IP Library › Granted Patent US 12701125
Granted Patent B2
US 12701125 · App. 18/649,280 · Granted Aug 4, 2026

Deep learning for in-line detection of malicious command and control traffic from unstructured payloads

Inventors: Chitra Priyaa Sathya Moorthy (Cupertino, CA); Lei Xu (Sunnyvale, CA)
Assignee: Palo Alto Networks, Inc.
H04L63/1416
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12701125
App. No.
18/649,280
Granted
Aug 4, 2026
Kind
B2
Abstract

Various techniques for providing deep learning for inline detection of malicious command and control (C2) traffic from unstructured payloads are disclosed. In some embodiments, a system/process/computer program product for providing deep learning for inline detection of malicious C2 traffic from unstructured payloads includes monitoring a session at a security platform, wherein the session includes network traffic; executing a local deep learning model on the network traffic, wherein the local deep learning model is a machine learning implemented C2 (MLC2) model executed on the security platform; and performing an action in response to determining that the monitored session is associated with malware based at least in part on a verdict from the deep learning model.

Claims (47)

1 . A system, comprising:

a processor configured to:

monitor a session at a security platform, wherein the session includes network traffic;

execute a local deep learning model on the network traffic, wherein the local deep learning model is a machine learning implemented command and control (MLC2) model executed on the security platform;

perform an action in response to determining that the monitored session is associated with malware based at least in part on a verdict from the deep learning model; and

update the local deep learning model using new training data, wherein the new training data includes User Datagram Protocol (UDP) traffic, wherein a payload of a UDP packet of the UDP traffic includes a reputation of source and destination IP addresses of the UDP packet, wherein the updating of the local deep learning model comprises to:

input the new training data into the local deep learning model;

perform byte-level and/or word-level tokenization and embedding of the UDP traffic; and

generate the updated local deep learning model based on the byte-level and/or the word-level tokenization and embedding; and

a memory coupled to the processor and configured to provide the processor with instructions.

2 . The system of claim 1 , wherein the MLC2 model automatically detects command and control (C2) traffic.

3 . The system of claim 1 , wherein the MLC2 model is generated as a convolutional neural network (CNN) implemented model.

4 . The system of claim 1 , wherein the action includes dropping the network traffic, blocking the network traffic, generating an alert, logging the network traffic, quarantining an endpoint associated with the network traffic, and/or sending the network traffic to a security cloud entity for further analysis.

5 . The system of claim 1 , wherein the processor is further configured to:

perform prefiltering at the security platform on the network traffic to determine whether to apply the local deep learning model.

6 . The system of claim 1 , wherein the processor is further configured to:

input a byte stream associated with the network traffic into the local deep learning model.

7 . The system of claim 1 , wherein the processor is further configured to:

input a byte stream associated with the network traffic into the local deep learning model; and

perform tokenization processing of the byte stream provided as input into the local deep learning model.

8 . The system of claim 1 , wherein the processor is further configured to:

input a byte stream associated with the network traffic into the local deep learning model; and

perform tokenization processing of the byte stream provided as input into the local deep learning model, wherein one or more bytes are extracted from the byte stream and translated into one or more tokens.

9 . The system of claim 1 , wherein the processor is further configured to:

input a byte stream associated with the network traffic into the local deep learning model;

perform tokenization processing of the byte stream provided as input into the local deep learning model, wherein one or more bytes are extracted from the byte stream and translated into one or more tokens; and

generate a score using the local deep learning model that processes the one or more tokens.

10 . A method, comprising:

monitoring a session at a security platform, wherein the session includes network traffic;

executing a local deep learning model on the network traffic, wherein the local deep learning model is a machine learning implemented command and control (MLC2) model executed on the security platform;

performing an action in response to determining that the monitored session is associated with malware based at least in part on a verdict from the deep learning model; and

updating the local deep learning model using new training data, wherein the new training data includes User Datagram Protocol (UDP) traffic, wherein a payload of a UDP packet of the UDP traffic includes a reputation of source and destination IP addresses of the UDP packet, wherein the updating of the local deep learning model comprises:

inputting the new training data into the local deep learning model;

performing byte-level and/or word-level tokenization and embedding of the UDP traffic; and

generating the updated local deep learning model based on the byte-level and/or the word-level tokenization and embedding.

11 . The method of claim 10 , wherein the MLC2 model automatically detects command and control (C2) traffic.

12 . The method of claim 10 , wherein the MLC2 model is generated as a convolutional neural network (CNN) implemented model.

13 . The method of claim 10 , wherein the MLC2 model is generated as a convolutional neural network (CNN) implemented model that is trained using byte-level and/or word-level tokenization.

14 . The method of claim 10 , wherein the action includes dropping the network traffic, blocking the network traffic, generating an alert, logging the network traffic, quarantining an endpoint associated with the network traffic, and/or sending the network traffic to a security cloud entity for further analysis.

15 . A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:

monitoring a session at a security platform, wherein the session includes network traffic;

executing a local deep learning model on the network traffic, wherein the local deep learning model is a machine learning implemented command and control (MLC2) model executed on the security platform;

performing an action in response to determining that the monitored session is associated with malware based at least in part on a verdict from the deep learning model; and

updating the local deep learning model using new training data, wherein the new training data includes User Datagram Protocol (UDP) traffic, wherein a payload of a UDP packet of the UDP traffic includes a reputation of source and destination IP addresses of the UDP packet, wherein the updating of the local deep learning model comprises:

inputting the new training data into the local deep learning model;

performing byte-level and/or word-level tokenization and embedding of the UDP traffic; and

generating the updated local deep learning model based on the byte-level and/or the word-level tokenization and embedding.