IP Library › Granted Patent US 9,710,646

Granted Patent B1

US 9,710,646 · App. 13/777,995 · Granted Jul 18, 2017

Malware detection using clustering with malware source information

Inventors: Yanxin Zhang (San Ramon, CA); Xinran Wang (San Ramon, CA); Huagang Xie (Pleasanton, CA); Wei Xu (Santa Clara, CA)

Assignee: Palo Alto Networks, Inc.

G06F21/56 H04L63/14 G06F21/568 H04L63/1441

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 9,710,646
App. No.: 13/777,995
Granted: Jul 18, 2017
Kind: B1

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Techniques for malware detection using clustering with malware source information are disclosed. In some embodiments, malware detection using clustering with malware source information includes generating a first cluster of source information associated with a first malware sample, in which the first malware sample was determined to be malware, and the first malware sample was determined to be downloaded from a first source; and determining that a second source is associated with malware based on the first cluster.

Claims (53)

1. A system for malware detection using clustering with malware source information, comprising:

a processor configured to:

generate a first cluster of source information associated with a first malware sample, wherein the first malware sample was determined to be malware, wherein the first malware sample was determined to be downloaded from a first source, and wherein the generating of the first cluster of source information comprises:

generate a directed graph associating a plurality of source information with the first malware sample to generate the first cluster of source information, the directed graph including a set of nodes and a set of edges, at least one node of the set of nodes relating to source information of a known malware, at least one edge of the set of edges representing a relationship based a first node of the set of nodes and a second node of the set of nodes, source information of the at least one node includes a domain, an IP address, or a combination thereof; the generating of the first cluster of source information being based at least in part on a clustering algorithm, the clustering algorithm including a recursive algorithm to find samples and domains that are correlated, the directed graph including:

source information of the first malware sample including at least one of a) a source domain, a source Internet Protocol (IP) address, or a combination thereof, and b) a visiting domain, a visiting IP address, or a combination thereof, the visiting domain being a domain that the first malware sample attempted to send information thereto and/or receive information therefrom, and the visiting IP address being an IP address that the first malware sample attempted to send information thereto and/or receive information therefrom;

obtain a second malware sample for analysis;

determine whether a second source of the second malware sample is associated with malware based on the first cluster, comprising;

traverse the directed graph to determine whether the second malware sample associated with the second source is associated with the first cluster, comprising to:

determine whether the second source is associated with at least one source of the first cluster of source information, comprising to:

determine whether an edge of the set of edges is connected to the second source of the second malware sample, the second source having an association with a) a source domain, a source Internet Protocol (IP) address, or a combination thereof, and b) a visiting domain, a visiting IP address, or a combination thereof; and

in the event that the edge of the set of edges is connected to the second source, determine that the second source is associated with at least one source of the first cluster of source information; and

in the event that the second malware sample is associated with the first cluster:

extract a signature from the second malware sample;

store the extracted signature in a database; and

send the extracted signature to a security device; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the first cluster associates related Internet Protocol (IP) address information and related domain information with the first malware sample.

3. The system recited in claim 1 , wherein the first cluster is generated using a searchable graph that associates related Internet Protocol (IP) address information and related domain information with the first malware sample.

4. The system recited in claim 1 , wherein the processor is further configured to:

determine a domain is associated with a malware family based on an association with the first cluster.

5. The system recited in claim 1 , wherein the processor is further configured to:

determine an Internet Protocol (IP) address is associated with a malware family based on an association with the first cluster.

6. The system recited in claim 1 , wherein the directed graph further includes the first malware sample having an association with an IP address resolved from a domain associated with the directed graph.

7. A method of malware detection using clustering with malware source information, comprising:

generating, using a hardware processor, a first cluster of source information associated with a first malware sample, wherein the first malware sample was determined to be malware, wherein the first malware sample was determined to be downloaded from a first source, and wherein the generating of the first cluster of source information comprises:

generating a directed graph associating a plurality of source information with the first malware sample to generate the first cluster of source information, the directed graph including a set of nodes and a set of edges, at least one node of the set of nodes relating to source information of a known malware, at least one edge of the set of edges representing a relationship based a first node of the set of nodes and a second node of the set of nodes, source information of the at least one node includes a domain, an IP address, or a combination thereof, the generating of the first cluster of source information being based at least in part on a clustering algorithm, the clustering algorithm including a recursive algorithm to find samples and domains that are correlated, the directed graph including:

obtaining a second malware sample for analysis;

determining, using the hardware processor, whether a second source of the second malware sample is associated with malware based on the first cluster, comprising;

traversing the directed graph to determine whether the second malware sample with the second source is associated with the first cluster, comprising;

determining whether the second source is associated with at least one source of the first cluster of source information, comprising:

determining whether an edge of the set of edges is connected to the second source of the second malware sample, the second source having an association with a) a source domain, a source Internet Protocol (IP) address, or a combination thereof, and b) a visiting domain, a visiting IP address, or a combination thereof; and

in the event that the edge of the set of edges is connected to the second source, determining that the second source is associated with at least one source of the first cluster of source information; and

in the event that the second malware sample is associated with the first cluster:

extracting a signature from the second malware sample;

storing the extracted signature in a database; and

sending the extracted signature to a security device.

8. A computer program product for malware detection using clustering with malware source information, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

generating a first cluster of source information associated with a first malware sample, wherein the first malware sample was determined to be malware, wherein the first malware sample was determined to be downloaded from a first source, and wherein the generating of the first cluster of source information comprises:

obtaining a second malware sample for analysis;

determining whether a second source of the second malware sample is associated with malware based on the first cluster, comprising;

traversing the directed graph to determine whether the second malware sample associated with the second source is associated with the first cluster, comprising:

determining whether the second source is associated with at least one source of the first cluster of source information, comprising:

in the event that the second malware sample is associated with the first cluster:

extracting a signature from the second malware sample;

storing the extracted signature in a database; and

sending the extracted signature to a security device.

9. The computer program product recited in claim 8 , further comprising computer instructions for:

determining a domain or an Internet Protocol (IP) address is associated with a malware family based on an association with the first cluster.

Assignments (1)

ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded May 24, 2013

From: ZHANG, YANXIN; WANG, XINRAN; XIE, HUAGANG; XU, WEI

To: PALO ALTO NETWORKS, INC.

Reel/Frame 030485/0690 →