Pipelined Malware Infrastructure Identification
Disclosed, in one general aspect, is a network security system that includes pipeline storage operative to receive a series of malware samples. A sandboxed operating environment is responsive to the pipeline storage and operative to automatically retrieve successive malware samples from the pipeline storage, to run each of the malware samples in the sandboxed operating environment after it is retrieved, and to analyze at least some communication from each of the malware samples as they are run. A verdict output is responsive to the sandboxed operating environment to provide a verdict for malicious internet infrastructure associated with at least some of the malware samples run in the sandboxed operating environment.
1 . A network security system, comprising:
pipeline storage operative to receive a series of malware samples,
a sandboxed operating environment responsive to the pipeline storage and operative to automatically retrieve successive malware samples from the pipeline storage, to run each of the malware samples in the sandboxed operating environment after it is retrieved, and to analyze at least some communication from each of the malware samples as they are run, and
a verdict output responsive to the sandboxed operating environment to provide a verdict for malicious internet infrastructure associated with at least some of the malware samples run in the sandboxed operating environment.
2 . The system of claim 1 further including an automatic file analysis tool operative to successively compare at least parts of each of the malware samples with patterns corresponding to known malware types, and wherein the verdict output is a combined verdict output responsive both to the traffic analysis tool and to the file analysis tool to provide a compound verdict for each of the malware samples run in the sandboxed operating environment based on results from both the network traffic analysis tool and the file analysis tool.
3 . The system of claim 1 further including verdict database storage operative to store the verdicts as they are output.
4 . The system of claim 1 further including command-and-control server probing logic operative to probe suspected command-and-control servers for the malware samples on an external network.
5 . The system of claim 3 further including candidate command-and-control server generation logic operative to generate candidate addresses for probing by the command-and-control server probing logic.
6 . The system of claim 4 wherein the candidate command-and-control server generation logic generates candidate addresses based on shared domain mappings.
7 . The system of claim 1 wherein the pipeline storage is responsive to malware providers and Internet repositories.
8 . The system of claim 1 wherein the network security system is operative to automatically process at least thousands of malware samples per day.
9 . The system of claim 1 wherein the network security system is operative to automatically process at least tens of thousands of malware samples per day.
10 . The system of claim 1 wherein the network security system is operative to automatically process at least hundreds of thousands of malware samples per day.
11 . The system of claim 1 wherein the verdict output is operative to provide a verdict for malware infrastructure associated with IP addresses.
12 . The system of claim 1 wherein the verdict output is operative to provide a verdict for malware infrastructure associated with Internet domains.
13 . The system of claim 1 wherein the verdict output is operative to provide a verdict for command-and-control servers.
14 . A network security method, comprising:
receiving a series of malware samples for processing,
automatically retrieving successive ones of the received malware samples to successively run each of the malware sample in the sandboxed operating environment,
automatically analyzing at least some network communication from each of the malware samples as they are run in the sandboxed operating environment, and
providing a verdict for malware infrastructure associated with at least some of the malware samples run in the sandboxed operating environment based on results from the automatic network communication analysis.
15 . A network security system, comprising:
means for receiving a series of malware samples for processing,
means for automatically retrieving successive ones of the received malware samples to successively run each of the malware samples in the sandboxed operating environment,
means for automatically analyzing at least some network communication from each of the malware samples as they are run in the sandboxed operating environment, and
means for providing a verdict for malware infrastructure associated with at least some of the malware samples run in the sandboxed operating environment based on results from the automatic network communication analysis.