Inline Malware Detection

Abstract

To disclose detection of malicious files.MEANS FOR SOLVING THE PROBLEM: A set comprising one or more sample classification models is stored on a networked device. N-gram analysis is performed on a sequence of received packets associated with a received file. Performing the n-gram analysis includes using at least one stored sample classification model. A determination is made that the received file is malicious based at least in part on the n-gram analysis of the sequence of received packets. In response to determining that the file is malicious, propagation of the received file is prevented.SELECTED DRAWING: Figure 1

Description

[Background technology]

[0001] Malware is a general term referring to malicious software (e.g., including a variety of hostile, intrusive, and / or unwanted software). Malware can be in the form of code, scripts, active content, and / or other software. Examples of malware uses include disrupting computer and / or network operations, stealing proprietary information (e.g., confidential information such as identity, financial, and / or intellectual property related information), and / or gaining access to private / proprietary computer systems and / or computer networks. Unfortunately, as techniques are developed to aid in the detection and mitigation of malware, malicious writers find ways to circumvent those efforts. Thus, there is a continuing need for improved techniques for identifying and mitigating malware. [Brief description of the drawings]

[0002] Various embodiments of the invention are disclosed in the following detailed description and the accompanying drawings. [Figure 1] FIG. 1 illustrates one embodiment of an environment in which malicious applications are detected and prevented from causing harm. [Figure 2A] FIG. 2A illustrates one embodiment of a data device. [Figure 2B] FIG. 2B is a functional diagram of the logical components of one embodiment of a data appliance. [Diagram 3] FIG. 3 illustrates one embodiment of logical components that may be included in a system for analyzing a sample. [Figure 4] FIG. 4 illustrates a portion of one exemplary embodiment of a threat engine. [Diagram 5] FIG. 5 shows one example of a portion of a tree. [Figure 6]FIG. 6 illustrates one embodiment of a process for performing in-line malware detection on a data appliance. [Figure 7A] FIG. 7A shows an example hash table for a file. [Figure 7B] FIG. 7B shows one exemplary threat signature for the sample. [Figure 8A] FIG. 8A illustrates one embodiment of a process for performing feature extraction. [Figure 8B] FIG. 8B illustrates one embodiment of a process for generating a model. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0003] The present invention can be implemented in numerous ways, including as a process, an apparatus, a system, a composition of matter, a computer program product embodied on a computer-readable storage medium, and / or a processor configured to execute instructions stored in and / or provided by a memory coupled to the processor. These embodiments, or other forms in which the present invention may be employed, are referred to herein as techniques. In general, the order of steps of a disclosed process may be altered within the scope of the present invention. Unless otherwise indicated, components such as a processor or memory described as configured to perform a task may be implemented as general components that are temporarily configured to perform the task at a given time, or as specific components that are manufactured to perform the task. As used herein, the term "processor" refers to one or more devices, circuits, and / or processing cores configured to process data, such as computer program instructions.

[0004] A detailed description of one or more embodiments of the present invention is provided below along with the accompanying drawings that illustrate the principles of the invention. While the present invention will be described in connection with such embodiments, the present invention is not limited to any embodiment. The scope of the present invention is limited only by the claims, and the present invention encompasses numerous alternatives, modifications, and equivalents. Numerous specific details are set forth in the following description to provide a thorough understanding of the present invention. These details are provided for the purposes of example, and the present invention may be practiced according to the claims without some or all of these specific details. For the sake of clarity, technical material well known in the art related to the invention will not be described in detail so as not to unnecessarily obscure the invention.

[0005] I. Overview

[0006] A firewall generally allows authorized communications to pass through the firewall while protecting the network from unauthorized access. A firewall is typically a device, a set of devices, or software running on a device that provides firewall functionality for network access. For example, a firewall can be integrated into the operating system of a device (e.g., a computer, a smartphone, or other type of network-enabled device). Firewalls can also be integrated or run as software applications on various types of devices or security devices, such as computer servers, gateways, network / routing devices (e.g., network routers), or data appliances (e.g., security appliances, or other types of special purpose devices), and in some implementations, certain operations can be implemented in special purpose hardware, such as ASICs or FPGAs. do.

[0007] A firewall typically denies or allows network transmissions based on a set of rules. These sets of rules are often referred to as policies (e.g., network policies or network security policies). For example, a firewall can filter inbound traffic by applying a set of rules or policies to prevent unwanted external traffic from reaching a protected device. A firewall can also filter outbound traffic by applying a set of rules or policies (e.g., allow, block, monitor, notify, or log, and / or other actions that may be specified in a firewall rule or firewall policy, which may be triggered based on various criteria, as described herein). A firewall can also filter local network (e.g., intranet) traffic by applying a set of rules or policies as well.

[0008] Security devices (e.g., security appliances, security gateways, security services, and / or other security devices) may perform various security operations (e.g., firewalls, anti-malware, intrusion prevention / detection, proxies, and / or other security functions), network functions (e.g., routing, quality of service (QoS), workload balancing of network-related resources, and / or other network functions), and / or other security and / or network-related functions. For example, routing may be performed based on source information (e.g., IP addresses and ports), destination information (e.g., IP addresses and ports), and protocol information.

[0009] Basic packet filtering firewalls filter network communication traffic by inspecting each individual packet sent across a network (e.g., a packet filtering firewall or first generation firewall, which is a stateless packet filtering firewall). Stateless packet filtering firewalls typically inspect the individual packets themselves and then apply rules based on the inspected packets (e.g., using a combination of the packet's source and destination address information, protocol information, and port numbers).

[0010] Application firewalls can also perform application layer filtering (e.g., using an application layer filtering firewall, or a second generation firewall that functions at the application level of the TCP / IP stack). Application layer filtering firewalls or application firewalls can generally identify certain applications and protocols (e.g., web browsing using the Hypertext Transfer Protocol (HTTP), Domain Name System (DNS) requests, file transfers using the File Transfer Protocol (FTP), and various other types of applications and other protocols, such as Telnet, DHCP, TCP, UDP, and TFTP (GSS)). For example, an application firewall can block unauthorized protocols that attempt to communicate on standard ports (e.g., unauthorized / out-of-policy protocols that attempt to sneak through by using a non-standard port for that protocol can generally be identified using an application firewall).

[0011] Stateful firewalls can also perform stateful-based packet inspection, where each packet is inspected in the context of the set of packets associated with its network outgoing packet flow. This firewall technique is commonly referred to as stateful packet inspection, because it keeps a record of all connections that pass through the firewall and can determine whether a packet is the start of a new connection, part of an existing connection, or an invalid packet. For example, the state of a connection can itself be one of the criteria that triggers a rule in a policy.

[0012] Advanced or next-generation firewalls can perform stateless and stateful packet filtering and application layer filtering, as described above. Next-generation firewalls can also perform additional firewall technologies. For example, certain new firewalls, often referred to as advanced or next-generation firewalls, can also identify users and content. In particular, certain next-generation firewalls have expanded the list of applications that they can automatically identify to thousands of applications. Examples of such next-generation firewalls are commercially available from Palo Alto Networks (e.g., Palo Alto Networks PA series firewalls). For example, Palo Alto Networks next-generation firewalls use a variety of identification technologies to enable enterprises and service providers to identify and control applications, users, and content - not just ports, IP addresses, and packets. Various identification techniques include Application-ID (e.g., App ID) for precise application identification, User-ID (e.g., User ID) for user identification, and Content-ID (e.g., Content ID) for real-time content scanning (e.g., to control web surfing and limit data and file transfers). These identification techniques allow enterprises to safely enable application usage using business-relevant concepts instead of following the traditional approach provided by traditional port-blocking firewalls.Additionally, special-purpose hardware for next-generation firewalls (e.g., implemented as dedicated devices) generally provides higher performance levels for application inspection than software running on general-purpose hardware (e.g., security appliances from Palo Alto Networks, Inc., which utilize dedicated, function-specific processing that is tightly integrated with a single-pass software engine to maximize network throughput while minimizing latency, for Palo Alto Networks' PA Series Next-Generation Firewalls).

[0013] Advanced or next-generation firewalls can also be implemented using virtualized firewalls. An example of such a next-generation firewall is available from Palo Alto Networks (which runs on VMware® ESXi). TM and NSX TM , Citrix(R)Netscaler SDX TM It supports a variety of commercial virtualization environments, including VMware, KVM / OpenStack (Centos / RHEL, Ubuntu®), and Amazon Web Services (AWS). For example, the virtualized firewall can support similar or identical next-generation firewall and advanced threat prevention capabilities available in physical form factor devices, allowing enterprises to safely enable the influx of applications to private, public, and hybrid cloud computing environments. Automation capabilities such as VM monitoring, dynamic address groups, and REST-based APIs enable enterprises to dynamically monitor VM changes and update security policies with that context, thereby eliminating policy lag that can occur when VMs change.

[0014] II. Examples of environmental practices

[0015] Figure 1 illustrates an example environment in which malicious applications ("malware") are detected and do not cause damage. As described in more detail below, malware classifications (e.g., produced by security platform 122) may be variously shared and / or refined among various entities included in the environment illustrated in Figure 1, and techniques described herein may be used to protect devices, such as endpoint client devices 104-110, from such malware.

[0016] The term “application” is used throughout this specification to collectively refer to programs, program bundles, manifests, packages, etc., regardless of format / platform. An “application” (also referred to herein as a “sample”) may be a standalone file (e.g., a calculator application having the file name “calculator.apk” or “calculator.exe”) or may be a separate component of another application (e.g., a library embedded within a mobile advertising SDK or calculator application).

[0017] As used herein, "malware" refers to any activity, covert or not (and illegal or not), that a user would not approve of if given full information. Examples of malware include Trojan horses, viruses, rootkits, spyware, hacking tools, keyloggers, etc. One example of malware is a desktop application that collects and reports the end user's location to a remote server (but does not provide the user with location-based services, such as mapping services). Another example of malware is a malicious Android application package .apk (APK) that appears to the end user as a free game, but secretly sends SMS premium messages (e.g., costing $10 each) and inflates the end user's phone bill. Another example of malware is Apple's iOS Flashlight application, which covertly collects a user's contacts and sends those contacts to spammers. Other forms of malware can also be detected / thwarted using the techniques described herein (e.g., ransomware). Additionally, although n-grams / feature vectors / output accumulation variables are described herein as being generated for malicious applications, the techniques described herein may also be used in various embodiments to generate profiles for other types of applications (e.g., adware profiles, goodware profiles, etc.).

[0018] The techniques described herein can be used in combination with various platforms (e.g., desktops, mobile devices, gaming platforms, embedded systems, etc.) and / or various types of applications (e.g., Android apk files, iOS applications, Windows PE files, Adobe Acrobat PDF files, etc.). In the exemplary environment shown in Figure 1, client devices 104-108 are laptop computers, desktop computers, and tablets that reside on enterprise network 140. Client device 110 is a laptop computer that resides outside of enterprise network 140.

[0019] Data appliance 102 is configured to enforce policies regarding communications between client devices, such as client devices 104 and 106, and nodes outside enterprise network 140 (e.g., reachable via external network 118). Examples of such policies include policies governing traffic shaping, quality of service, and routing of traffic. Other examples of policies include security policies, such as mandating scanning for threats in incoming (and outgoing) email attachments, web site content, files exchanged via instant messaging programs, and / or other file transfers. In some embodiments, data appliance 102 is also configured to enforce policies regarding traffic that remains within enterprise network 140.

[0020] One embodiment of a data appliance is shown in FIG. 2A. The illustrated example is a representation of the physical components included in the data appliance 102 in various embodiments. Specifically, the data appliance 102 includes a high-performance multi-core central processing unit (CPU) 202 and a random access memory (RAM) 204. The data appliance 102 also includes storage 210 (such as one or more hard disks or solid-state storage units). In various embodiments, the data appliance 102 stores (either in the RAM 204, the storage 210, and / or other suitable locations) information used to monitor the enterprise network 140 and to implement the disclosed techniques. Examples of such information include application identifiers, content identifiers, user identifiers, requested URLs, IP address mappings, policies and other configuration information, signatures, hostname / URL categorization information, malware profiles, and machine learning models. The data appliance 102 may also include one or more optional hardware accelerators. For example, data device 102 may include a cryptographic engine 206 configured to perform encryption and decryption operations, and one or more field programmable gate arrays 208 configured to perform matching, operate as a network processor, and / or perform other tasks.

[0021] The functionality described herein as being performed by data appliance 102 may be provided / implemented in a variety of ways. For example, data appliance 102 may be a dedicated device or set of devices. The functionality provided by data appliance 102 may be integrated or performed as software on a general purpose computer, computer server, gateway, and / or network / routing device. In some embodiments, at least some of the services described as being provided by data appliance 102 are instead (or in addition) provided to a client device (e.g., client device 104 or client device 110) by software executing on the client device.

[0022] Whenever the data appliance 102 is described as performing a task, a single component, a subset of components, or all components of the data appliance 102 may cooperate to perform the task. Similarly, whenever a component of the data appliance 102 is described as performing a task, the subcomponent may perform the task and / or the component may perform the task with other components. In various embodiments, portions of the data appliance 102 are provided by one or more third parties. Depending on factors such as the amount of computing resources available to the data appliance 102, various logical components and / or features of the data appliance 102 may be omitted and the techniques described herein adapted accordingly. Similarly, additional logical components / features may be included in embodiments of the data appliance 102, as applicable. One example of a component included in the data appliance 102 in various embodiments is an application identification engine configured to identify applications (e.g., using various application signatures to identify applications based on packet flow analysis). For example, the application identification engine may determine the type of traffic a session involves, such as web browsing-social networking, web browsing-news, SSH, etc.

[0023] 2B is a functional diagram of the logical components of one embodiment of a data appliance. The illustrated example is a representation of the logical components that may be included in the data appliance 102 in various embodiments. Unless otherwise specified, the various logical components of the data appliance 102 may generally be implemented in a variety of ways, including as a set of one or more scripts (e.g., written in Java, python, etc., as applicable).

[0024] As shown, data appliance 102 includes a firewall and includes a management plane 232 and a data plane 234. The management plane is responsible for managing user interaction, such as by providing a user interface for setting policies and displaying log data. The data plane is responsible for data management, such as by performing packet processing and session handling.

[0025] The network processor 236 is configured to receive packets from a client device, such as the client device 108, and provide them to the data plane 234 for processing. The flow module 238 creates a new session flow whenever it identifies a packet as part of a new session. Subsequent packets are identified as belonging to the session based on the flow lookup. If applicable, SSL decryption is applied by the SSL decryption engine 240. If not, processing by the SSL decryption engine 240 is skipped. The decryption engine 240 helps the data appliance 102 inspect and control SSL / TLS and SSH encrypted traffic, and thus helps stop threats that may otherwise remain hidden in the encrypted traffic. The decryption engine 240 can also help prevent sensitive content from leaving the enterprise network 140. Decryption can be selectively controlled (e.g., enabled or disabled) based on parameters such as URL category, traffic source, traffic destination, user, user group, and port. In addition to a decryption policy (e.g., one that specifies which sessions to decrypt), a decryption profile can be assigned to control various options of the session controlled by the policy, for example, the use of specific cipher suites and encryption protocol versions can be required.

[0026] The application identification (APP-ID) engine 242 is configured to determine the type of traffic the session involves. As an example, the application identification engine 242 may recognize a GET request in the received data and conclude that the session requires an HTTP decoder. In some cases, such as during a web browsing session, the identified application may change and such changes may be noted by the data appliance 102. For example, a user may first browse a corporate Wiki (classified as “Web Browsing-Productivity” based on the URLs visited) and then browse a social networking site (classified as “Web Browsing-Social Networking” based on the URLs visited). Different types of protocols have corresponding decoders.

[0027] Based on the determination made by the application identification engine 242, the packets are sent by the threat engine 244 to the appropriate decoder configured to assemble the packets in the correct order, perform tokenization, and extract information. The threat engine 244 also performs signature matching to determine what should happen to the packets. If necessary, the SSL encryption engine 246 can re-encrypt the decrypted data. The packets are forwarded using the forwarding module 248 for forwarding (e.g., to a destination).

[0028] 2B, a policy 252 is received and stored in the management plane 232. The policy may include one or more rules, which may be specified using domain names and / or host / server names, and the rules may apply one or more signatures or other matching criteria or heuristics, such as for security policy enforcement, to subscriber / IP flows based on various extracted parameters / information from the monitored session traffic flows. An interface (I / F) communicator 250 is provided for management communications (e.g., via (REST) ​​APIs, messages, or network protocol communications, or other communication mechanisms).

[0029] III. Security Platform

[0030] Returning to Figure 1, assume that a malicious individual (using system 120) has created malware 130. The malicious individual wants a client device, such as client device 104, to run a copy of the malware 130, compromising the client device and, for example, causing the client device to become a bot in a botnet. The compromised client device can then be instructed to perform a task (e.g., mining cryptocurrency or participating in a denial of service attack) and to report information to an external entity, such as a command and control (C&C) server 150, as well as, optionally, to receive instructions from the C&C server 150.

[0031] Assume that the data appliance 102 intercepts an email sent to a user "Alice" operating a client device 104. A copy of the malware 130 has been attached to the message by the system 120. In an alternative, but similar scenario, the data appliance 102 may intercept an attempt by the client device 104 to download the malware 130 (e.g., from a website). In either scenario, the data appliance 102 determines whether a signature of the file (e.g., an email attachment or a website download of the malware 130) is present on the data appliance 102. If present, the signature may indicate that the file is known to be safe (e.g., on a whitelist) and may also indicate that the file is known to be malicious (e.g., on a blacklist).

[0032] In various embodiments, the data appliance 102 is configured to operate in cooperation with the security platform 122. As one example, the security platform 122 can provide the data appliance 102 with a set of signatures of known malicious files (e.g., as part of a subscription). If a signature for the malware 130 is included in the set (e.g., an MD5 hash of the malware 130), the data appliance 102 can respond by preventing transmission of the malware 130 to the client device 104 (e.g., by detecting that an MD5 hash of an email attachment sent to the client device 104 matches the MD5 hash of the malware 130). The security platform 122 can also provide the data appliance 102 with a list of known malicious domains and / or IP addresses, enabling the data appliance 102 to block traffic between the enterprise network 140 and the C&C server 150 (e.g., if the C&C server 150 is known to be malicious). The list of malicious domains (and / or IP addresses) can also help the data appliance 102 determine when one of its nodes has been compromised. For example, if a client device 104 attempts to contact the C&C server 150, such an attempt is a strong indicator that the client 104 has been compromised by malware (and thus that corrective action should be taken, such as isolating the client device 104 from communicating with other nodes in the enterprise network 140). As described in more detail below, the security platform 122 may also provide other types of information to the data appliance 102 (e.g., as part of a subscription), such as a set of machine learning models that can be used by the data appliance 102 to perform inline analysis of files.

[0033] In various embodiments, if a signature for an attachment is not found, the data device 102 can take various actions. As a first example, the data device 102 can be fail-safe by blocking the transmission of any attachment that is not whitelisted as benign (e.g., does not match the signature of a known good file). The drawback of this approach is that there may be many legitimate attachments that are unnecessarily blocked as potentially malware when in fact they are benign. As a second example, the data device 102 can pose a fail-danger by allowing the transmission of any attachment that is not blacklisted as malicious (e.g., does not match the signature of a known malicious file). The drawback of this approach is that newly created malware (previously unseen by the platform 122) is not prevented from causing harm.

[0034] As a third example, the data appliance 102 can be configured to provide a file (e.g., malware 130) to the security platform 122 for static / dynamic analysis to determine whether it is malicious and / or classify it. While the analysis by the security platform 122 of the attachment (signature not yet present) is being performed, the data appliance 102 can take various actions. As a first example, the data appliance 102 can prevent the email (and attachment) from being delivered to Alice until a response is received from the security platform 122. Assuming that it takes about 15 minutes for the platform 122 to fully analyze the sample, this means that the incoming message to Alice will be delayed by 15 minutes. In this example, such a delay will not negatively impact Alice, since the attachment is malicious. In another example, assume that someone sends Alice a time sensitive message with a benign attachment that is also not signed. Delaying the delivery of the message to Alice by 15 minutes is likely to be considered unacceptable (e.g., by Alice). As described in more detail below, an alternative approach is to perform at least some real-time analysis of the attachment at the data appliance 102 (e.g., while awaiting a verdict from the platform 122). If the data appliance 102 can independently determine whether the attachment is malicious or benign, it can take initial action (e.g., block or allow delivery to Alice) and can adjust / take additional action, if necessary, after receiving a verdict from the security platform 122.

[0035] The security platform 122 stores a copy of the received sample in storage 142 and analysis is initiated (or scheduled, as appropriate). One example of storage 142 is an Apache Hadoop cluster. The results of the analysis (and additional information related to the application) are stored in database 146. If the application is determined to be malicious, the data appliance can be configured to automatically block the file download based on the analysis results. Additionally, a signature can be generated and distributed (e.g., to data appliances such as data appliances 102, 136, 148) for the malware to automatically block future file transfer requests to download files determined to be malicious.

[0036] In various embodiments, security platform 122 includes one or more dedicated, commercially available hardware servers (e.g., having multi-core processors, 32G+ of RAM, gigabit network interface adapters, and hard drives) running a typical server-class operating system (e.g., Linux). Security platform 122 may be implemented across a scalable infrastructure including multiple such servers, solid-state drives, and / or other applicable high performance hardware. Security platform 122 may have multiple distributed components, including components provided by one or more third parties. For example, some or all of security platform 122 may be implemented using Amazon Elastic Compute Cloud (EC2) and / or Amazon Simple Storage Service (S3). Additionally, as with data appliance 102, whenever security platform 122 is referred to as performing a task, such as storing data or processing data, it should be understood that a subcomponent or subcomponents of security platform 122 may cooperate (individually or in cooperation with third party components) to perform that task. As one example, security platform 122 can optionally cooperate with one or more virtual machine (VM) servers, such as VM server 124, to perform static and dynamic analysis.

[0037] One example of a virtual machine server is a physical machine that includes commercially available server-class hardware (e.g., multi-core processor, 32G+ of RAM, and one or more gigabit network interface adapters) running commercially available virtualization software such as VMware ESXi, Citrix XenServer, or Microsoft Hyper-V. In some embodiments, the virtual machine server is omitted. Additionally, the virtual machine server may be under the control of the same entity that manages the security platform 122, but may also be provided by a third party. As one example, the virtual machine server may rely on EC2, with the remainder of the security platform 122 being provided by dedicated hardware owned and under the control of the operator of the security platform 122. The VM server 124 is configured to provide one or more virtual machines 126-128 to emulate client devices. The virtual machines may run a variety of operating systems and / or versions thereof. Observed behavior resulting from running applications on the virtual machines is logged and analyzed (e.g., if it indicates that the application is malicious). In some embodiments, the log analysis is performed by a VM server (e.g., VM server 124). In other embodiments, the analysis is performed, at least in part, by other components of security platform 122, such as coordinator 144.

[0038] In various embodiments, the security platform 122 makes available the results of the analysis of the samples to the data appliance 102 via a list of signatures (and / or other identifiers) as part of the subscription. For example, the security platform 122 can periodically (e.g., daily, hourly, or other intervals and / or based on events configured by one or more policies) send a content package identifying malware applications. An example content package includes a list of identified malware applications, along with information such as the package name, a hash value to uniquely identify the application, and a malware name (and / or malware family name) for each identified malware application. The subscription can cover only the analysis of files intercepted by the data appliance 102 and sent by the data appliance 102 to the security platform 122, and can also cover all malware signatures known to the security platform 122 (or a subset thereof, just mobile malware but not other forms of malware (e.g., PDF malware)). As described in more detail below, platform 122 may also make available other types of information, such as machine learning models that can assist data appliance 102 in detecting malware.

[0039] In various embodiments, security platform 122 is configured to provide security services to various entities in addition to (or instead of, if applicable) the operator of data equipment 102. For example, other enterprises having their own respective enterprise networks 114 and 116 and their own respective data equipment 136 and 148 may contract with the operator of security platform 122. Other types of entities may also use the services of security platform 122. For example, an Internet service provider providing Internet service to client device 110 may contract with security platform 122 to analyze applications that client device 110 attempts to download. As another example, the owner of client device 110 may install software on client device 110 that communicates with security platform 122 (e.g., to receive content packages from security platform 122, use the received content packages to check attachments according to techniques described herein, and send applications to security platform 122 for analysis).

[0040] IV. Sample Analysis Using Static / Dynamic Analysis

[0041] 3 illustrates examples of logical components that may be included in a system for analyzing a sample. Analysis system 300 may be implemented using a single device. For example, the functionality of analysis system 300 may be implemented in a malware analysis module 112 embedded within data appliance 102. Analysis system 300 may also be implemented collectively across multiple separate devices. For example, the functionality of analysis system 300 may be provided by security platform 122.

[0042] In various embodiments, analysis system 300 uses a list, database, or other collection of known safe content and / or known bad content (collectively shown in FIG. 3 as collection 314). Collection 314 may be obtained in various ways, such as via a subscription service (e.g., provided by a third party) and / or as a result of other processing (e.g., performed by data appliance 102 and / or security platform 122). Examples of information included in collection 314 are URLs, domain names, and / or IP addresses of known malicious servers, URLs, domain names, and / or IP addresses of known safe servers, URLs, domain names, and / or IP addresses of known command and control (C&C) domains, signatures, hashes, and / or other identifiers of known malicious applications, signatures, hashes, and / or other identifiers of known safe applications, signatures, hashes, and / or other identifiers of known malicious files (e.g., Android exploit files), signatures, hashes, and / or other identifiers of known safe libraries, and signatures, hashes, and / or other identifiers of known malicious libraries.

[0043] A. Ingestion

[0044] In various embodiments, when a new sample is received for analysis (e.g., there are no existing features associated with the sample in the analysis system 300), it is added to the queue 302. As shown in FIG. 3, an application 130 is received by the system 300 and added to the queue 302.

[0045] B. Static analysis

[0046] The coordinator 304 monitors the queue 302, and when resources (e.g., static analysis workers) become available, the coordinator 304 removes samples from the queue 302 for processing (e.g., fetches a copy of the malware 130). In particular, the coordinator 304 first provides the samples to a static analysis engine 306 for static analysis. In some embodiments, one or more static analysis engines are included within the analysis system 300, where the analysis system 300 is a single device. In other embodiments, static analysis is performed by a separate static analysis server that includes multiple workers (i.e., multiple instances of the static analysis engine 306).

[0047] The static analysis engine obtains general information about the sample and includes it (along with heuristic and other information, as appropriate) in a static analysis report 308. The report may be generated by the static analysis engine or by the coordinator 304 (or by another suitable component), which may be configured to receive information from the static analysis engine 306. In some embodiments, the collected information is stored in the sample's database record (e.g., database 316) instead of or in addition to a separate static analysis report 308 (i.e., part of the database record from report 308) being generated. In some embodiments, the static analysis engine also forms a verdict regarding the application (e.g., "safe," "suspicious," or "malicious"). As one example, if one "malicious" static feature is present in the application (e.g., the application contains a hard link to a known malicious domain), the verdict may be "malicious." As another example, points can be assigned to each feature (e.g., based on severity if discovered, based on the feature's reliability for predicting malicious intent, etc.) and a decision can be assigned by the static analysis engine 306 (or coordinator 304, if applicable) based on the number of points associated with the static analysis results.

[0048] C. Dynamic Analysis

[0049] Once static analysis is complete, the coordinator 304 deploys an available dynamic analysis engine 310 to perform dynamic analysis on the application. Similar to static analysis engine 306, analysis system 300 can include one or more dynamic analysis engines directly. In other embodiments, dynamic analysis is performed by a separate dynamic analysis server that includes multiple workers (i.e., multiple instances of dynamic analysis engine 310).

[0050] Each dynamic analysis worker manages a virtual machine instance. In some embodiments, the results of the static analysis (e.g., performed by static analysis engine 306), either in report form (308) and / or stored in database 316 or otherwise, are provided as input to dynamic analysis engine 310. For example, the static report information can be used to aid in the selection / customization of the virtual machine instance (e.g., Microsoft Windows 7 SP2 vs. Microsoft Windows 10 Enterprise, or iOS 11.0 vs. iOS 12.0) used by dynamic analysis engine 310. When multiple virtual machine instances run simultaneously, a single dynamic analysis engine can manage all instances, or multiple dynamic analysis engines can be used (e.g., with each managing its own virtual machine instance), as needed. During the dynamic portion of the analysis, actions taken by the application (including network activity) are analyzed, as described in more detail below.

[0051] In various embodiments, static analysis of the sample is omitted or, if applicable, performed by a separate entity. As one example, traditional static and / or dynamic analysis may be performed on the file by a first entity. Once a given file is determined to be malicious (e.g., by a first entity), the file may be provided to a second entity (e.g., an operator of the security platform 122) for additional analysis (e.g., by the dynamic analysis engine 310), particularly related to the malware's use of network activity.

[0052] The environment used by analysis system 300 is instrumented / hooked (e.g., using a customized kernel that supports hooking and logcat) so that behaviors observed while the application is running are logged as they occur. Network traffic associated with the emulator is also captured (e.g., using pcap). The log / network data can be stored as temporary files on analysis system 300, and can also be stored more persistently (e.g., using HDFS, or other suitable storage technology, or a combination of technologies, such as MongoDB). The dynamic analysis engine (or another suitable component) can compare connections made by the sample to a list (314) of domains, IP addresses, etc., and determine whether the sample communicated (or attempted to communicate) with a malicious entity.

[0053] Similar to the static analysis engine, the dynamic analysis engine stores the results of its analysis in a database 316 in a record associated with the application being tested (and / or includes the results in a report 312, if applicable). In some embodiments, the dynamic analysis engine also forms a verdict regarding the application (e.g., “benign,” “suspicious,” or “malicious”). As one example, even if a single “malicious” action was taken by the application (e.g., an attempt to contact a known malicious domain or an attempt to remove sensitive information is observed), the verdict may be “malicious.” As another example, points may be assigned to the actions taken (e.g., based on the severity if found, based on the reliability of the action to predict maliciousness, etc.), and a verdict may be assigned by the dynamic analysis engine 310 (or the coordinator 304, if applicable) based on the number of points associated with the dynamic analysis results. In some embodiments, a final verdict regarding the sample is made (e.g., by the coordinator 304) based on a combination of the reports 308 and 312.

[0054] V. Inline Malware Detection

[0055] Returning to the environment of Figure 1, millions of new malware samples may be generated each month (e.g., by unauthorized individuals, such as operators of system 120, either by making subtle modifications to existing malware or by creating new malware). Thus, there are many malware samples for which security platform 122 does not have signatures (at least initially). Furthermore, even if security platform 122 did generate signatures for newly created malware, due to resource constraints, a data appliance, such as data appliance 102, may not have / use a list of all known signatures (e.g., stored on platform 122) at any given time.

[0056] Sometimes, malware, such as malware 130, successfully infiltrates network 140. One reason for this is when data appliance 102 operates on a “first-time allow” basis. Assume that if data appliance 102 does not have a signature for a sample (e.g., sample 130) and submits it to security platform 122 for analysis, it takes security platform 122 approximately five minutes to return a verdict (e.g., “benign,” “malicious,” “unknown,” etc.). Instead of blocking communication between system 120 and client device 104 during that five-minute period, under the first-time allow basis, communication is allowed. When a verdict is returned (e.g., after five minutes), data appliance 102 can use the verdict to block further transmission of malware 130 to network 140, can prevent communication between system 120 and network 140, etc. In various embodiments, if a second copy of the sample 130 arrives at the data device 102 while the data device 102 is awaiting a decision from the security platform 122, the second copy of the sample 130 (and any subsequent copies) is retained by the system 120 while awaiting a response from the security platform 122.

[0057] Unfortunately, during the five minutes that the data appliance 102 waits for a decision from the security platform 122, the user of the client device 104 could have executed malware 130, potentially compromising the client device 104 or other nodes in the network 140. As described above, in various embodiments, the data appliance 102 includes a malware analysis module 112. One task that the malware analysis module 112 may perform is in-line malware detection. In particular, as described in more detail below, machine learning techniques may be applied to perform efficient analysis of a file (such as a sample 130) on the data appliance 102 as it passes through the data appliance 102 (e.g., in parallel with other processing performed on the file by the data appliance 102), and an initial malicious decision may be determined by the data appliance 102 (e.g., while waiting for a decision from the security platform 122).

[0058] Various challenges may arise when performing such analysis on a resource constrained appliance, such as the data appliance 102. One major resource on the appliance 102 is session memory. A session is a network transfer of information, including the files that the appliance 102 analyzes according to the techniques described herein. A single appliance may have millions of simultaneous sessions, and the memory that can be sustained during a given session is very limited. A first challenge in performing inline analysis on a data appliance, such as the data appliance 102, is that due to such memory constraints, the data appliance 102 typically cannot process an entire file at once, but instead receives a series of packets that must be processed packet by packet. Thus, the machine learning approach used by the data appliance 102 must accommodate the packet stream in various embodiments. A second challenge is that in some cases, the data appliance 102 cannot determine where a given file being processed ends (e.g., the end of the samples 130 in the stream). The machine learning approach used by the data appliance 102 therefore needs to be able to make a decision regarding a given file potentially midstream (e.g., midway through receipt / processing of the sample 130 or otherwise before the actual end of the file) in various embodiments.

[0059] A. Machine Learning Models

[0060] As described in further detail below, in various embodiments, the security platform 122 provides a set of machine learning models to the data appliance 102 for use with inline malware detection. The models incorporate features (e.g., n-grams or other features) determined by the security platform 122 that correspond to malicious files. Examples of two types of such models include linear and non-linear classification models. Examples of linear classification models that may be used by the data appliance 102 include logistic regression and linear support vector machines. One example of a non-linear classification model that may be used by the data appliance 102 includes gradient boosting trees (e.g., eXtreme Gradient Boosting (XGBoost)). The non-linear models are more accurate (and can better detect obfuscated / disguised malware), while the linear models use significantly fewer resources in the appliance 102 (and are more suitable for efficiently analyzing JavaScript or similar files).

[0061] As described in more detail below, the type of classification model used for a given file being analyzed can be based on the file type associated with that file (and can be determined, for example, by a magic number).

[0062] 1. Additional Threat Engine Details

[0063] In various embodiments, the data appliance 102 includes a threat engine 244. The threat engine incorporates both protocol decoding and threat signature matching during respective decoder and pattern match stages. The results of the two stages are merged by the detector stage.

[0064] When the data appliance 102 receives a packet, it performs a session match to determine which session the packet belongs to (allowing the data appliance 102 to support simultaneous sessions). Each session has a session state, which refers to a particular protocol decoder (e.g., a Web browsing decoder, an FTP decoder, or an SMTP decoder). When a file is sent as part of a session, the applicable protocol decoder can use the appropriate file-specific decoder (e.g., a PE file decoder, a JavaScript decoder, or a PDF decoder).

[0065] A portion of one example embodiment of the threat engine 244 is shown in FIG. 4. For a given session, the decoder 402 walks the traffic byte stream according to the corresponding protocol and marking context. One example of a context is an end-of-file context (e.g., encountering while processing a JavaScript file). The decoder 402 can mark the end-of-file context in a packet, which can then be used to trigger execution of an appropriate model using the observed characteristics of the file. In some cases (e.g., FTP traffic), there may not be an explicit protocol-level tag for the decoder 402 to identify / mark the context. As described in more detail below, in various embodiments, the decoder 402 uses other information (e.g., file size reported in the header) to determine when feature extraction for the file should end (e.g., begin the overlay section) and execution using the appropriate model should begin.

[0066] The decoder 402 is composed of two parts. The first part of the decoder 402 is a virtual machine part (404) that can be implemented as a state machine using a state machine language. The second part of the decoder 402 is a set of tokens 406 for triggering state machine transitions and actions when traffic is matched. The threat engine 244 also includes a threat pattern matcher 408 (e.g., using regular expressions) that performs pattern matching (e.g., against threat patterns). As one example, the threat pattern matcher 408 can include (e.g., by the security platform 122) a table of strings to match (either exact strings or wildcard strings) and corresponding actions to take if a matching string is found. The detector 410 processes the output provided by the decoder 402 and the threat pattern matcher 408 to take various actions.

[0067] 2. N-grams

[0068] The data in a session can be divided into a series of n-grams - a series of byte strings. As an example, assume that some of the hexadecimal data in a session is "1023ae42f6f28762aab". Then, the 2-grams in the sequence are all pairs of adjacent characters, such as "1023", "23ae", "ae42", "42f6", etc. In various embodiments, the threat engine 244 is configured to analyze the file using 8-grams. Other n-grams can also be used, such as 7-grams or 4-grams. In the example string above, "1023ae42f6f28762" is an 8-gram, "23ae42f6f28762aa" is an 8-gram, etc. The total number of different 8-grams possible in a byte sequence is 2^64 (18,446,744,073,709,551,616). Searching for all of the possible 8-grams within a byte sequence would easily exceed the resources of the data appliance 102. Instead, a greatly reduced set of 8-grams is provided by the security platform 122 to the data appliance 102 for use by the threat engine 244, as described in more detail below.

[0069] When a session packet corresponding to a file is received by the threat engine 244, the threat pattern matcher 408 analyzes the packet for matches against strings in the table (e.g., by performing regular expressions and / or exact string matching). A list of matches (e.g., each instance of a match identified by a corresponding pattern ID) and at which offset each match occurred is generated. Actions on these matches are taken in offset order (e.g., bottom to top). For a given match (i.e., corresponding to a particular pattern ID), a set of one or more actions to be taken is specified (e.g., via an action table that maps actions to pattern IDs).

[0070] The set of 8-grams provided by the security platform 122 can be added (e.g., as an exact string match) as an addition to a table of matches that the threat pattern matcher 408 is already performing (e.g., heuristic matches that look for specific indicators of malware, such as where a JavaScript file accesses password storage or where a PE file calls a Local Security Authority Subsystem Service (LSASS) API). One advantage of this approach is that 8-grams can be searched in parallel with other searches performed by the threat pattern matcher 408, instead of performing multiple passes through the packet (e.g., first evaluating a heuristic match and then evaluating an 8-gram match).

[0071] As described in more detail below, 8-gram matches are used by both linear and non-linear classification models in various embodiments. Examples of actions that can be specified for n-gram matches include incrementing a weighted counter (e.g., for linear classifiers) and saving the match in a feature vector (e.g., for non-linear classifiers). Which action is taken can be specified based on the file type associated with the packet (which determines which type of model to use).

[0072] 3. Model Selection

[0073] In some cases, a particular file type is specified in the file's header (e.g., as a magic number that appears in the first 7 bytes of the file itself). In such a scenario, the threat engine 244 can select an appropriate model that corresponds to the specified file type (e.g., based on a table provided by the security platform 122 that lists file types and corresponding models). In other cases, such as JavaScript, the magic number or other file type identifier (if present in the header) does not certify which classification model should be used. As an example, JavaScript would have a file type of "textfile". To identify file types such as JavaScript, the decoder 402 is used to perform deterministic finite state automaton (DFA) pattern matching and then heuristics (e.g., identifying that a file is JavaScript) that are used to classify files. <script>および他のインジケータ)を適用することができる。決定されたファイルタイプ及び / 又は選択された分類モデルは、セッション状態に保存される。セッションに関連付けられたファイルタイプは、セッションの進行につれて、更新することができる。例えば、テキストストリームにおいて、<script>タグに出会うとき、JavaScriptファイルタイプをセッションに割り当てることができる。対応する< / script> When encountered, the file type can be changed (e.g. back to plain text).

[0074] 4. Linear Classification Models

[0075] One way to express the linear model is using the following linear equation:

[0076] Σ(β i x i ) <C,i=1,2,3…,P where P is the total number of features and x i is the i-th feature, and β i is feature x i where C is a coefficient (weight) of, and C is a threshold constant. In this example, C is the threshold for malicious verdicts, meaning that if the sum for a given file is less than C, the file is assigned a benign verdict, and if the sum is greater than or equal to C, the file is assigned a malicious verdict.

[0077] One approach to using a linear classification model with data instrument 102 is as follows: A single float (d) is used to track the scores of the input files, and the observed n-grams and corresponding coefficients (i.e., x i and β i For each incoming packet, each n-gram feature (e.g., as provided by the security platform 122) is checked. The features in the hash table (x i ), we find a single float (β i ) is added (say to d). When the end of the file is reached, a single float (d) is compared against a threshold (C) to determine a decision for the file.

[0078] For n-gram counts, feature x i is equal to the number of times the i-th n-gram is observed. Suppose the i-th n-gram is observed 4 times for a particular file. 4*β i is β i +β i +β i +β i We count how many times the i-th n-gram is observed (i.e., 4 times), and then we use β i Instead of multiplying by β every time the i-th n-gram is observed, another approach is to multiply by β i Furthermore, suppose that the jth n-gram is observed three times in the file. i Similarly, β i +β i +β i can be written as β i Instead of counting how many times is observed, we count each time β i and then add it all together.

[0079] Σ(β i x i ), β ix i , β j x j , ... are added together (where ... correspond to all the other features / weights). This means that β i +β i +β i +β j +β j +β j +β j Since addition is cumulative, the addition of values ​​can be done in any order (e.g., β i +β j +β i +β j +β i +β i +β j , etc.) and accumulate to a single float. Assume the float (d) starts at 0.0. i Each time is observed, β i is added to the float d, and x j Each time is observed, β j can be added to the float d. This approach allows a 4-byte float to be used as the total memory per session, and contrasts with approaches where the memory per session is proportional to the number of features, where the entire feature vector is kept in memory as it is multiplied by the weight vector. Using the example of 4 bytes * 1,000 4K bytes of features, 4K of storage would be required (compared to a single 4-byte float), which is 1,000 times more expensive.

[0080] 5. Nonlinear Classification Models

[0081] Various non-linear classification approaches can be used with the techniques described herein. One example of a non-linear classification model is a gradient boosting tree. In this example, the feature vector is initialized to an all-zero vector. Unfortunately, in a non-linear model (unlike a linear model), the entire set of features whose presence has been detected (e.g., 1000 features) is persisted for the entire duration of the session. This is not as efficient as in the linear approach, but some efficiency can still be obtained by downsampling the features to be 1-byte (0-255) floats rather than full 4-byte floats (which can be used on devices where memory is not constrained).

[0082] As the data appliance 102 scans the entire file, each time a feature is observed, the value of the feature is incremented by one in the feature vector. Once the end of the file is reached (or an end of feature observations otherwise occurs), the constructed feature vector is fed into the gradient boosting tree model (e.g., received from the security platform 122). As described in more detail below, non-linear classification models can be constructed using both n-gram (e.g., 8-gram) and non-n-gram features. One example of a non-n-gram feature is the purported size of a file (which can be read as a value from a packet containing the file's header). File data that appears after the intended end of the file (e.g., based on the file size specified in the header) is called an overlay. In addition to serving as a feature, the intended file length can be used as a proxy for how long the file is expected to be. A non-linear classifier can be run on the packet stream of the file until the intended file length is reached. A verdict can then be formed for the file, regardless of whether the end of the file has actually been reached or not. The inclusion of an overlay in a given file is also an example of a feature that may be used as part of a non-linear classification model. In various embodiments, the overlay portion of the file is not analyzed, and again, analysis can occur prior to the actual end of the file. In other embodiments, feature extraction is performed and a verdict+on maliciousness is not made until the actual end of the file is reached.

[0083] In one exemplary embodiment, the tree model includes 5000 binary trees. Every node on each tree includes a feature and a corresponding threshold. An example of a portion of a tree is shown in FIG. 5. In the example shown in FIG. 5, if the value of a feature (e.g., feature F4) is less than its threshold (e.g., 30), the left branch is taken (502). If the value of the feature is equal to or greater than the threshold, the right branch is taken (504). The tree proceeds until a leaf node (e.g., node 506) is reached that has an associated value (e.g., 0.7). The values ​​of each leaf reached are summed (for each tree) (rather than multiplied) to obtain a final score for computing a verdict. If the score is below the threshold, the file is deemed benign, and if it is equal to or greater than the threshold, the file is deemed malicious. The lack of multiplication in obtaining the final score helps the model to be used more efficiently in the resource-constrained environment of the data appliance 102.

[0084] In various embodiments, the tree itself may be fixed in the data appliance 102 (until an updated model is received) and stored in a shared memory that may be accessed by multiple sessions simultaneously. The cost per session is the cost of storing the feature vectors for a session, which may be zero once analysis of the session is complete.

[0085] 6. Example of Process Implementation

[0086] 6 illustrates an example process for performing inline malware detection on a data appliance. In various embodiments, process 600 is performed by the data appliance 102, and in particular by the threat engine 244. The threat engine 244 may be implemented using a script (or set of scripts) written in a suitable scripting language (e.g., Python). Process 600 may also be performed at an endpoint, such as the client device 110 (e.g., by an endpoint protection application executing on the client device 110).

[0087] Process 600 begins at 602 when an indication is received by device 102 that a file is being transmitted as part of a session. As one example of the processing performed at 602, for a given session, an associated protocol decoder may invoke or otherwise use an appropriate file-specific decoder when the start of a file is detected by the protocol decoder. As described above, the file type is determined (e.g., by decoder 402) and associated with the session (e.g., such that subsequent file type analysis does not need to be performed until the file type changes or no more file packets are transmitted).

[0088] At 604, n-gram analysis is performed on the sequence of received packets. As mentioned above, n-gram analysis can be performed inline with other analysis being performed by the device 102 on the session. For example, while the device 102 is performing an analysis on a particular packet (e.g., to check for the presence of a particular heuristic), it can also determine whether an 8-gram in the packet matches an 8-gram provided by the security platform 122. During the processing performed at 604, when an n-gram match is found, the corresponding pattern ID is used to map the condition to an action based on the filetype. The action is either to increment a weighted counter (e.g., if the filetype is associated with a linear classifier) ​​or to update a feature vector to account for the match (e.g., if the filetype is associated with a non-linear classifier).

[0089] The n-gram analysis continues, packet by packet, until either an end-of-file condition or a checkpoint is reached, at which point (606) the appropriate model is used to determine the verdict of the file (i.e., comparing the final value obtained using the model to a maliciousness threshold). As mentioned above, the model incorporates n-gram features, and may also incorporate other features (e.g., in the case of a non-linear classifier).

[0090] Finally, at 608, an action is taken in response to the determination made at 606. One example of a responsive action is to terminate the session. Another example of a responsive action is to allow the session to continue but prevent the file from being transmitted (instead, placing it in a quarantine area). In various embodiments, the device 102 is configured to share its verdict (either a benign verdict, a malicious verdict, or both) with the security platform 122. Once the security platform 122 has completed its independent analysis of the file, it can use the verdict reported by the device 102 for various purposes, including evaluating the performance of the model that formed the verdict.

[0091] An example of a threat signature for a sample is shown in Figure 7B. In particular, for a sample with a SHA-256 hash of "4d73f42438fb5a8579219cdfa9cbbb4ce3f771ffed93af81b052831e4813f8," the first value in each pair corresponds to a feature and the second value corresponds to a count. In the example shown in Figure 7B, features that include numbers (e.g., feature "3905") correspond to n-gram features, and features that include a "J" and a number (e.g., feature "J18") correspond to non-n-gram features.

[0092] In one exemplary embodiment, security platform 122 is configured to target a particular false positive ratio (e.g., 0.001) when generating models for use by devices such as data device 102. Thus, in some cases (e.g., 1 in 1000 files), data device 102 may erroneously determine that a benign file is malicious when performing an inline analysis using a model according to the techniques described herein. In such a scenario, if security platform 122 subsequently determines that the file is in fact benign, it may add it to a whitelist to prevent it from being later flagged as malicious (e.g., by another device).

[0093] One approach to whitelisting is to instruct the security platform 122 to add the file to a whitelist stored on the device 102. Another approach is to instruct the security platform 122 to a false positive whitelist system 154, which in turn keeps devices such as the device 102 up to date with the false positive information. As mentioned above, one problem with devices such as the device 102 is that they are resource constrained. One approach to minimize the resources used to maintain a whitelist on the device is to maintain the whitelist using a Least Recently Used (LRU) cache. The whitelist can include file hashes, and can also be based on other factors, such as feature vectors or hashes of feature vectors.

[0094] VI. Building the Model

[0095] Returning to the environment shown in FIG. 1, as described above, security platform 122 is configured to perform static and dynamic analysis on received samples. Security platform 122 can receive samples for analysis from a variety of sources. As described above, one exemplary type of sample source is a data appliance (e.g., data appliances 102, 136, and 148). Other sources (e.g., one or more third party providers of samples, such as other security appliance vendors, security researchers, etc.) can also be used as desired. As described in more detail below, security platform 122 can use the corpus of samples it receives to build models (e.g., the models can then be used by security appliance 102 in accordance with embodiments of the techniques described herein).

[0096] In various embodiments, the static analysis engine 306 is configured to perform feature extraction on received samples (e.g., while performing other static analysis functions as described above). One exemplary process for performing feature extraction (e.g., by the security platform 122) is shown in FIG. 8A. Process 800 begins at 802 when static analysis of a sample is initiated. During feature extraction (804), all 8-grams (or other applicable n-grams in embodiments where 8-grams are not used) are extracted from the sample being processed (e.g., sample 130 of FIG. 3). In particular, a histogram of 8-grams in the sample being analyzed is extracted (e.g., in a hash table), which indicates the number of times a given 8-gram was observed in the sample being processed. One advantage of extracting 8-grams during feature analysis by the static analysis engine 306 is that it mitigates potential privacy and contractual concerns in the use of samples obtained from third parties (e.g., in building models), since the original file cannot be reconstructed from the resulting histograms. The extracted histograms are stored at 806.

[0097] In various embodiments, the static analysis engine 306 stores the extracted histogram (e.g., represented using a hash table) for a given sample in storage 142 (e.g., a Hadoop cluster) along with histograms extracted from other samples. Data in Hadoop is compressed, and when operations are performed on the Hadoop data, the necessary data is decompressed on the fly. An example of an exemplary hash table (represented in JSON) for a file is shown in FIG. 7A. Line 702 shows the SHA-256 hash of the file. Line 704 shows the UNIX time that the sample 130 arrives at the security platform 122. Line 706 shows the count of n-grams in the overlay portion (e.g., 'd00fbf4e08bc366':1 indicates that one instance of 'd00fbf4e08bc366' was found in the overlay section). Line 708 shows the count of each 8-gram present in the file. Line 710 indicates that the file has an overlay. Line 712 indicates that the file has a file type of ".exe". Line 714 indicates the UNIX time that security platform 122 finished processing sample 130. Line 716 indicates a count of each non-8-gram feature that the file hit. Finally, line 718 indicates that the file was determined to be malicious (e.g., by security platform 122).

[0098] In one exemplary embodiment, the set of 8-gram histograms stored in the Hadoop cluster grows by approximately 3 terabytes of 8-gram histogram data per day. The histograms correspond to both malicious and benign samples (e.g., labeled as such based on the results of other static and dynamic analyses performed by security platform 122 as described above).

[0099] The histogram of 8-grams extracted from the analyzed sample is roughly 10% larger than the file itself, and a typical sample has a histogram containing roughly 1 million different 8-grams. The total number of different possible 8-grams is 2^64 (2 64 ). As noted above, in contrast, the classification models transmitted by the security platform 122 (e.g., as part of a subscription) to devices such as the data appliance 102 may, in various embodiments, include only a few thousand features (e.g., 1000 features). Potentially up to 2 64 One exemplary method of reducing the set of features to the 1000 most important features to use in the model is to use mutual information techniques. Other approaches (e.g., chi-squared score) are also applicable. The four required parameters include the number of malicious samples with the given feature, the number of benign samples with the given feature, the total number of malicious samples, and the total number of benign samples. One advantage of mutual information is that it can be used efficiently in very large datasets. In Hadoop, the mutual information approach can be performed in a single pass (i.e., through all 8-gram histograms stored in the Hadoop cluster dataset for a given file type) by distributing the task across multiple mappers, each responsible for processing a particular feature. Those features with the highest mutual information can be selected as the set of features most indicative of maliciousness and / or most indicative of benignity, if applicable. The resulting 1000 features can then be used to build models (e.g., linear and non-linear classification models), if applicable. For example, to build a linear classification model, a model builder 152 (implemented using a set of open source tools and / or scripts written in a suitable language, such as python) saves the top 1000 features and applicable weightings as a set of n-gram features for the device 102 to check (e.g., as described in section VA4 above).

[0100] In some embodiments, the non-linear classification model is also built by the model builder 152 using the top 1000 (or other desired number) of features. In other embodiments, the non-linear classification model is built primarily using the top features (e.g., 950), but also incorporates other non-n-gram features (e.g., 50 such features) that may be detected during per-packet feature extraction and analysis. Some examples of non-n-gram features that can be incorporated into the non-linear classification model include (1) the size of the header, (2) the presence or absence of a checksum in the file, (3) the number of sections in the file, (4) the intended length of the file (as indicated in the PE file header), (5) whether the file contains an overlay portion, and (6) whether the file requires the Windows EFI subsystem to run the PE.

[0101] In some embodiments, rather than using mutual information to select the top 1000 features, a larger set of features (an over-generated feature set) is determined. As an example, the top 5000 features can be first selected using mutual information. The set of 5000 can then be used as input to a traditional feature selection technique (e.g., bagging), which does not scale well for very large datasets (e.g., the entire Hadoop dataset), but is more effective for reduced sets (e.g., 5000 features). Traditional feature selection techniques can be used to select the final 1000 features from the set of 5000 features identified using mutual information.

[0102] Once the final 1000 features are selected, one exemplary method for building the nonlinear model is to use open source tools such as scikit-learn or XGBoost. If applicable, parameter tuning can be performed, such as by using cross-validation.

[0103] One exemplary process for generating a model is shown in FIG. 8B. In various embodiments, process 850 is performed by security platform 122. Process 850 begins at 852 when a set of extracted features (e.g., including n-gram features) is received. One exemplary way that the set of features can be received is by reading features stored as a result of process 800. At 854, a reduced set of features is determined from the features received at 852. As discussed above, one exemplary way of determining the reduced set of features is by using mutual information. Other approaches (e.g., chi-squared score) can also be used. Furthermore, as also discussed above, a combination of techniques can also be used at 852 / 854, such as using mutual information to select an initial set of features and refining the initial set of features using bagging or other suitable techniques. Finally, as discussed above, once features are selected (e.g., at 854), a suitable model is constructed at 856 (e.g., using open source or other tools and performing parameter tuning, if applicable). The model (e.g., generated by model builder 152 using process 850) may be transmitted (e.g., as part of a subscription service) to data appliance 102 and other applicable recipients (e.g., data appliances 136 and 148).

[0104] In various embodiments, model builder 152 generates models (e.g., linear and non-linear classification models) on a daily (or other applicable) basis. By performing process 850 or otherwise generating models periodically, security platform 122 can help ensure that models used by devices, such as device 102, detect the latest types of malware threats (e.g., threats most recently deployed by malicious individuals).

[0105] Whenever a newly generated model is determined to be better than an existing model (e.g., as determined based on a set of quality assessment metrics that exceed a threshold), an updated model may be sent to a data appliance, such as data appliance 102. In some cases, such updates adjust the weights assigned to features. Such updates are easily deployed to the appliance and adopted by the appliance (e.g., as real-time updates). In other cases, such updates adjust the features themselves. Such updates may require patches to components of the appliance, such as the decoder, making deployment more complicated. One advantage of using overtraining during model generation is that the model can take into account whether the decoder can detect a particular feature.

[0106] In various embodiments, the appliance is required (e.g., by the security platform 122) to deploy updates to the models as they are received. In other embodiments, the appliance can selectively deploy updates (at least for a period of time). As an example, when a new model is received by the appliance 102, the existing model and the new model can both run in parallel on the appliance 102 for a period of time (e.g., the existing model is used in production and the new model reports on actions that would be taken without actually executing them). The appliance administrator can indicate whether the existing model or the new model should be used to process traffic on the appliance (e.g., based on which model performs better). In various embodiments, the appliance 102 returns telemetry to the security platform 122 indicating information such as which model is running on the appliance 102 and how effective the model is (e.g., false positive statistics).

[0107] Although the above embodiments have been described in some detail for clarity of understanding, the invention is not limited to the details provided. There are many alternative ways to implement the invention. The disclosed embodiments are illustrative and not restrictive.

Claims

1. 1. A system comprising: a processor; receiving a set of features extracted from a set of files, the set including a plurality of n-grams; determining a reduced set of features including at least a portion of the plurality of n-grams, the reduced set of features being determined using mutual information, selecting a set of features most indicative of maliciousness and / or most indicative of benignness as the reduced set of features; and using the reduced set of features to generate a model usable by a data appliance to perform inline malware analysis; A processor; a memory coupled to the processor and configured to provide instructions to the processor; Including, the system.

2. the set of features includes features extracted from a set of known malicious files; The system of claim 1 .

3. the set of features includes features extracted from a set of known benign files; The system of claim 1 .

4. The reduced set of features is determined using a chi-squared score. The system of claim 1 .

5. The generated model includes n-gram features. The system of claim 1 .

6. The model is a linear model. The system of claim 1 .

7. The model is a non-linear model. The system of claim 1 .

8. the plurality of n-grams are extracted during static analysis of the set of files; The system of claim 1 .

9. a system in which the model is transmitted to a first data device; The system of claim 1 .

10. in response to a false positive result reported by the second data device, the processor is configured to generate an updated model and transmit the updated model to the first data device. The system of claim 9.

11. A method comprising: receiving, by a central processing unit (CPU) of the data appliance, a set of features extracted from the set of files, the set of features including a plurality of n-grams; determining, by the CPU, a reduced set of features including at least a portion of the plurality of n-grams, the reduced set of features being determined using mutual information, and selecting a set of features most indicative of maliciousness and / or most indicative of benignness as the reduced set of features; using, by the CPU, the reduced set of features to generate a model usable by the data appliance to perform inline malware analysis; A method comprising:

12. A computer program comprising a plurality of computer instructions stored on a tangible computer readable storage medium, When the computer instructions are executed, they cause the computer to: receiving a set of features extracted from a set of files, the set of features including a plurality of n-grams; determining a reduced set of features comprising at least a portion of the plurality of n-grams, the reduced set of features being determined using mutual information, and selecting a set of features most indicative of maliciousness and / or most indicative of benignness as the reduced set of features; using the reduced set of features to generate a model usable by a data appliance to perform inline malware analysis; A computer program that causes the

Images