Malicious HTTP cookies detection and clustering

1. A system, comprising:

a processor configured to:

receive a sample at a cloud security service;

detonate the sample in an instrumented virtual environment to monitor network traffic associated with the sample;

extract a cookie from the network traffic associated with the sample;

extract a textual pattern from the cookie wherein the textual pattern includes a key-value pair associated with the cookie;

perform a textual analysis of the key-value pair associated with the cookie,

wherein the textual analysis of the key-value pair associated with the cookie includes one or more of following: length, types of characters, upper/lower case letters, use of specific characters, and an entropy analysis;

determine that the cookie is associated with malware based on the textual analysis of the key-value pair associated with the cookie;

generate a signature for detecting malware based on one or more patterns extracted from the cookie; and

distribute the signature for detecting malware to a plurality of subscribing security devices; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the cookie is extracted from a packet capture of the network traffic associated with the sample.

3. The system recited in claim 1 , wherein the cookie is an HTTP cookie.

4. The system recited in claim 1 , wherein the processor is further configured to:

extract one or more strings from the cookie.

5. The system recited in claim 1 , wherein the processor is further configured to:

extract one or more strings from the cookie; and

analyze the one or more strings.

6. The system recited in claim 1 , wherein the processor is further configured to:

extract one or more patterns from the cookie to generate the signature.

7. The system recited in claim 1 , wherein the processor is further configured to:

generate a cluster of a plurality of cookies including the cookie to determine whether the cookie is a malicious cookie.

8. The system recited in claim 1 , wherein the processor is further configured to:

apply a false positive filter to verify that the signature does not match a threshold level of benign network traffic.

9. A method, comprising:

receiving a sample at a cloud security service;

detonating the sample in an instrumented virtual environment to monitor network traffic associated with the sample;

extracting a cookie from the network traffic associated with the sample;

extracting a textual pattern from the cookie wherein the textual pattern includes a key-value pair associated with the cookie;

performing a textual analysis of the key-value pair associated with the cookie, wherein the textual analysis of the key-value pair associated with the cookie includes one or more of following: length, types of characters, upper/lower case letters, use of specific characters, and an entropy analysis;

determining that the cookie is associated with malware based on the textual analysis of the key-value pair associated with the cookie using a processor;

generating a signature based on one or more patterns extracted from the cookie; and

distributing the signature for detecting malware to a plurality of subscribing security devices.

10. The method of claim 9 , wherein the cookie is extracted from a packet capture of the network traffic associated with the sample.

11. The method of claim 9 , wherein the cookie is an HTTP cookie.

12. The method of claim 9 , further comprising:

extracting one or more strings from the cookie; and

analyzing the one or more strings.

13. The method of claim 9 , further comprising:

extracting one or more patterns from the cookie to generate the signature.

14. The method of claim 9 , further comprising:

applying a false positive filter to verify that the signature does not match a threshold level of benign network traffic.

15. A computer program product, the computer program product being embodied in a non-transitory, tangible computer readable storage medium and comprising computer instructions for:

receiving a sample at a cloud security service;

detonating the sample in an instrumented virtual environment to monitor network traffic associated with the sample;

extracting a cookie from the network traffic associated with the sample;

extracting a textual pattern from the cookie wherein the textual pattern includes a key-value pair associated with the cookie;

performing a textual analysis of the key-value pair associated with the cookie, wherein the textual analysis of the key-value pair associated with the cookie includes one or more of following: length, types of characters, upper/lower case letters, use of specific characters, and an entropy analysis;

determining that the cookie is associated with malware based on the textual analysis of the key-value pair associated with the cookie; using a processor;

generating a signature based on one or more patterns extracted from the cookie; and distributing the signature for detecting malware to a plurality of subscribing security devices.

16. The computer program product recited in claim 15 , wherein the cookie is extracted from a packet capture of the network traffic associated with the sample.

17. The computer program product recited in claim 15 , further comprising computer instructions for:

extracting one or more strings from the cookie; and

analyzing the one or more strings.

18. The computer program product recited in claim 15 , further comprising computer instructions for:

extracting one or more patterns from the cookie to generate the signature.

19. The computer program product recited in claim 15 , further comprising computer instructions for:

applying a false positive filter to verify that the signature does not match a threshold level of benign network traffic.