Granted Patent B2

US 12,341,787 · App. 17/855,940 · Granted Jun 24, 2025

Inventors: Alexey Kleymenov (Massagno, CH); Moreno Carullo (Gavirate, IT); Andrea Carcano (San Francisco, CA)

Assignee: Nozomi Networks Sagl

H04L63/1416H04L9/3247

Abstract

Claims (20)

1. A method for automatic signatures generation from a plurality of sources, comprising:

defining a plurality of identified sources of samples providers;

collecting, by a computerized data processing unit, input samples from said sample providers;

extracting, by the computerized data processing unit, raw indicators of compromise (IoCs) from said input samples;

verifying, by said computerized data processing unit, said input samples defining verified input samples;

generating, by said computerized data processing unit, verified signatures from said verified input samples;

storing, in a verified signatures database operatively connected to said computerized data processing unit, said verified signatures;

wherein said collecting comprises extracting raw IoCs from said input samples;

wherein said verifying comprises evaluating the reputation of each of said raw IoCs according to predefined reputation rules and comparing each of said raw IoCs with a database of existing signatures operatively connected to said data processing unit to define allowable raw IoCs; and

wherein said generating comprises creating said verified signatures from said verified input samples corresponding to said allowable raw IoCs, by inserting each allowable raw IoC into a predefined structured format including associated metadata.

2. The method for automatic signatures generation from a plurality of sources according to claim 1 , wherein said verified signatures are structured in a STIX format.

3. The method for automatic signatures generation from a plurality of sources according to claim 1 , wherein said input samples comprises input IoCs and pre-existing threat detection signatures.

4. The method for automatic signatures generation from a plurality of sources according to claim 1 , wherein said verified signatures are created by inserting said allowable raw IoCs into a predefined structure coupled with associated metadata.

5. The method for automatic signatures generation from a plurality of sources according to claim 4 , wherein said predefined structure is an XML structure or a JSON structure.

6. The method for automatic signatures generation from a plurality of sources according to claim 4 , wherein said metadata comprises information relating to one or more of: date of creation, time of creation, malware category.

7. The method for automatic signatures generation from a plurality of sources according to claim 1 , wherein said method further comprises filtering said input samples after collecting said input samples;

wherein said collecting comprises extracting raw signatures from said input samples; and

wherein said filtering comprises identifying verified signatures by removing said raw signatures containing artifacts.

8. The method for automatic signatures generation from a plurality of sources according to claim 1 , wherein said method further comprises receiving telemetry data related to usage or performance of said verified signatures.

9. The method of claim 1 , wherein said raw indicators of compromise include one or more of: IP addresses, domain names, file hashes, email addresses, or URLs.

Assignments (1)

Continuity (1)

References Cited (14)