botnet Detection Through Fine Flow Classifcation”, CSE Dept. Technical Report No. CSE11-001, p. 1-17, Jan. 31, 2011.Applicant
- Landecki, Grzegorz, Detecting Botnets, Linux Journal, Jan. 1, 2009.Applicant
- Karasaridis, Anestis et al., Wide-scale Botnet Detection and Characterization, Dec. 14, 2010.Applicant
- Author Unknown, Advanced Persistent Threats (APT), What's an APT? A Brief Definition, Damballa, Dec. 14, 2010.Applicant
- Author Unknown, Executive Overview, The Command Structure of the Aurora Botnet, Damballa, Mar. 2010.Applicant
- Strayer, W. Timothy et al. Detecting Botnets with Tight Command and Control, BBN Technologies, Nov. 2006.Applicant
- Ramachandran, Anirudh et al., Revealing Botnet Membership Using DNSBL Counter-Intelligence, Jul. 7, 2006.Applicant
- Goebel, Jan et al., Rishi: Identify Bot Contaminated Hosts by IRC Nickname Evaluation, Apr. 2007.Applicant
- Gu, Guofei et al., BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic, Feb. 2008.Applicant
- Gu, Guofei et al., BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation, Aug. 2007.Applicant
- Gu, Guofei et al., BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection, Jul. 2008.Applicant
- Royal, Paul, Analysis of the Kraken Botnet, Damballa, Apr. 9, 2008.Applicant
- Livadas, Carl et al., Using Machine Learning Techniques to Identify Botnet Traffic, BBN Technologies, Nov. 2006.Applicant
- Binkley, James R. et al., An Algorithm for Anomaly-based Botnet Detection, Jul. 2006.Applicant
- Yen, Ting-Fang et al., Traffic Aggregation for Malware Detection, Jul. 2008.Applicant
- Author Unknown, Anatomy of a Targeted Attack, Damballa, Dec. 3, 2008.Applicant
- Author Unknown, Layer 8, How and Why Targeted Attacks Exploit Your Users, Damballa, Nov. 2011.Applicant
- Author Unknown, Targeted Attacks for Fun and Profit, An Executed Guide to a New and Growing Enterprise Threat, Damballa, Oct. 13, 2008.Applicant
- Author Unknown, AV, IDS/IPS and Damballa's Response to Targeted Attacks, A Technology Comparison, Damballa, Nov. 2008.Applicant
- Author Unknown, Updated on the Enemy, A Deconstruction of Who Profits From Botnets, Damballa, May 13, 2009.Applicant
- Author Unknown, A Day in the Life of a BotArmy, Damballa, Month Unknown, 2008 (2008 is prior to the year 2012).Applicant
- Ollmann, Gunter, Botnet Communication Topologies, Understanding the Intricacies of Bonet Command and Control, Damballa, Jun. 2009.Applicant
- Ollmann, Gunter, The Botnet vs. Malware Relationship, The One to one Botnet Myth, Damballa, Jun. 2009.Applicant
- Author Unknown, Closed Window, How Failsafe Enhancements Dramatically Limit Opportunities for Malware Armies and other Targeted Attacks, Damballa, Sep. 23, 2009.Applicant
- Author Unknown, Damballa's In-The-Cloud Security Model, Enterprise Protection Moves Beyond the Network Perimeter, Damballa, Aug. 24, 2008.Applicant
- Ollmann, Gunter, Extracting CnC from Malware, The Role of malware Sample Analysis in Botnet Detection, Damballa, Dec. 8, 2009.Applicant
- Ollmann, Gunter, The Opt-IN Botnet Generation, Hacktivism and Centrally Controlled Protesting, Social Networks, Damballa, Apr. 26, 2010.Applicant
- Ollmann, Gunter, Serial Variant Evasion Tactics, Techniques Used to Automatically Bypass Antivirus Technologies, Damballa, Oct. 7, 2009.Applicant
- Author Unknown, Damballa: A Different Approach, Targeted Attacks Requires a New Solution, Damballa, Sep. 23, 2008.Applicant
- Author Unknown, Trust Betrayed, What to Do When a Targeted Attack Turns Your Networks Against You, Damballa, Feb. 22, 2008.Applicant
- Author Unknown, How to Be a Hero in the War Against BotArmies, Damballa, Month Unknown, 2008 (2008 is prior to 2012).Applicant
- Giroire, Frederic et al., Exploiting Temporal Persistence to Detect Convert Botnet Channels, Sep. 2009.Applicant
- Russ White, “High Availability in Routing”, Mar. 2004, Cisco Systems, vol. 7, Issue 1, pp. 2-14.Applicant
- Yadav et al., “Detecting Algorithmically Generated Malicious Domain Names”, Nov. 2010.Applicant
- Abu Rajab et al., “A Multifaceted Approach to Understanding the Botnet Phenonmenon,” Proceedings of the 6th ACM SIGCOMM conference on Internet measurement, Oct. 2006, 12 pages.Applicant
- Author Unknown, “FireEye Malware Analysis”, FireEye.com, FireEye, Inc., Month Unknown, 2010 (2010 is prior to 2012).Applicant
- Author Unknown, “Hybrid Sandboxing for Detecting and Analyzing Advanced and Unknown Malware”, Blue Coat Systems, Inc., Nov. 2013.Applicant
- Author Unknown, “Multi-Vector Virtual Execution (MVX) Engine”, FireEye, Inc., http://www.fireeye.com/products-and-solutions/virtual-execution-engine.html, Jun. 2014.Applicant
- Chen et al., “Chapter 4: Guarding Against Network Intrusions,” Network and System Security, Elsevier Inc., Feb. 2009, 5 pages.Applicant
- Lau et al., “Measuring Virtual Machine Detection in Malware using DSD Tracer”, Sophoslabs, Journal in Computer Virology, Aug. 2008.Applicant
- Ligh et al., “Chapter 5: Researching Domains and IP Addresses,” Malware Analyst's Cookbook, John Wiley & Sons, Nov. 2010, 38 pages.Applicant
- Lindorfer et al., “Detecting Enviroment-Sensitive Malware”, Recent Advances in Intrusion Detection. Springer Berlin Heidelberg, Jan. 2011.Applicant
- Schechter et al., “Fast Detection of Scanning Worm Infections,” Recent Advances in Intrusion Detection: 7th International Symposium RAID 2004 Proceedings, Jan. 2004, 24 pages.Applicant
- Singh et al., “Hot Knives Through Butter: Evading File-based Sandboxes”, FireEye, Inc., Feb. 2014.Applicant
- Dittrich et al., P2P as Botnet Command and Control; A Deeper Insight, 2008 3rd International Conference on Malicious and Unwanted Software (Malware), Oct. 2008, IEEE, vol. 10, pp. 41-48.Applicant