Malicious pattern extraction via fuzzing
Various techniques for malicious pattern extraction via fuzzing are disclosed. In some embodiments, a system/process/computer program product for malicious pattern extraction via fuzzing includes receiving a malicious sample (e.g., the malicious sample can be an executable file, such as a binary, script, etc., or a file that includes content for inputting into an application, such as for an office productivity suite or another application); mutating the malicious sample using fuzzing; and generating a signature based on a critical path (e.g., a malware signature can be automatically generated by a cloud security service for detection of the malicious sample, and the cloud security service can distribute the malware signature to a plurality of firewalls and/or other security entities to subscribers of a security service).
1 . A system, comprising:
a processor configured to:
receive a malicious sample;
mutate the malicious sample using fuzzing to obtain a critical path, comprising to:
modify the malicious sample to identify mutation targets for fuzzing;
determine that a different behavior of the modified malicious sample is observed based on an execution flow of the modified malicious sample;
in response to a determination that the different behavior of the modified malicious sample is observed, store the observed different behavior of the modified malicious sample; and
detect the critical path for the malicious sample based on the stored the observed different behavior;
generate a signature based on the critical path; and
distribute the signature to a security service for detection of the malicious sample; and
a memory coupled to the processor and configured to provide the processor with instructions.
2 . The system of claim 1 , wherein the signature is a malware signature that is automatically generated.
3 . The system of claim 1 , wherein the signature is a malware signature that is automatically generated by a cloud security service for detection of the malicious sample.
4 . The system of claim 1 , wherein the signature is a malware signature that is automatically generated by a cloud security service for detection of the malicious sample, and wherein the cloud security service distributes the malware signature to subscribers of a security service.
5 . The system of claim 1 , wherein the signature is a malware signature that is automatically generated by a cloud security service for detection of the malicious sample, and wherein the cloud security service distributes the malware signature to subscribers of a security service for an intrusion detection system (IDS) and/or an intrusion prevention system (IPS).
6 . The system of claim 1 , wherein the signature is a malware signature that is automatically generated by a cloud security service for detection of the malicious sample, and wherein the cloud security service distributes the malware signature to a plurality of firewalls to subscribers of a security service.
7 . The system of claim 1 , wherein the malicious sample is associated with an executable file or a file that includes content for inputting into an application.
8 . The system of claim 1 , wherein the signature is verified to check for false positives.
9 . The system of claim 1 , wherein the processor is further configured to:
analyze execution flow of the malicious sample to identify mutation targets for fuzzing.
10 . A method, comprising:
receiving a malicious sample;
mutating the malicious sample using fuzzing to obtain a critical path, comprising:
modifying the malicious sample to identify mutation targets for fuzzing;
determining that a different behavior of the modified malicious sample is observed based on an execution flow of the modified malicious sample;
in response to a determination that the different behavior of the modified malicious sample is observed, storing the observed different behavior of the modified malicious sample; and
detecting the critical path for the malicious sample based on the stored the observed different behavior;
generating a signature based on the critical path; and
distributing the signature to a security service for detection of the malicious sample.
11 . The method of claim 10 , wherein the signature is a malware signature that is automatically generated.
12 . The method of claim 10 , wherein the signature is a malware signature that is automatically generated by a cloud security service for detection of the malicious sample.
13 . The method of claim 10 , wherein the signature is a malware signature that is automatically generated by a cloud security service for detection of the malicious sample, and wherein the cloud security service distributes the malware signature to subscribers of a security service.
14 . The method of claim 10 , wherein the signature is a malware signature that is automatically generated by a cloud security service for detection of the malicious sample, and wherein the cloud security service distributes the malware signature to subscribers of a security service for an intrusion detection system (IDS) and/or an intrusion prevention system (IPS).
15 . The method of claim 10 , wherein the signature is a malware signature that is automatically generated by a cloud security service for detection of the malicious sample, and wherein the cloud security service distributes the malware signature to a plurality of firewalls to subscribers of a security service.
16 . The method of claim 10 , wherein the malicious sample is associated with an executable file or a file that includes content for inputting into an application.
17 . A computer program product embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
receiving a malicious sample;
mutating the malicious sample using fuzzing to obtain a critical path, comprising:
modifying the malicious sample to identify mutation targets for fuzzing;
determining that a different behavior of the modified malicious sample is observed based on an execution flow of the modified malicious sample;
in response to a determination that the different behavior of the modified malicious sample is observed, storing the observed different behavior of the modified malicious sample; and
detecting the critical path for the malicious sample based on the stored the observed different behavior;
generating a signature based on the critical path; and
distributing the signature to a security service for detection of the malicious sample.
18 . The computer program product recited in claim 17 , wherein the signature is a malware signature that is automatically generated.