Application identification for phishing detection

Abstract

Application identification techniques for phishing detection are disclosed. In some embodiments, a system / process / computer program product for application identification for phishing detection includes monitoring network activity associated with a session to detect a request to access a site; determining an advanced application identifier associated with the site; and identifying the site as a phishing site based on the advanced application identifier.

Description

Background Art

[0001] A firewall generally protects a network from unauthorized access while allowing authorized communications to pass through the firewall. A firewall is typically a device or set of devices that provide firewall functionality for network access, or software executed on a device such as a computer. For example, a firewall can be integrated into the operating system of a device (e.g., a computer, a smart phone, or other type of device with network communication capabilities). A firewall can also be integrated into or executed as software on a computer server, a gateway, a network / routing device (e.g., a network router), or a data device (e.g., a security device or other type of dedicated device).

[0002] Firewalls typically deny or permit network traffic based on a set of rules. These rule sets are often referred to as policies. For example, a firewall can filter inbound traffic by applying a set of rules or a set of policies. A firewall can also filter outbound traffic by applying a set of rules or a set of policies. Firewalls may also be able to perform basic routing functions. BRIEF DESCRIPTION OF THE DRAWINGS

[0003] Various embodiments of the invention are disclosed in the following detailed description and accompanying drawings.

[0004] Figure 1 An example of an environment in which malicious applications are detected and prevented from causing harm is illustrated.

[0005] Figure 2A An embodiment of a data device is illustrated.

[0006] Figure 2B is a functional diagram of the logical components of an embodiment of a data device.

[0007] Figure 3 Examples of logical components that may be included in a system for analyzing a sample are illustrated.

[0008] Figure 4 Illustrated are portions of an example embodiment of a threat detection engine using application identification in accordance with some embodiments.

[0009] Figures 5A-5C Illustrated are example phishing sites that may be detected using application identification for phishing detection in accordance with some embodiments.

[0010] Figure 6 is a flow diagram of a process for application identification for phishing detection in accordance with some embodiments.

[0011] Figure 7 is another flow diagram of a process for application identification for phishing detection in accordance with some embodiments. DETAILED DESCRIPTION

[0012] The present invention may be implemented in many ways, including as a process; an apparatus; a system; a composition of matter; a computer program product embodied on a computer-readable storage medium; and / or a processor, such as a processor configured to execute instructions stored on and / or provided by a memory coupled to the processor. In this specification, these implementations or any other form that the present invention may take may be referred to as techniques. In general, the order of the steps of the disclosed process may be changed within the scope of the present invention. Unless otherwise stated, components such as processors or memories described as being configured to perform tasks may be implemented as general components that are temporarily configured to perform tasks at a given time or as specific components that are manufactured to perform tasks. As used herein, the term "processor" refers to one or more devices, circuits, and / or processing cores configured to process data such as computer program instructions.

[0013] A detailed description of one or more embodiments of the present invention and the accompanying drawings illustrating the principles of the present invention are provided below. The present invention is described in conjunction with such embodiments, but the present invention is not limited to any embodiment. The scope of the present invention is limited only by the claims, and the present invention encompasses many alternatives, modifications and equivalents. In order to provide a thorough understanding of the present invention, many specific details are set forth in the following description. These details are provided for illustrative purposes, and the present invention can be practiced according to the claims without some or all of these specific details. For the purpose of clarity, technical materials known in the technical field related to the present invention are not described in detail to avoid unnecessarily obscuring the present invention.

[0014] A firewall generally protects a network from unauthorized access while allowing authorized communications to pass through the firewall. A firewall is typically a device, a set of devices, or software executed on a device that provides firewall functionality for network access. For example, a firewall can be integrated into an operating system of a device (e.g., a computer, a smart phone, or other type of device with network communication capabilities). A firewall can also be integrated into various types of devices or security devices, or executed as a software application on various types of devices or security devices, such as computer servers, gateways, network / routing devices (e.g., network routers), or data devices (e.g., security devices or other types of dedicated devices).

[0015] Firewalls typically deny or allow network transmissions based on rule sets. These rule sets are often referred to as policies (e.g., network policies or network security policies). For example, a firewall can filter inbound traffic by applying a rule set or policy set to prevent unwanted external traffic from reaching the protected device. A firewall can also filter outbound traffic by applying a rule set or policy set (e.g., allowing, blocking, monitoring, notifying, or logging, and / or other actions that can be specified in a firewall / security rule or firewall / security policy, which can be triggered based on various criteria, such as described herein). A firewall can also apply antivirus protection, malware detection / prevention, or intrusion protection by applying a rule or policy set.

[0016] Security devices (e.g., security appliances, security gateways, security services, and / or other security devices) may include various security functions (e.g., firewalls, anti-malware, intrusion prevention / detection, proxies, and / or other security functions), networking functions (e.g., routing, quality of service (QoS), workload balancing of network-related resources, and / or other networking functions), and / or other functions. For example, routing functions may be based on source information (e.g., source IP address and port), destination information (e.g., destination IP address and port), and protocol information.

[0017] Basic packet filtering firewalls filter network communication traffic by inspecting individual packets transmitted on the network (e.g., packet filtering firewalls or first generation firewalls, which are stateless packet filtering firewalls). Stateless packet filtering firewalls typically inspect the individual packets themselves and apply rules based on the inspected packets (e.g., using a combination of the packet's source and destination address information, protocol information, and port numbers).

[0018] Application firewalls can also perform application layer filtering (e.g., using an application layer filtering firewall or second generation firewall, which works at the application level of the TCP / IP stack). Application layer filtering firewalls or application firewalls can generally identify certain applications and protocols (e.g., web browsing using Hypertext Transfer Protocol (HTTP), Domain Name System (DNS) requests, file transfers using File Transfer Protocol (FTP), and various other types of applications and other protocols, such as Telnet, DHCP, TCP, UDP, and TFTP (GSS)). For example, an application firewall can block unauthorized protocols that attempt to communicate on standard ports (e.g., unauthorized / non-compliant protocols that attempt to sneak through using non-standard ports for the protocol can generally be identified using an application firewall).

[0019] A stateful firewall may also perform stateful packet inspection, where each packet is inspected within the context of a series of packets associated with a packet flow / packet stream transmitted by the network (e.g., a stateful firewall or third generation firewall). This firewall technology is often referred to as stateful packet inspection because it maintains a record of all connections passing through the firewall and is able to determine whether a packet is the start of a new connection, part of an existing connection, or an invalid packet. For example, the state of a connection itself can be one of the criteria for triggering a rule within a policy.

[0020] As discussed above, advanced or next-generation firewalls can perform stateless and stateful packet filtering as well as application layer filtering. Next-generation firewalls can also perform additional firewall technologies. For example, some newer firewalls (sometimes referred to as advanced or next-generation firewalls) can also identify users and content. In particular, some next-generation firewalls are expanding the list of applications that these firewalls can automatically identify to thousands of applications. Examples of such next-generation firewalls are commercially available from PaloAlto Networks (e.g., Palo Alto Networks' PA Series Next-Generation Firewalls, Palo Alto Networks' VM Series Virtualized Next-Generation Firewalls, and CN Series Container Next-Generation Firewalls).

[0021] For example, Palo Alto Networks' next-generation firewall enables enterprises and service providers to identify and control applications, users, and content, not just ports, IP addresses, and packets, using a variety of identification technologies such as: App-ID for accurate application identification TM (e.g., application ID), User-ID for user identification (e.g., by user or user group) TM (e.g., User ID), and Content-ID for real-time content scanning (e.g., controlling web surfing and limiting data and file transfers) TM (e.g., Content ID). These identification technologies allow enterprises to securely enable application usage using business-relevant concepts rather than following the traditional approach provided by traditional port-blocking firewalls. In addition, dedicated hardware of next-generation firewalls implemented as, for example, dedicated appliances generally provide higher performance levels for application inspection than software executed on general-purpose hardware (e.g., security appliances such as those provided by Palo Alto Networks, which utilize dedicated, function-specific processing that is tightly integrated with a single-channel software engine to maximize network throughput while minimizing latency in Palo Alto Networks' PA Series Next-Generation Firewalls).

[0022] Technical Overview of Application Identification for Phishing Detection

[0023] Phishing is a growing security threat, with approximately 1.5 million new phishing sites identified each month. Specifically, we have witnessed a significant increase in phishing attacks since the start of the COVID-19 pandemic (e.g., which has led to a greater number of businesses allowing employees and contractors to work from home (remotely)).

[0024] Existing methods for detecting phishing attacks have various disadvantages. For example, signature detection methods based on pattern matching are often prone to false positives (FP) because of the high similarity between the original web page of the target site and the phishing page that attempts to emulate / mimic the target site (e.g., because such phishing pages are often created to mimic the original web page, such as the login page of a banking site, an e-commerce site, a streaming media site, etc.). As another example, URL-based detection methods often require an offline analyzer to observe the exact same page as the customer (e.g., as the customer's corporate firewall, but based on various camouflage techniques using geographic location targets, this is often not the case, e.g., only German location targets will receive phishing pages, as opposed to customers elsewhere in Europe, etc., and if the security service provider has its servers located in a different geographic location from the target location, this will not result in the phishing site being presented for security analysis, such as by the security service provider's cloud-based security platform that can perform URL or other security analysis).

[0025] Therefore, there is a need for new and improved techniques for detecting phishing.

[0026] As such, various techniques for application identification (App-ID) for phishing detection are disclosed. For example, the disclosed techniques facilitate integrated use of advanced application identification (App-ID) (e.g., as used herein, advanced application identification (App-ID) includes (1) identification of a protocol (e.g., HTTP, HTTPS, SSL, TLS, etc.) and (2) identification of a website based on analysis of web page content, generally referred to herein as site similarity) in combination with various other techniques to provide more efficient and effective phishing detection (e.g., increased coverage and lower FP rate), as will be described herein.

[0027] In some embodiments, a system / process / computer program product for application identification for phishing detection includes: monitoring network activity associated with a session to detect requests to access a site; determining a high-level application identification associated with the site; and identifying the site as a phishing site based on the high-level application identification.

[0028] For example, the disclosed application identification techniques for phishing detection can be performed to facilitate more effective and efficient online detection and blocking of phishing sites (e.g., at a security platform such as a perimeter firewall). The disclosed techniques also facilitate improved phishing detection rates compared to existing stand-alone approaches. Furthermore, the disclosed techniques use such a combination of detection techniques and application identification (e.g., as opposed to existing approaches that perform only web page content analysis alone) resulting in lower FP rates, which will also be described further below.

[0029] Thus, in accordance with some embodiments, new and improved security solutions are disclosed that facilitate the application of application identification to phishing detection using a security platform (e.g., a firewall (FW) / next-generation firewall (NGFW), a network sensor acting on behalf of a firewall, or another (virtual) device / component that can implement security policies using the disclosed techniques, including, for example, Palo Alto Networks' PA Series Next-Generation Firewalls, Palo Alto Networks' VM Series Virtualized Next-Generation Firewalls, and CN Series Container Next-Generation Firewalls, and / or other commercially available virtual-based or container-based firewalls that can similarly be implemented and configured to perform the disclosed techniques).

[0030] These and other embodiments and examples of applying application identification to phishing detection are described further below.

[0031] Example system architecture for application identification for phishing detection

[0032] Thus, in some embodiments, the disclosed technology includes providing a security platform (e.g., security function(s) / platform(s) may be implemented using a firewall (FW) / next-generation firewall (NGFW), a network sensor acting on behalf of a firewall, or another (virtual) device / component that may implement security policies using the disclosed technology, such as PANOS or another security platform / NFGW executed on a virtual / physical NGFW solution commercially available from Palo Alto Networks, including, for example, Palo Alto Networks' PA Series Next-Generation Firewalls, Palo Alto Networks' VM Series Virtualized Next-Generation Firewalls, and CN Series Container Next-Generation Firewalls, and / or other commercially available virtual-based or container-based firewalls that may be similarly implemented and configured to perform the disclosed technology), the security platform being configured to provide, for example, DPI capabilities (e.g., including stateful inspection) that apply App-ID to phishing detection based on policy (e.g., Layer 7 security and / or other security policy enforcement), as further described below.

[0033] Figure 1 An example of an environment in which malicious applications ("malware") are detected and prevented from causing harm is illustrated. As will be described in more detail below, malware classification (e.g., by security platform 122) may be performed in Figure 1 The environments shown in FIG. 1 and FIG. 2 are variously shared and / or refined between the various entities included in the environments shown in FIG. 1 and FIG. 2 . Also, using the techniques described herein, devices such as endpoint client devices 104 - 110 may be protected from such malware (eg, including phishing-related malware).

[0034] As used herein, "malware" refers to an application that engages in behavior - whether secret or not (and whether illegal or not) - that the user does not approve of / would not approve of in full knowledge. Examples of malware include ransomware, Trojans, viruses, rootkits, spyware, hacker tools, and the like. One example of malware is a desktop application that encrypts a user's stored data (e.g., ransomware). Another example of malware is a desktop application that collects and reports to a remote server the activities of an end user and / or various information associated with the user (e.g., spyware). Other forms of malware (e.g., keyloggers) may also be detected / blocked using improved phishing detection techniques as will be further described herein.

[0035] The term "phishing" is used throughout the specification to collectively refer to messages, such as electronic mail (email) messages, text messages, and / or various other types of messages, such as via social or work productivity related messaging platforms, in which an attacker sends a fraudulent message (e.g., spoofed, forged, or otherwise deceptive content and / or web links) designed to trick a user / individual into performing actions to facilitate malicious and / or undesirable activities (e.g., revealing sensitive information to the attacker, such as login information or other personal / confidential information or credentials, or facilitating the download of malware, such as by visiting a deceptive website, deploying malware, such as ransomware, on a user's infrastructure, etc.). As further discussed herein, as phishing attacks become more sophisticated and often transparently mirror the targeted site (e.g., website), allowing the attacker to observe everything as the victim browses the site, and crossing any additional security boundaries with the victim, the detection of phishing activity is increasingly becoming a technical challenge.

[0036] The techniques described herein may be used in conjunction with various platforms (e.g., desktop computers, mobile devices, gaming platforms, embedded systems, etc.) and / or various forms of phishing attacks (e.g., via electronic mail (email) messages, text messages, and / or various other types of messages, such as via social or work productivity related messaging platforms, etc.). Figure 1In the example environment shown in , client devices 104-108 (respectively) are a laptop computer, a desktop computer, and a tablet device that reside within an enterprise network 140. Client device 110 is a laptop computer that resides outside of enterprise network 140.

[0037] Data device 102 is configured to implement policies regarding communications between client devices (such as client devices 104 and 106) and nodes external to enterprise network 140 (e.g., reachable via external network 118). Examples of such policies include policies governing traffic shaping, quality of service, and traffic routing. Other examples of policies include security policies, such as policies requiring scanning of incoming (and / or outgoing) email attachments, website content, files exchanged via instant messaging programs, and / or other file transfers for threats. In some embodiments, data device 102 is also configured to implement policies for traffic that resides within enterprise network 140.

[0038] Figure 2A 102. The example shown is a representation of the physical components included in the data device 102 in various embodiments. Specifically, the data device 102 includes a high-performance multi-core central processing unit (CPU) 202 and a random access memory (RAM) 204. The data device 102 also includes a storage device 210 (such as one or more hard disks or solid-state storage units). In various embodiments, the data device 102 stores (whether in RAM 204, storage device 210 and / or other appropriate locations) information for monitoring the enterprise network 140 and implementing the disclosed technology. Examples of such information include application identifiers, content identifiers, user identifiers, requested URLs, IP address mappings, policies and other configuration information, signatures, host name / URL classification information, malware profiles, and machine learning models. The data device 102 may also include one or more optional hardware accelerators. For example, the data device 102 may include a cryptographic engine 206 configured to perform encryption and decryption operations, and one or more field programmable gate arrays (FPGAs) 208 configured to perform matching, act as a network processor, and / or perform other tasks.

[0039] The functions described herein as being performed by data device 102 may be provided / implemented in a variety of ways. For example, data device 102 may be a dedicated device or a group of devices. The functions provided by data device 102 may also be integrated into a general-purpose computer, computer server, gateway, and / or network / routing device, or executed as software thereon. In some embodiments, at least some of the services described as being provided by data device 102 are alternatively (or additionally) provided to a client device (e.g., client device 104 or client device 110) by software executed on the client device.

[0040] Whenever the data device 102 is described as performing a task, a single component, a subset of components, or all components of the data device 102 may collaborate to perform the task. Similarly, whenever a component of the data device 102 is described as performing a task, a subcomponent may perform the task and / or the component may perform the task in conjunction with other components. In various embodiments, portions of the data device 102 are provided by one or more third parties. Depending on factors such as the amount of computing resources available to the data device 102, various logical components and / or features of the data device 102 may be omitted, and the techniques described herein are adapted accordingly. Similarly, additional logical components / features may be included in embodiments of the data device 102, where applicable. In various embodiments, an example of a component included in the data device 102 is an application identification engine that is configured to identify an application (e.g., using various application signatures for identifying an application based on packet flow analysis). For example, the application identification engine may determine what type of traffic a session involves, such as Web browsing-social networking; Web browsing-news; SSH; and the like. As will be further described herein, the application identification engine disclosed herein may perform advanced application identification. Specifically, advanced application identification includes identifying both applications (e.g., identifying applications based on packet flow analysis using various application signatures) and identifying target sites based on site similarity analysis (e.g., site similarity analysis of target sites and potential phishing sites, such as further described herein).

[0041] Figure 2B 102. The example shown is a representation of the logical components that may be included in the data device 102 in various embodiments. Unless otherwise indicated, the various logical components of the data device 102 may generally be implemented in various ways, including as a collection of one or more scripts (e.g., written in Java, Python, etc., where applicable).

[0042] As shown, the data device 102 includes a firewall and includes a management plane 232 and a data plane 234. The management plane is responsible for managing user interactions, such as by providing a user interface for configuring policies and viewing log data. The data plane is responsible for managing data, such as by performing packet processing and session handling.

[0043] The network processor 236 is configured to receive packets from a client device such as the client device 108 and provide them to the data plane 234 for processing. Whenever the flow module 238 identifies a packet as part of a new session, it creates a new session flow. Based on the flow lookup, subsequent packets will be identified as belonging to the session. If applicable, SSL decryption is applied by the SSL decryption engine 240. Otherwise, the processing of the SSL decryption engine 240 is omitted. The decryption engine 240 can help the data device 102 to inspect and control SSL / TLS and SSH encrypted traffic, and thereby help prevent threats that may still be hidden in the encrypted traffic. The decryption engine 240 can also help prevent sensitive content from leaving the enterprise network 140. Decryption can be selectively controlled (e.g., enabled or disabled) based on parameters such as URL categories, traffic sources, traffic destinations, users, user groups, and ports. In addition to decryption policies (e.g., specifying which sessions to decrypt), decryption profiles can also be assigned to control various options for policy-controlled sessions. For example, it may be necessary to use a specific cipher suite and encryption protocol version.

[0044] The application identification (APP-ID) engine 242 is configured to determine what type of traffic a session involves. As an example, the application identification engine 242 can identify a GET request in the received data and infer that the session requires an HTTP decoder. In some cases, such as a web browsing session, the identified application may change, and this change will be noticed by the data device 102. For example, a user may initially browse to a company wiki (classified as "Web Browsing-Productivity" based on the URL visited), and then subsequently browse to a social networking site (classified as "Web Browsing-Social Networking" based on the URL visited). Different types of protocols have corresponding decoders. In addition, the application identification engine disclosed herein can perform advanced application identification. Specifically, advanced application identification includes identifying applications (e.g., using various application signatures for identifying applications based on packet flow analysis as similarly described above) and identifying both target sites based on site similarity analysis (e.g., site similarity analysis of target sites and potential phishing sites, such as will be further described below).

[0045] Based on the determination made by the application identification engine 242, the threat engine 244 sends the packet to the appropriate decoder, which is configured to assemble the packets (which may be received out of order) into the correct order, perform tokenization, and extract the information. The threat engine 244 also performs signature matching to determine what should happen to the packet. The SSL encryption engine 246 can re-encrypt the decrypted data as needed. The forwarding module 248 is used to forward the packet for transmission (e.g., to a destination).

[0046] Likewise Figure 2BAs shown in , policies 252 are received and stored in the management plane 232. The policies may include one or more rules, which may be specified using domain names and / or host names / server names, and the rules may apply one or more signatures or other matching criteria or heuristics, such as for security policy enforcement on subscribers / IP flows based on various parameters / information extracted from monitored session traffic flows. Example policies may include phishing detection policies that use the disclosed advanced application identification techniques in combination with one or more other parameters (e.g., (one or more) IP addresses associated with a site, geographic location information associated with a site / (one or more) IP addresses, and / or other information, such as further described below). An interface (I / F) communicator 250 is provided for management communications (e.g., via a (REST) ​​API, messaging or network protocol communications, or other communication mechanisms).

[0047] Secure Platform

[0048] Back to Figure 1 , assume that a malicious individual (using system 120) has created malware 130 (e.g., such as delivered to a user's endpoint device via a phishing site, where the URL of the phishing site is sent to the target user in the content of an email). The malicious individual hopes that a client device, such as client device 104, will execute a copy of malware 130, compromising the client device and, for example, causing the client device to become a bot in a botnet. The compromised client device can then be instructed to perform tasks (e.g., cryptocurrency mining, or to engage in a denial of service attack) and report information to an external entity (such as a command and control (C&C) server 150), as well as receive instructions from C&C server 150 (when applicable).

[0049] Assume that data appliance 102 has intercepted an email sent (e.g., by system 120) to user "Alice" operating client device 104. In this example, Alice receives the email and clicks on a link to a phishing site, which may result in Alice's client device 104 attempting to download malware 130. However, in this example, data appliance 102 can perform disclosed application identification for phishing and block access to the phishing site from Alice's client device 104, thereby preempting and preventing any such downloading of malware 130 to Alice's client device 104. As will be further described below, data appliance 102 performs advanced application identification and can use additional information associated with the target site (e.g., IP address(es) associated with the site, geo-location information associated with the site / IP address(es), and / or other information, such as described further below) to detect and block such phishing attempts.

[0050] In various embodiments, the data device 102 is configured to work in cooperation with the security platform 122. As an example, the security platform 122 may provide the data device 102 with a signature set of known malicious files (e.g., as part of a subscription). If the signature of the malware 130 is included in the set (e.g., an MD5 hash of the malware 130), the data device 102 may accordingly prevent the transmission of the malware 130 to the client device 104 (e.g., by detecting that the MD5 hash of the email attachment sent to the client device 104 matches the MD5 hash of the malware 130). The security platform 122 may also provide the data device 102 with a list of known malicious domains and / or IP addresses, thereby allowing the data device 102 to block traffic between the enterprise network 140 and the C&C server 150 (e.g., where the C&C server 150 is known to be malicious). The list of malicious domains (and / or IP addresses) may also help the data device 102 determine when one of its nodes has been compromised. For example, if the client device 104 attempts to contact the C&C server 150, such an attempt is a strong indicator that the client 104 has been compromised by malware (and remedial action should be taken accordingly, such as isolating the client device 104 from communicating with other nodes within the enterprise network 140). As will be described in more detail below, the security platform 122 may also provide other types of information to the data device 102 (e.g., as part of a subscription), such as a set of information for performing advanced application identification of phishing (e.g., target site information for performing site similarity, IP address(es) associated with the site, geo-location information associated with the site / IP address(es), and / or other information, such as described further below), which the data device 102 may use to perform online analysis of files.

[0051] In various embodiments, if the signature of the attachment is not found, the data device 102 can take various actions. As a first example, the data device 102 can fail-safe by blocking the transmission of any attachment that is not whitelisted as benign (e.g., does not match the signature of a known good file). One disadvantage of this approach is that there may be many legitimate attachments that are unnecessarily blocked as potential malware when they are actually benign. As a second example, the data device 102 can fail-risk by allowing the transmission of any attachment that is not blacklisted as malicious (e.g., does not match the signature of a known bad file). One disadvantage of this approach is that newly created malware (that the platform 122 has not seen before) will not be prevented from causing harm. As a third example, the data device 102 can be configured to provide a file (e.g., malware 130) to the security platform 122 for static / dynamic analysis to determine whether it is malicious and / or otherwise classify it.

[0052] Security platform 122 stores a copy of the received sample in storage device 142 and begins analysis (or schedules it, as applicable). An example of storage device 142 is an Apache Hadoop cluster (HDFS). The results of the analysis (and additional information related to the application) are stored in database 146. If an application is determined to be malicious, the data device can be configured to automatically block file downloads based on the analysis results. In addition, signatures can be generated for malware and distributed (e.g., to data devices such as data devices 102, 136, and 148) to automatically block future file transfer requests to download files determined to be malicious.

[0053] In various embodiments, the security platform 122 includes one or more dedicated commercially available hardware servers (e.g., with (one or more) multi-core processors, 32G+ of RAM, (one or more) gigabit network interface adapters, and (one or more) hard drives) running a typical server-class operating system (e.g., Linux). The security platform 122 can be implemented across a scalable infrastructure including multiple such servers, solid-state drives, and / or other applicable high-performance hardware. The security platform 122 may include several distributed components, including components provided by one or more third parties. For example, part or all of the security platform 122 may be implemented using Amazon Elastic Compute Cloud (EC2) and / or Amazon Simple Storage Service (S3). In addition, as with the data device 102, whenever the security platform 122 is referred to as performing a task such as storing data or processing data, it should be understood that one or more subcomponents of the security platform 122 (whether alone or in collaboration with third-party components) may collaborate to perform the task. As an example, the security platform 122 may optionally collaborate with one or more virtual machine (VM) servers (such as VM server 124) to perform static / dynamic analysis.

[0054] An example of a virtual machine server is a physical machine including commercially available server-class hardware (e.g., a multi-core processor, 32+ gigabytes of RAM, and one or more gigabit network interface adapters) running commercially available virtualization software (such as VMware ESXi, Citrix XenServer, or Microsoft Hyper-V). In some embodiments, the virtual machine server is omitted. In addition, the virtual machine server can be under the control of the same entity that manages the security platform 122, but can also be provided by a third party. As an example, the virtual machine server can rely on EC2, and the rest of the security platform 122 is provided by dedicated hardware owned and under the control of the operator of the security platform 122. The VM server 124 is configured to provide one or more virtual machines 126-128 to emulate client devices. The virtual machine can execute various operating systems and / or versions thereof. The observed behavior (e.g., an indication that the application is malicious) caused by executing the application in the virtual machine is recorded and analyzed. In some embodiments, the log analysis is performed by the VM server (e.g., VM server 124). In other embodiments, the analysis is performed at least in part by other components of the security platform 122, such as the coordinator 144.

[0055] In various embodiments, as part of a subscription, the security platform 122 makes the results of its sample analysis available to the data device 102 via a list of signatures (and / or other identifiers). For example, the security platform 122 may periodically send content packages that identify malware files, phishing websites, and the like (e.g., daily, hourly, or some other interval, and / or based on events configured by one or more policies). An example content package includes a list of identified phishing sites, with information such as target site names, URLs, and site similarity information, as well as various other information for each target site (e.g., IP address(es) associated with the target site, geo-location information associated with the site / IP address(es), and / or other information, such as described further below). The subscription may cover analysis of only those files intercepted by the data device 102 and sent to the security platform 122 by the data device 102, and may also cover signatures of malware known to the security platform 122. As will be described in more detail below, platform 122 may also use site model 152 to make other types of information available for phishing detection, which is performed using the disclosed advanced application identification techniques that may help data device 102 detect and perform online blocking of phishing sites.

[0056] In various embodiments, the security platform 122 is configured to provide security services to various entities in addition to (or, where applicable, in lieu of) the operator of the data device 102. For example, other enterprises with their respective enterprise networks 114 and 116 and their respective data devices 136 and 148 may contract with the operator of the security platform 122. Other types of entities may also utilize the services of the security platform 122. For example, an Internet service provider (ISP) that provides Internet service to the client device 110 may contract with the security platform 122 to analyze applications that the client device 110 attempts to download. As another example, the owner of the client device 110 may install software on the client device 110 that communicates with the security platform 122 (e.g., receives content packages from the security platform 122, uses the received content packages to inspect attachments according to the techniques described herein, and transmits applications to the security platform 122 for analysis).

[0057] Analyze samples using static / dynamic analysis

[0058] Figure 3An example of logical components that may be included in a system for analyzing a sample is illustrated. Analysis system 300 may be implemented using a single device. For example, the functionality of analysis system 300 may be implemented in malware analysis module 112 incorporated into data device 102. Analysis system 300 may also be implemented across multiple different devices. For example, the functionality of analysis system 300 may be provided by security platform 122.

[0059] In various embodiments, the analysis system 300 utilizes a list, database, or other collection of known safe content and / or known objectionable content (in Figure 3 102 and / or security platform 122). The collection 314 may be obtained in various ways, including via a subscription service (e.g., provided by a third party) and / or as a result of other processing (e.g., performed by the data device 102 and / or security platform 122). Examples of information included in the collection 314 are: URLs, domain names, and / or IP addresses of known malicious servers; URLs, domain names, and / or IP addresses of known secure servers; URLs, domain names, and / or IP addresses of known command and control (C&C) domains; signatures, hashes, and / or other identifiers of known malicious applications; signatures, hashes, and / or other identifiers of known secure applications; signatures, hashes, and / or other identifiers of known malicious files (e.g., OS vulnerability files); signatures, hashes, and / or other identifiers of known secure libraries; and signatures, hashes, and / or other identifiers of known malicious libraries.

[0060] In various embodiments, when a new sample is received for analysis (e.g., an existing signature associated with the sample does not exist in the analysis system 300), it is added to the queue 302. Figure 3 As shown in , system 300 receives application 130 and adds it to queue 302 .

[0061] Coordinator 304 monitors queue 302, and when resources (e.g., static analysis workers) become available, coordinator 304 takes samples from queue 302 for processing (e.g., taking a copy of malware 130). In particular, coordinator 304 first provides samples to static analysis engine 306 for static analysis. In some embodiments, one or more static analysis engines are included in analysis system 300, where analysis system 300 is a single device. In other embodiments, static analysis is performed by a separate static analysis server that includes multiple workers (i.e., multiple instances of static analysis engine 306).

[0062] The static analysis engine obtains general information about the sample and includes it in a static analysis report 308 (along with heuristics and other information, where applicable). The report can be created by the static analysis engine, or by a coordinator 304 (or by another appropriate component) that can be configured to receive information from the static analysis engine 306. As an example, a static analysis of a target site can include site information for performing a site similarity analysis that is used to perform the disclosed techniques for phishing detection. In some embodiments, the collected information is stored in a database record for the sample (e.g., in a database 316) instead of or in addition to creating a separate static analysis report 308 (i.e., a portion of the database record forms the report 308). In some embodiments, the static analysis engine also forms a determination about the application (e.g., "safe", "suspicious", or "malicious"). As an example, if there is even one "malicious" static feature in the application (e.g., the application includes a hard link to a known malicious domain), the determination may be "malicious". As another example, each feature can be assigned a point (e.g., based on severity if found; based on how reliable the feature is for predicting maliciousness; etc.) and a decision can be assigned by static analysis engine 306 (or orchestrator 304, if applicable) based on the number of points associated with the static analysis results.

[0063] Once the static analysis is complete, the coordinator 304 locates an available dynamic analysis engine 310 to perform dynamic analysis on the application. As with the static analysis engine 306, the analysis system 300 may directly include one or more dynamic analysis engines. In other embodiments, the dynamic analysis is performed by a separate dynamic analysis server that includes multiple workers (i.e., multiple instances of the dynamic analysis engine 310).

[0064] Each dynamic analysis worker manages a virtual machine instance. In some embodiments, the results of the static analysis (e.g., performed by the static analysis engine 306) - whether in the form of a report (308) and / or stored in a database 316, or stored in other ways - are provided as input to the dynamic analysis engine 310. For example, the static report information can be used to help select / customize the virtual machine instance used by the dynamic analysis engine 310 (e.g., Microsoft Windows 7SP 2 vs. Microsoft Windows 10 Enterprise, or iOS 11.0 vs. iOS 12.0). In the case of multiple virtual machine instances executing simultaneously, a single dynamic analysis engine can manage all instances, or multiple dynamic analysis engines can be used (e.g., each of which manages its own virtual machine instance). As will be explained in more detail below, during the dynamic portion of the analysis, the actions taken by the analysis application (including network activity) are analyzed.

[0065] In various embodiments, static analysis of samples is omitted or performed by a separate entity, where applicable. As an example, a first entity may perform traditional static and / or dynamic analysis on a file. Once a determination is made (e.g., by a first entity) that a given file is malicious, the file may be provided to a second entity (e.g., an operator of security platform 122) specifically for additional analysis regarding malware's use of network activity (e.g., by dynamic analysis engine 310).

[0066] The environment used by the analysis system 300 is instrumented / hooked so that behaviors observed while the application is executing are logged as they occur (e.g., using a custom kernel that supports hooks and logcat). Network traffic associated with the emulator is also captured (e.g., using pcap). The log / network data can be stored as temporary files on the analysis system 300, and can also be stored more permanently (e.g., using HDFS or another appropriate storage technology or combination of technologies, such as MongoDB). The dynamic analysis engine (or another appropriate component) can compare the connections made by the sample to a list of domains, IP addresses, etc. (314) and determine whether the sample has communicated (or attempted to communicate) with a malicious entity.

[0067] As with the static analysis engine, the dynamic analysis engine stores the results of its analysis in a record associated with the application being tested in database 316 (and / or includes the results in report 312, if applicable). In some embodiments, the dynamic analysis engine also forms a determination (e.g., "safe," "suspicious," or "malicious") about the application. As an example, if the application takes even one "malicious" action (e.g., an attempt is made to contact a known malicious domain, or an attempt is observed to leak sensitive information), the determination may be "malicious." As another example, points may be assigned to the actions taken (e.g., if found, based on severity; based on how reliable the action is for predicting maliciousness; etc.) and the determination may be assigned by the dynamic analysis engine 310 (or coordinator 304, if applicable) based on the number of points associated with the dynamic analysis results. In some embodiments, a final determination associated with the sample is made based on a combination of report 308 and report 312 (e.g., by coordinator 304).

[0068] Advanced application identification for phishing detection

[0069] Figure 4Portions of an example embodiment of a threat detection engine using application identification in accordance with some embodiments are illustrated. As similarly discussed above, in various embodiments, the data device 102 includes a threat engine 244. The threat engine includes an application identification (App-ID) engine 402 that performs advanced application identification. As such, the App-ID engine 402 incorporates both protocol decoding 404 for application identification and site similarity matching 406 during the corresponding decoder stage and pattern matching stage performed online at the data device 102. As shown at 410, the results of the two stages are merged by the detector stage. In some embodiments, the detector 410 also utilizes IP address information and / or other features as shown at 408, in conjunction with advanced application identification information to detect phishing sites (e.g., combining advanced application identification with IP, URL, and / or domain anomaly detection features, as further described below).

[0070] When data device 102 receives a packet, data device 102 performs session matching to determine which session the packet belongs to (allowing data device 102 to support concurrent sessions). Each session has a session state involving a specific protocol decoder (e.g., a web browsing decoder, an FTP decoder, or an SMTP decoder). When a file is transferred as part of a session, the applicable protocol decoder can utilize an appropriate file-specific decoder (e.g., a PE file decoder, a JavaScript decoder, or a PDF decoder).

[0071] Site similarity is performed based on periodic static analysis of target sites in order to cache visual representations of prospective target sites for subsequent pattern matching comparative analysis with potential phishing sites. In an example implementation, site similarity analysis is performed by abstracting web page code, which may include, for example, titles, headers, footers, form elements, copyright information, and / or other fields and information.

[0072] In some embodiments, using Figure 4 The disclosed technique for phishing detection implemented by the threat detection engine shown in includes combining application identification with IP, URL, and / or domain anomaly detection features.

[0073] As a first example, application identification can be used in conjunction with pattern matching (e.g., site similarity pattern matching as described herein) to perform phishing detection. For example, advanced application identification includes performing application identification in conjunction with site similarity to improve phishing detection, which can reduce false positives compared to phishing detection techniques that rely solely on pattern matching for site similarity. As such, the disclosed advanced application identification techniques for phishing detection include using application identification to identify a hosting server as a pre-filter for pattern-based site similarity detection (e.g., a pre-filter can be used to reduce the load of performing pattern matching, which will facilitate achieving better performance of the disclosed techniques).

[0074] As a second example, advanced application identification may be used in conjunction with an IP address range associated with a target site (e.g., a legitimate / verified Amazon Web Services (AWS) site) to perform phishing detection. Many web services have servers in a fixed IP address range. As such, if advanced application identification identifies the web page(s) of a potential phishing site as being similar to a target site (e.g., a legitimate / verified Amazon Web Services (AWS) site, a login web page) based on site similarity detection, but if these servers associated with the potential phishing site have IP addresses outside of a known IP address range associated with the target site, the threat detection engine may identify the potential phishing site as a possible phishing.

[0075] As a third example, advanced application identification can be used in conjunction with URL categories associated with target sites (e.g., legitimate / verified Amazon Web Services (AWS) sites) to perform phishing detection. It is often observed that many phishing sites change domains frequently. As such, for web page content that is considered to look similar to well-known sites (e.g., AWS sites, where various well-known sites, such as the top 100 or top 1000 or top 10,000, etc. sites can be periodically monitored to generate site similarity information for performing such site similarity analysis), but if the potential phishing site is associated with a newly registered domain category (e.g., various publicly and / or commercially available URL-related services can provide information about domain name registration date information), the threat detection engine can identify the potential phishing site as a possible phishing.

[0076] Example use case for application identification for phishing detection

[0077] Figures 5A-5CExample phishing sites that can be detected using application identification for phishing detection are illustrated in accordance with some embodiments. For example, the disclosed application identification techniques for phishing detection can be implemented to be performed using online malware detection, such as on data device 102 (e.g., and / or on endpoints such as client devices 104, 106, and 108, using a security agent executing on the protected endpoint, and can also be performed as a cloud-based security service, such as using security platform 122, as described herein).

[0078] refer to Figure 5A , illustrates an example web page for a Wells Fargo Bank phishing website. However, the disclosed techniques can perform advanced application identification to identify this example phishing site. In this example, the potential phishing site is located at hXXps: / / storage[.]googleapis[.]com / awells-putlogs-308643420 / index[.]html. As such, traffic directed to this address (e.g., a Uniform Resource Identifier (URI) / Uniform Resource Locator (URL)) will be identified using the disclosed advanced application identification techniques (e.g., by Figure 4 In addition, the disclosed pattern matching-based site similarity is used to detect web pages that look similar to the Wells Fargo bank login page, which is also a method of using the disclosed advanced application identification technology (e.g., by Figure 4 ) performed on a hosted App-ID or a stored App-ID, which can be used by the detector 410 of the threat detection engine 244 to efficiently and effectively detect the phishing site (e.g., and similar phishing sites of this type) because the threat detection engine (e.g., Figure 4 The threat detection engine 244) is configured to identify such well-known sites that are not legitimately located on the hosted App-ID or stored App-ID as phishing sites.

[0079] refer to Figure 5B, illustrating an example web page of an AWS phishing site. However, the disclosed technology can perform advanced application identification in conjunction with an IP address range validation feature to detect such an example phishing site. As such, when advanced application identification is applied to a phishing site (such as https: / / howitfix[.]com / app / aws / ) in conjunction with IP address range validation, then the IP address(es) associated with the example phishing site will not resolve to a known IP address range associated with AWS (e.g., because the phishing site is not even owned by Amazon, where AWS has a given set of IP address ranges publicly available at https: / / ip-ranges.amazonaws.com / ip-ranges.json, which can be periodically updated and stored in the IP / other features component 408 of the threat detection engine 244). Thus, the detector 410 of the threat detection engine 244 can efficiently and effectively detect the phishing site (e.g., and similar phishing sites of this type) using identification of the potential phishing site as appearing similar to the AWS site and subsequent checking of its IP address range.

[0080] refer to Figure 5C , illustrating an example web page for the Netflix phishing website. However, the disclosed technology can be combined with another feature to perform advanced application identification to determine whether the potential phishing site is a newly registered domain. In this example, the domain of the potential phishing site (Canada-neflxt[.]com) is a recently registered domain (e.g., less than 1 day, 1 week, 1 month, or some other threshold for recently registered domains can be similarly used for this feature). In this example, when the threat engine identifies the potential phishing site as similar to the well-known site Netflix, but the URL category shows the site as a newly registered domain (NRD) as in this example (e.g., NRD information can be periodically updated and stored in the IP / other features component 408 of the threat detection engine 244), the detector 410 of the threat detection engine 244 can use this additional NRD attribute to efficiently and effectively detect the phishing site (e.g., and similar phishing sites of this type).

[0081]

[0066] Additional example processes for the disclosed application identification techniques for phishing detection will now be described.

[0082] Example process for application identification for phishing detection

[0083] Figure 6 is a flow chart of a process for application identification for phishing detection according to some embodiments. Figure 6The process 600 shown in FIG. 6 is performed by a security platform and techniques similar to those described above, including the security platform and techniques described above with respect to FIG. Figure 1-5C In one embodiment, process 600 is performed as described above with respect to Figure 1 The data device 102 described above Figure 1 The described security platform 122 may be implemented as a cloud-based security service, a virtual appliance (e.g., Palo Alto Networks' VM Series virtualized next-generation firewalls, CN Series container next-generation firewalls, and / or other commercially available virtual-based or container-based firewalls may be similarly implemented and configured to perform the disclosed techniques), an SDN security solution, a cloud security service, and / or a combination or hybrid implementation of the foregoing as described herein.

[0084] At 602, monitoring network activity associated with a session to detect a request to access a site is performed. For example, data device 102 may be configured to monitor the session and detect a request to access a site, as described above with respect to Figure 1-2B Similar to what is described.

[0085] At 604, a high-level application identification associated with the site is determined. For example, the high-level application identification may be performed using the protocol ID component 404 and the site similarity component 406 of the threat detection engine 244, as described above with respect to Figure 4 and Figure 5A Similar to what is described.

[0086] At 606, identifying the site as a phishing site based on the high-level application identification is performed. For example, policy enforcement may include blocking sessions from accessing phishing sites, logging attempted access to phishing sites, monitoring and logging access to phishing sites, warning users before allowing access to phishing sites, and / or may be based on policies (e.g., phishing / security policies, which may be stored in a repository such as a phishing site). Figure 2B ) to perform other actions / responses or combinations thereof.

[0087] Figure 7 is another flow chart of a process for application identification for phishing detection according to some embodiments. Figure 7 The process 700 shown in FIG. 1 is performed by a security platform and techniques similar to those described above, including the security platform and techniques described above with respect to FIG. Figure 1-5C In one embodiment, process 700 is performed as described above with respect to Figure 1 The data device 102 described above Figure 1The described security platform 122 may be implemented as a cloud-based security service, a virtual appliance (e.g., Palo Alto Networks' VM Series virtualized next-generation firewalls, CN Series container next-generation firewalls, and / or other commercially available virtual-based or container-based firewalls may be similarly implemented and configured to perform the disclosed techniques), an SDN security solution, a cloud security service, and / or a combination or hybrid implementation of the foregoing as described herein.

[0088] At 702, monitoring network activity associated with a session to detect a request to access a site is performed. For example, data device 102 may be configured to monitor the session and detect a request to access a site, as described above with respect to Figure 1-2B Similar to what is described.

[0089] At 704, a high-level application identification associated with the site is determined. For example, the high-level application identification may be performed using the protocol ID component 404 and the site similarity component 406 of the threat detection engine 244, as described above with respect to Figure 4 and Figure 5A Similar to what is described.

[0090] At 706, IP / other features associated with the request to access the site are determined. For example, determination of IP / other features (e.g., (one or more) IP addresses / ranges, NRD information, URL category information, etc.) associated with the request to access the site can be performed using IP / other features component 408 of threat detection engine 244, such as described above with respect to Figure 4 as well as Figure 5B and 5C For example, advanced application identification may include protocol identification based at least in part on identifying phishing sites using URL categories, where the URL categories are selected using URL categorizations based on extracted domains associated with requests to access the sites (e.g., the URL categorizations may be obtained from a firewall using a URL categorization solution / service, such as PanDB commercially available from Palo Alto Networks, Inc. and / or using another commercially or publicly available URL categorization solution / service).

[0091] At 708, identification of the site as a phishing site based on the high-level application identification and another IP / other feature is performed. For example, policy enforcement may include blocking sessions from accessing phishing sites, logging attempted access to phishing sites, monitoring and logging access to phishing sites, warning users before allowing access to phishing sites, and / or may be based on policies (e.g., phishing / security policies, which may be stored in e.g., Figure 2B ) to perform other actions / responses or combinations thereof.

[0092] Although the foregoing embodiments have been described in detail for the purpose of clarity of understanding, the invention is not limited to the details provided. There are many alternative ways to implement the invention. The disclosed embodiments are illustrative rather than restrictive.

Claims

1. A system, include: The processor is configured as: Monitor network activity associated with a session to detect requests to access the Site; determining a high-level application identifier associated with the site; and identifying the site as a phishing site based on the advanced application identifier; and a memory coupled to the processor and configured to provide instructions to the processor.

2. The system of claim 1, wherein the high-level application identifier comprises a protocol identifier.

3. The system of claim 1 , wherein the high-level application identification comprises a protocol identification that identifies the phishing site based at least in part on a URL category, wherein the URL category is selected using a URL classification based on an extracted domain associated with a request to access the site. The system of claim 1 , wherein the high-level application identification comprises a site affinity identification.

5. The system of claim 1, wherein the high-level application identification includes a site similarity identification to determine whether a request for the site is visually similar to a well-known site. The system according to claim 1 , wherein the high-level application identifier comprises a protocol identifier and a site similarity identifier.

7. The system of claim 1, wherein detecting the site as a phishing site is performed online using a data device.

8. The system of claim 1, wherein the processor is further configured to determine an IP address associated with the request for the site for comparison with an expected range of IP addresses associated with well-known similar sites based on a site similarity analysis.

9. The system of claim 1, wherein the processor is further configured to determine a URL category associated with the request for the site to compare with expected URL categories associated with well-known similar sites based on a site similarity analysis.

10. The system of claim 1, wherein the processor is further configured to determine that the site is a newly registered domain (NRD) as another feature for detecting the site as a phishing site.

11. A method, include: Monitor network activity associated with a session to detect requests to access the Site; determining a high-level application identifier associated with the site; and The site is identified as a phishing site based on the high-level application identification. The method of claim 11 , wherein the high-level application identification comprises a protocol identification.

13. The method of claim 11, wherein the high-level application identification comprises a protocol identification that identifies the phishing site based at least in part on a URL category, wherein the URL category is selected using a URL classification based on an extracted domain associated with a request to access the site. The method of claim 11 , wherein the high-level application identifier comprises a site affinity identifier.

15. The method of claim 11, wherein the high-level application identification includes a site similarity identification to determine whether a request for the site is visually similar to a well-known site. The method according to claim 11 , wherein the high-level application identifier comprises a protocol identifier and a site similarity identifier.

17. The method of claim 11, wherein detecting the site as a phishing site is performed online using a data device.

18. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for: Monitor network activity associated with a session to detect requests to access the Site; determining a high-level application identification associated with the site; and The site is identified as a phishing site based on the high-level application identification.

19. The computer program product of claim 18, wherein the high-level application identification comprises a protocol identification.

20. The computer program product of claim 18, wherein the high-level application identification comprises a site affinity identification.

Images