Deep learning pipeline for detecting malicious commands and controlling traffic

Abstract

A method for detecting command and control malware is disclosed. Network traffic sessions are monitored. Using a deep learning model, automatic feature identification is performed for real-time malicious command and control traffic detection based on request headers of the monitored network traffic sessions.

Description

[Background technology]

[0001] Malware is a general term commonly used to refer to malicious software (e.g., including a variety of hostile, intrusive, and / or otherwise unwanted software). Examples of malware uses include disrupting the operation of computers and / or computer networks, stealing confidential information (e.g., sensitive information such as identity, financial, and / or intellectual property-related information), and / or gaining access to private / private computer systems and / or computer networks. Malware can be in the form of code, scripts, active content, and / or other software. Unfortunately, as technologies are developed to aid in the detection and mitigation of malware, nefarious authors find ways to circumvent these efforts. Thus, there is a continuing need for improvements to techniques for identifying and mitigating malware. [Brief explanation of the drawings]

[0002] Various embodiments of the present invention are disclosed in the following detailed description and accompanying drawings. [Figure 1] FIG. 1 shows an example of an environment in which malicious applications are detected and prevented from causing harm. [Figure 2A] FIG. 2A shows an example of a data appliance. [Figure 2B] FIG. 2B is a functional diagram of the logical components of one embodiment of a data appliance. [Figure 3] FIG. 3 shows one example of logical components that may be included in a system for analyzing a sample. [Figure 4A] FIG. 4A illustrates one embodiment of a process for performing command detection and malware control. [Figure 4B]FIG. 4B illustrates one embodiment of a process for performing automatic feature identification. [Figure 4C] FIG. 4C illustrates one embodiment of a process for feeding character and word tokens into an embedding layer of a deep learning model to find groups of features. [Figure 5] FIG. 5 shows one embodiment of a request header. [Figure 6] FIG. 6 shows one embodiment of a buried layer. [Figure 7] FIG. 7 shows an example of one-dimensional convolution. [Figure 8] FIG. 8 shows one embodiment of a model architecture involving convolution. [Figure 9] FIG. 9 shows one example of bidirectional long short-term memory with attention. [Figure 10] FIG. 10 shows one example of a fully connected layer in a deep learning network. [Figure 11] FIG. 11 shows one example of a cost function. [Figure 12] FIG. 12 shows one example of results from model training. DETAILED DESCRIPTION OF THE INVENTION

[0003] The present invention can be implemented in numerous ways, including as a process, an apparatus, a system, a composition of matter, a computer program product embodied on a computer-readable storage medium, and / or a processor, such as instructions stored on a memory and / or a processor configured to execute instructions stored and / or provided by a memory coupled to the processor. These implementations, or any other form the present invention may take, may be referred to herein as techniques. In general, the order of steps in disclosed processes may be varied within the scope of the present invention. Unless otherwise specified, components, such as a processor or memory, described as configured to perform a task may be implemented as general-purpose components temporarily configured to perform the task at a given time, or as specific components manufactured to perform the task. As used herein, the term “processor” refers to one or more devices, circuits, and / or processing cores configured to process data, such as computer program instructions.

[0004] A detailed description of one or more embodiments of the present invention is provided below along with accompanying figures that illustrate the principles of the invention. While the present invention will be described in connection with such embodiments, the present invention is not limited to any embodiment. The scope of the present invention is limited only by the claims, and the present invention encompasses numerous alternatives, modifications, and equivalents. Numerous specific details are set forth in the following description to provide a thorough understanding of the present invention. These details are provided for the purpose of example, and the present invention may be practiced according to the claims without some or all of these specific details. For the purposes of clarity, technical material known in the art related to the present invention has not been described in detail so as not to unnecessarily obscure the present invention.

[0005] In some embodiments, a system / method / computer program product for performing command detection and malware control includes monitoring network traffic sessions and using a deep learning model to perform automatic feature identification for real-time malicious command and control traffic detection based on request headers of the monitored network traffic sessions.

[0006] In some embodiments, performing automatic feature identification for real-time malicious command and control traffic detection includes extracting the request header from the network traffic session, performing tokenization of the request header to generate character tokens and word tokens, and feeding the character tokens and the word tokens to an embedding layer of the deep learning model to find groups of features.

[0007] In some embodiments, feeding the character tokens and the word tokens into an embedding layer of the deep learning model to find groups of features includes multiplying the embedding layer with a filter matrix to obtain a convolutional layer, and max-pooling elements of the convolutional layer to obtain the groups of features.

[0008] In some embodiments, multiplying the embedding layer with a filter matrix to obtain the convolutional layer includes multiplying the embedding layer with the filter matrix at a first position to obtain a first element of the convolutional layer, shifting the filter matrix down one row along the embedding layer to obtain a second position of the filter matrix, and multiplying the embedding layer with the filter matrix at the second position to obtain a second element of the convolutional layer.

[0009] In some embodiments, performing automatic feature identification for the real-time malicious command and control traffic detection includes finding contextual relationships between features in the group of features using a Bidirectional Long Short-Term Memory (Bi-LSTM) after the max-pooling of the plurality of elements is performed.

[0010] In some embodiments, the system / method / computer program product further includes predicting a label for a HyperText Transfer Protocol (HTTP) session based on the probability score using a fully connected layer of the deep learning model.

[0011] In some embodiments, the deep learning model corresponds to a neural network.

[0012] I. Overview

[0013] A firewall generally allows authorized communications to pass through the firewall while protecting the network from unauthorized access. A firewall is typically a device, set of devices, or software running on devices that provides firewall functionality for network access. For example, a firewall can be integrated into the operating system of a device (e.g., a computer, a smartphone, or other type of network-enabled device). Firewalls can also be integrated or run as software applications on various types of devices or security devices, such as computer servers, gateways, network / routing devices (e.g., network routers), or data appliances (e.g., security appliances or other types of special-purpose devices), and in some implementations, certain operations can be implemented in special-purpose hardware, such as an ASIC or FPGA. do.

[0014] Firewalls typically deny or allow network transmissions based on a set of rules. These sets of rules are often referred to as policies (e.g., network policies or network security policies). For example, a firewall can filter inbound traffic by applying a set of rules or policies to prevent unwanted external traffic from reaching a protected device. A firewall can also filter outbound traffic by applying a set of rules or policies (e.g., allow, block, monitor, notify, or log, and / or other actions that may be specified in a firewall rule or firewall policy, which may be triggered based on various criteria, as described herein). A firewall can also filter local network (e.g., intranet) traffic by similarly applying a set of rules or policies.

[0015] Security devices (e.g., security appliances, security gateways, security services, and / or other security devices) may perform various security operations (e.g., firewalls, anti-malware, intrusion prevention / detection, proxies, and / or other security functions), network functions (e.g., routing, quality of service (QoS), workload balancing of network-related resources, and / or other network functions), and / or other security and / or network-related functions. For example, routing may be performed based on source information (e.g., IP addresses and ports), destination information (e.g., IP addresses and ports), and protocol information.

[0016] Basic packet filtering firewalls filter network communication traffic by inspecting individual packets sent over the network (e.g., stateless packet filtering firewalls, or first-generation firewalls). Stateless packet filtering firewalls typically inspect the individual packets themselves and then apply rules based on the inspected packets (e.g., using a combination of the packet's source and destination address information, protocol information, and port numbers).

[0017] Application firewalls can also perform application-layer filtering (e.g., using an application-layer filtering firewall or a second-generation firewall that functions at the application level of the TCP / IP stack). Application-layer filtering firewalls or application firewalls can generally identify certain applications and protocols (e.g., web browsing using the Hypertext Transfer Protocol (HTTP), Domain Name System (DNS) requests, file transfers using the File Transfer Protocol (FTP), and various other types of applications and other protocols, such as Telnet, DHCP, TCP, UDP, and TFTP (GSS)). For example, an application firewall can block unauthorized protocols that attempt to communicate on standard ports (e.g., unauthorized / out-of-policy protocols that attempt to sneak through by using a non-standard port for that protocol can generally be identified using an application firewall).

[0018] Stateful firewalls can also perform stateful-based packet inspection, where each packet is inspected within the context of the set of packets associated with its network outbound packet flow. This firewall technique is commonly referred to as stateful packet inspection because it keeps a record of all connections passing through the firewall and can determine whether a packet is the start of a new connection, part of an existing connection, or an invalid packet. For example, the state of a connection can itself be one of the criteria that triggers a rule in a policy.

[0019] Advanced or next-generation firewalls can perform stateless and stateful packet filtering and application layer filtering, as described above. Next-generation firewalls can also implement additional firewall technologies. For example, certain newer firewalls, often referred to as advanced or next-generation firewalls, can also identify users and content. In particular, certain next-generation firewalls have expanded the list of applications that they can automatically identify to thousands of applications. Examples of such next-generation firewalls are commercially available from Palo Alto Networks (e.g., the Palo Alto Networks PA Series firewalls). For example, Palo Alto Networks next-generation firewalls use various identification technologies to enable enterprises and service providers to identify and control applications, users, and content—not just ports, IP addresses, and packets. Various identification technologies include Application ID (App-ID) for precise application identification, User ID (User-ID) for user identification (e.g., User ID), Content ID (Content-ID) for real-time content scanning (e.g., to control web surfing and restrict data and file transfers), and Device ID (e.g., for identifying IoT device types). These identification technologies allow enterprises to securely enable application usage using business-relevant concepts instead of following the traditional approach provided by traditional port-blocking firewalls.Additionally, special-purpose hardware for next-generation firewalls (e.g., implemented as dedicated devices) generally provides higher performance levels for application inspection than software running on general-purpose hardware (e.g., security appliances from Palo Alto Networks, Inc., which utilize dedicated, function-specific processing that is tightly integrated with a single-pass software engine to minimize latency while maximizing network throughput, as in the case of Palo Alto Networks' PA Series Next-Generation Firewalls).

[0020] Advanced or next-generation firewalls can also be implemented using virtualized firewalls. An example of such a next-generation firewall is commercially available from Palo Alto Networks (Palo Alto Networks firewalls are deployed on VMware® ESXi). TM and NSX TM , Citrix® Netscaler SDX TM It supports a variety of commercial virtualization environments, including KVM / OpenStack (Centos / RHEL, Ubuntu®), and Amazon Web Services (AWS). For example, the virtualized firewall can support similar or identical next-generation firewall and advanced threat prevention capabilities available in physical form factor devices, allowing enterprises to safely enable the influx of applications to private, public, and hybrid cloud computing environments. Automation capabilities such as VM monitoring, dynamic address groups, and a REST-based API allow enterprises to dynamically monitor VM changes and update security policies with that context, thereby eliminating policy lag that can occur when VMs change.

[0021] II. Example Environment

[0022] FIG. 1 illustrates one example of an environment in which malicious applications (“malware”) are detected and prevented from causing harm. As described in more detail below, malware classifications (e.g., as determined by security platform 122) may be shared and / or refined in various ways among various entities included in the environment shown in FIG. 1. Using techniques described herein, devices, such as endpoint client devices 104-110, may then be protected from such malware.

[0023] The term "application" is used throughout this specification to collectively refer to programs, program bundles, manifests, packages, etc., regardless of format / platform. An "application" (also referred to herein as a "sample") may be a standalone file (e.g., a calculator application with the file name "calculator.apk" or "calculator.exe"), and may also be an independent component of another application (e.g., a mobile advertising SDK or library embedded within a calculator application).

[0024] As used herein, “malware” refers to applications that engage in behavior, covert or not (and illegal or not), that a user would not / would not approve of if fully informed. Examples of malware include Trojan horses, viruses, rootkits, spyware, hacking tools, keyloggers, etc. One example of malware is a desktop application that collects and reports an end user's location to a remote server (but does not provide the user with location-based services, such as a mapping service). Another example of malware is a malicious Android application package .apk (APK) file that appears to be a free game to the end user but stealthily sends SMS premium messages (e.g., costing $10 each), increasing the end user's phone bill. Another example of malware is the Apple iOS Flashlight application that stealthily collects a user's contact information and sends them to spammers. Other forms of malware may also be detected / thwarted using the techniques described herein (e.g., ransomware). Additionally, although malware signatures are described herein as being generated for malicious applications, the techniques described herein may also be used in various embodiments to generate profiles for other types of applications (e.g., adware profiles, goodware profiles, etc.).

[0025] The techniques described herein may be used with various platforms (e.g., desktops, mobile devices, gaming platforms, embedded systems, etc.) and / or various types of applications (e.g., Android .apk files, iOS applications, Windows PE files, Adobe Acrobat PDF files, etc.). In the example environment shown in Figure 1, client devices 104-108 are a laptop computer, a desktop computer, and a tablet (respectively) that reside within enterprise network 140. Client device 110 is a laptop computer that resides outside enterprise network 140.

[0026] Data appliance 102 is configured to enforce policies regarding communications between client devices, such as client devices 104 and 106, and nodes outside enterprise network 140 (e.g., those reachable via external network 118). Examples of such policies include those governing traffic shaping, quality of service, and traffic routing. Other examples of policies include security policies, such as those requiring scanning for threats in incoming (and / or outgoing) email attachments, website content, files exchanged via instant messaging programs, and / or other file transfers. In some embodiments, data appliance 102 is also configured to enforce policies regarding traffic remaining within enterprise network 140.

[0027] Although shown as a single element in Figure 1, enterprise network 140 may include multiple networks, any / each of which may include one or more data appliances or other components embodying the techniques described herein. For example, the techniques described herein may be deployed by a large multinational corporation (or other entity) with multiple offices in multiple geographic locations. And, while client devices 104-108 are shown in Figure 1 as connecting directly to data appliance 102, it should be understood that one or more intermediary nodes (e.g., routers, switches, and / or proxies) can, and typically do, intervene between various elements in enterprise network 140.

[0028] One embodiment of a data appliance is shown in FIG. 2A. The illustrated example is a representation of the physical components included in a data appliance 102, in various embodiments. Specifically, the data appliance 102 includes a high-performance multi-core central processing unit (CPU) 202 and random access memory (RAM) 204. The data appliance 102 also includes storage 210 (such as one or more hard disks or solid-state units). In various embodiments, the data appliance 102 stores (either in RAM 204, storage 210, and / or other suitable locations) information used to monitor the enterprise network 110 and implement the disclosed techniques. Examples of such information include application identifiers, content identifiers, user identifiers, requested URLs, IP address mappings, policy and other configuration information, signatures, hostname / URL categorization information, malware profiles, machine learning models, IoT device classification information, etc. The data appliance 102 may also include one or more optional hardware accelerators. For example, the data appliance 102 may include a cryptographic engine 206 configured to perform encryption and decryption operations, and one or more field programmable gate arrays 208 configured to perform matching, act as a network processor, and / or perform other tasks.

[0029] The functionality described herein as being performed by data appliance 102 may be provided / implemented in a variety of ways. For example, data appliance 102 may be a dedicated device or set of devices. The functionality provided by data appliance 102 may also be integrated with or performed as software on a general-purpose computer, computer server, gateway, and / or network / routing device. In some embodiments, at least some of the services described as being provided by data appliance 102 are instead (or in addition) provided to a client device (e.g., client device 104 or client device 110) by software running on the client device (e.g., endpoint protection application 132).

[0030] Whenever the data appliance 102 is described as performing a task, a single component, a subset of components, or all components of the data appliance 102 may cooperate to perform the task. Similarly, whenever a component of the data appliance 102 is described as performing a task, a subcomponent may perform the task and / or the component may perform the task in conjunction with other components. In various embodiments, portions of the data appliance 102 are provided by one or more third parties. Depending on factors such as the amount of computing resources available to the data appliance 102, various logical components and / or features of the data appliance 102 may be omitted, and the techniques described herein may be adapted accordingly. Similarly, additional logical components / features may be included in embodiments of the data appliance 102, as applicable. One example of a component included in the data appliance 102 in various embodiments is an application identification engine configured to identify applications (e.g., using various application signatures to identify applications based on packet flow analysis). For example, the application identification engine may determine the type of traffic a session involves, such as web browsing-social networking, web browsing-news, SSH, etc.

[0031] 2B is a functional diagram of logical components according to one embodiment of a data appliance. The example shown is a representation of logical components that may be included in data appliance 102 in various embodiments. Unless otherwise specified, the various logical components of data appliance 102 may generally be implemented in a variety of ways, including as a set of one or more scripts (e.g., written in Java, Python, etc., where applicable).

[0032] As shown, data appliance 102 includes a firewall and includes a management plane 232 and a data plane 234. The management plane is responsible for managing user interaction, such as by providing a user interface for setting policies and displaying log data, and the data plane is responsible for data management, such as by performing packet processing and session handling.

[0033] The network processor 236 is configured to receive packets from client devices, such as the client device 108, and provide them to the data plane 234 for processing. The flow module 238 creates a new session flow whenever it identifies a packet as part of a new session. Subsequent packets are identified as belonging to the session based on the flow lookup. If applicable, SSL decryption is applied by the SSL decryption engine 240. Otherwise, processing by the SSL decryption engine 240 is skipped. The decryption engine 240 helps the data appliance 102 inspect and control SSL / TLS and SSH encrypted traffic and, therefore, helps stop threats that might otherwise remain hidden within the encrypted traffic. The decryption engine 240 can also help prevent sensitive content from leaving the enterprise network 140. Decryption can be selectively controlled (e.g., enabled or disabled) based on parameters such as URL category, traffic source, traffic destination, user, user group, and port. In addition to decryption policies (e.g., specifying which sessions to decrypt), decryption profiles can be assigned to control various options of the sessions controlled by the policy, for example, requiring the use of specific cipher suites and encryption protocol versions.

[0034] The application identification (APP-ID) engine 242 is configured to determine the type of traffic a session involves. As one example, the application identification engine 242 may recognize a GET request in the received data and conclude that the session requires an HTTP decoder. In some cases, such as during a web browsing session, the identified application may change, and such changes may be noted by the data appliance 102. For example, a user may first browse a company wiki (categorized as "Web Browsing-Productivity" based on the URLs visited) and then browse a social networking site (categorized as "Web Browsing-Social Networking" based on the URLs visited). Different types of protocols have corresponding decoders 244.

[0035] Based on the determination made by the application identification engine 242, the packets are sent to the appropriate decoder 244. The decoder 244 is configured to assemble the packets (which may be received out of order) into the correct order, perform tokenization, and extract information. The decoder 244 also performs signature matching to determine what should happen to the packets. If necessary, the SSL encryption engine 246 can re-encrypt the decrypted data. The packets are forwarded using a forwarding module 248 for forwarding (e.g., to a destination).

[0036] 2B, a policy 252 is also received and stored in the management plane 232. The policy can include one or more rules, which can be specified using domain names and / or host / server names, and the rules can apply one or more signatures or other matching criteria or heuristics, such as for security policy enforcement, to subscriber / IP flows based on various extracted parameters / information from the monitored session traffic flows. An interface (I / F) communicator 250 is provided for management communications (e.g., via (REST) ​​APIs, messages, or network protocol communications, or other communication mechanisms).

[0037] III. Security Platform

[0038] Returning to FIG. 1, in various embodiments, security platform 122 is configured to provide various services (including to data appliance 102), including analyzing samples (e.g., documents, applications, etc.) for malicious content, classifying applications, classifying domains / URLs / URIs, etc.

[0039] Assume that a malicious individual (using system 120) has created malware 130. The malicious individual wants a client device, such as client device 104, to run a copy of malware 130, compromising the client device and causing it to become a bot in a botnet. The compromised client device can then be instructed to perform a task (e.g., cryptocurrency mining or participating in a denial-of-service attack) and to report information to an external entity, such as command and control (C&C) server 150, and, if applicable, receive instructions from C&C server 150.

[0040] Assume that data appliance 102 intercepts an email sent (e.g., by system 120) to user “Alice,” operating client device 104. A copy of malware 130 has been attached to the message by system 120. In an alternative but similar scenario, data appliance 102 may intercept an attempted download of malware 130 by client device 104 (e.g., from a website). In either scenario, data appliance 102 determines whether a signature of the file (e.g., email attachment or website download of malware 130) is present on data appliance 102. If present, the signature can indicate that the file is known to be safe (e.g., whitelisted) and can also indicate that the file is known to be malicious (e.g., blacklisted).

[0041] In various embodiments, the data appliance 102 is configured to operate in cooperation with the security platform 122. As one example, the security platform 122 may provide the data appliance 102 with a set of signatures of known malicious files (e.g., as part of a subscription). If a signature for malware 130 (e.g., an MD5 hash of the malware 130) is included in the set of signatures, the data appliance 102 may accordingly prevent transmission of the malware 130 to the client device 104 (e.g., by detecting that the MD5 hash of an email attachment sent to the client device 104 matches the MD5 hash of the malware 130). The security platform 122 may also provide the data appliance 102 with a list of known malicious domains and / or IP addresses, enabling the data appliance 102 to block traffic between the enterprise network 140 and the C&C server 150 (e.g., if the C&C server 150 is known to be malicious). The list of malicious domains (and / or IP addresses) can also help the data appliance 102 determine when one of its nodes has been compromised. For example, if a client device 104 attempts to contact the C&C server 150, such an attempt is a strong indicator that the client 104 has been compromised by malware (and corrective action should be taken accordingly, such as quarantining the client device 104 from communicating with other nodes in the enterprise network 140). The security platform 122 can also provide other types of information to the data appliance 102 (e.g., as part of a subscription), such as a set of machine learning models that can be used by the data appliance 102 to perform inline analysis of files.

[0042] In various embodiments, various actions may be taken by the data appliance 102 if an attachment signature is not found. As a first example, the data appliance 102 may fail-safe by blocking the transmission of any attachment that is not whitelisted as benign (e.g., does not match the signature of a known good file). A potential drawback of this approach is that many legitimate attachments may be unnecessarily blocked as potential malware when they are actually benign. As a second example, the data appliance 102 may fail-danger by allowing the transmission of any attachment that is not blacklisted as malicious (e.g., does not match the signature of a known bad file). A potential drawback of this approach is that newly created malware (not previously seen by the platform 122) will not be prevented from causing harm. As a third example, the data appliance 102 may be configured to submit a file (e.g., malware 130) to the security platform 122 for static / dynamic analysis to determine whether it is malicious and / or classify it if not. While the security platform 122 is analyzing the attachment (for which a signature does not yet exist), various actions can be taken by the data appliance 102. As a first example, the data appliance 102 can prevent the email (and the attachment) from being delivered to Alice until a response is received from the security platform 122. Assuming it takes approximately 15 minutes for the platform 122 to fully analyze the sample, this means that the incoming message to Alice will be delayed by 15 minutes. In this example, the attachment is malicious, so such a delay does not negatively impact Alice. In an alternative example, suppose someone sends Alice a time-sensitive message with a benign attachment for which the signature also does not exist.Delaying delivery of the message to Alice by 15 minutes would likely be deemed unacceptable (e.g., by Alice). As described in more detail below, an alternative approach is to perform at least some real-time analysis on the attachment on data appliance 102 (e.g., while awaiting a verdict from platform 122). If data appliance 102 can independently determine whether the attachment is malicious or benign, it can take initial action (e.g., block or allow delivery to Alice) and, if applicable, adjust / take additional action once a verdict is received from security platform 122.

[0043] Security platform 122 stores a copy of the received sample in storage device 142, and analysis is initiated (or scheduled, if applicable). One example of storage 142 is an Apache Hadoop cluster (HDFS). The results of the analysis (and additional information about the application) are stored in database 146. If the application is determined to be malicious, the data appliance can be configured to automatically block file downloads based on the analysis results. Additionally, signatures for the malware can be generated and distributed (e.g., to data appliances such as data appliances 102, 136, and 148) to automatically block future file transfer requests to download files determined to be malicious.

[0044] In various embodiments, security platform 122 comprises one or more dedicated, off-the-shelf hardware servers (e.g., having multi-core processors, 32G+ RAM, gigabit network interface adapters, and hard drives) running a typical server-class operating system (e.g., Linux®). Security platform 122 may be implemented across a scalable infrastructure including multiple such servers, solid-state drives, and / or other applicable high-performance hardware. Security platform 122 may comprise several distributed components, including components provided by one or more third parties. For example, some or all of security platform 122 may be implemented using Amazon Elastic Compute Cloud (EC2) and / or Amazon Simple Storage Service (S3). Additionally, similar to data appliance 102, whenever security platform 122 is referred to as performing a task, such as storing data or processing data, it should be understood that a subcomponent or subcomponents of security platform 122 may cooperate (individually or in cooperation with third-party components) to perform that task. As one example, security platform 122 can optionally cooperate with one or more virtual machine (VM) servers, such as VM server 124, to perform static and dynamic analysis.

[0045] One example of a virtual machine server is a physical machine including commercially available server-class hardware (e.g., a multi-core processor, 32+ gigabytes of RAM, and one or more gigabit network interface adapters) running open-source and / or commercially available virtualization software, such as Linux Kernel-based Virtual Machine (KVM), VMware ESXi, Citrix XenServer, and / or Microsoft Hyper-V. In some embodiments, the virtual machine server is omitted. Furthermore, the virtual machine server may be under the control of the same entity that manages security platform 122, but may also be provided by a third party. As one example, the virtual machine server may rely on EC2, while the remainder of security platform 122 is provided by dedicated hardware owned and under the control of the operator of security platform 122. VM server 124 is configured to provide one or more virtual machines 126-128 for emulating client devices. The virtual machines may run various operating systems and / or versions thereof. Observed behavior resulting from running an application within a virtual machine is logged and analyzed (e.g., for indications that the application is malicious). In some embodiments, the log analysis is performed by a VM server (e.g., VM server 124). In other embodiments, the analysis is performed, at least in part, by other components of security platform 122, such as coordinator 144.

[0046] In various embodiments, security platform 122 makes the results of its analysis of samples available to data appliance 102 as part of a subscription via a list of signatures (and / or other identifiers). For example, security platform 122 can periodically (e.g., daily, hourly, or at some other interval and / or based on events configured by one or more policies) send a content package identifying malware apps. One exemplary content package includes a list of identified malware apps with information such as the package name, a hash value to uniquely identify the app, and the malware name (and / or malware family name) of each identified malware app. A subscription can cover analysis of only those files intercepted by and sent by data appliance 102 to security platform 122, and can also cover signatures of all malware known to security platform 122 (or a subset thereof, such as only mobile malware but not other forms of malware (e.g., PDF malware)). Platform 122 may also make available other types of information, such as machine learning models, that can help data appliance 102 detect malware (e.g., through techniques other than hash-based signature matching).

[0047] In various embodiments, security platform 122 is configured to provide security services to various entities in addition to (or, if applicable, instead of) the operator of data appliance 102. For example, other businesses with their own respective enterprise networks 114 and 116 and their own respective data appliances 136 and 148 may contract with the operator of security platform 122. Other types of entities may also utilize the services of security platform 122. For example, an Internet Service Provider (ISP) providing Internet service to client device 110 may contract with security platform 122 to analyze applications that client device 110 attempts to download. As another example, the owner of client device 110 may install endpoint protection software 134 on client device 110 that communicates with security platform 122 (e.g., to receive content packages from security platform 122, use the received content packages to check attachments in accordance with the techniques described herein, and then send applications to security platform 122 for analysis).

[0048] In various embodiments, security platform 122 is configured to cooperate with one or more third-party services. As one example, security platform 122 can provide malware scan results (and other information, if applicable) to a third-party scanner service (e.g., VirusTotal). Security platform 122 can similarly incorporate information obtained from the third-party scanner service (e.g., malicious verdicts from entities other than security platform 122) into its own information (e.g., information stored in database 146 or a suitable information repository).

[0049] IV. Analyzing the Sample Using Static and Dynamic Analysis

[0050] 3 illustrates one example of logical components that may be included in a system for analyzing samples. Analysis system 300 may be implemented using a single device. For example, the functionality of analysis system 300 may be implemented in malware analysis module 112 embedded in data appliance 102. Analysis system 300 may also be implemented collectively across multiple separate devices. For example, the functionality of analysis system 300 may be provided by security platform 122.

[0051] In various embodiments, analysis system 300 utilizes a list, database, or other collection of known good content and / or known bad content (collectively shown in FIG. 3 as collection 314). Collection 314 can be obtained in various ways, including via a subscription service (e.g., provided by a third party) and / or as a result of other processing (e.g., performed by data appliance 102 and / or security platform 122). Examples of information included in collection 314 include: URLs, domain names, and / or IP addresses of known malicious servers; URLs, domain names, and / or IP addresses of known good servers; URLs, domain names, and / or IP addresses of known command and control (C&C) domains; signatures, hashes, and / or other identifiers of known malicious applications; signatures, hashes, and / or other identifiers of known good applications; signatures, hashes, and / or other identifiers of known malicious files (e.g., Android exploit files); signatures, hashes, and / or other identifiers of known good libraries; and signatures, hashes, and / or other identifiers of known malicious libraries.

[0052] A. Ingestion

[0053] In various embodiments, when a new sample is received for analysis (e.g., there is no existing signature associated with the sample in the analysis system 300), it is added to the queue 302. As shown in Figure 3, an application 130 is received by the system 300 and added to the queue 302.

[0054] B.Static Analysis

[0055] The coordinator 304 monitors the queue 302, and as resources (e.g., static analysis workers) become available, the coordinator 304 fetches samples from the queue 302 for processing (e.g., fetches copies of malware 130). In particular, the coordinator first provides (305) samples to a static analysis engine 306 for static analysis. In some embodiments, one or more static analysis engines are included within the analysis system 300, where the analysis system 300 is a single device. In other embodiments, static analysis is performed by a separate static analysis server that includes multiple workers (i.e., multiple instances of the static analysis engine 306).

[0056] The static analysis engine (which may be implemented via a set of scripts written in a suitable scripting language) obtains general information about the sample and includes it (along with heuristic and other information, if applicable) in a static analysis report 308. The report may be generated by the static analysis engine or by the coordinator 304 (or by another suitable component), which may be configured to receive information from the static analysis engine 306. In some embodiments, the collected information is stored in the sample's database record (e.g., in database 316) instead of or in addition to a separate static analysis report 308 being generated (i.e., portions of the database record form the report 308). In some embodiments, the static analysis engine also generates a verdict about the application (e.g., "safe," "suspicious," or "malicious"). As one example, a verdict may be "malicious" if the application has at least one "malicious" static feature (e.g., the application contains a hard link to a known malicious domain). As another example, points may be assigned to each of the features (e.g., based on severity, if found, based on how reliable the feature is for predicting malicious intent, etc.), and a verdict may be assigned by the static analysis engine 306 (or coordinator 304, if applicable) based on the number of points associated with the static analysis result.

[0057] C.Dynamic Analysis

[0058] Once static analysis is complete, coordinator 304 locates an available dynamic analysis engine 310 to perform dynamic analysis on the application. Similar to static analysis engine 306, analysis system 300 can directly include one or more dynamic analysis engines. In other embodiments, dynamic analysis is performed by a separate dynamic analysis server that includes multiple workers (i.e., multiple instances of dynamic analysis engine 310).

[0059] Each dynamic analysis worker manages a virtual machine instance. In some embodiments, the results of the static analysis (e.g., performed by static analysis engine 306), whether in report format (308) and / or stored in database 316 or otherwise, are provided as input to dynamic analysis engine 310. For example, static report information may be used to help select / customize the virtual machine instance used by dynamic analysis engine 310 (e.g., Microsoft Windows 7 SP2 vs. Microsoft Windows 10 Enterprise, or iOS 11.0 vs. iOS 12.0). When multiple virtual machine instances run simultaneously, a single dynamic analysis engine can manage all of the instances, or, if applicable, multiple dynamic analysis engines may be used (e.g., each managing its own virtual machine instance). During the dynamic portion of the analysis, actions taken by the application (including network activity) are analyzed.

[0060] In various embodiments, static analysis of the sample, if applicable, is omitted or performed by a separate entity. As one example, traditional static and / or dynamic analysis may be performed on the file by a first entity. Once a given file is determined (e.g., by the first entity) to be suspicious or malicious, the file may be provided to a second entity (e.g., an operator of security platform 122) for additional analysis (e.g., by dynamic analysis engine 310), particularly regarding malware use in network activity.

[0061] The environment used by analysis system 300 is instrumented / hooked so that behaviors observed while the application is running are logged as they occur (e.g., using a customized kernel that supports hooking and logcat). Network traffic associated with the emulator is also captured (e.g., using pcap). The log / network data may be stored as temporary files in analysis system 300, or may be stored more permanently (e.g., using HDFS or another suitable storage technology, or a combination of technologies, such as MongoDB). The dynamic analysis engine (or another suitable component) can compare connections made by the sample to a list (314) of domains, IP addresses, etc., and determine whether the sample communicated (or attempted to communicate) with a malicious entity.

[0062] Like the static analysis engine, the dynamic analysis engine stores the results of its analysis in database 316 in a record associated with the application being tested (and / or includes the results in report 312, if applicable). In some embodiments, the dynamic analysis engine also forms a verdict (e.g., “safe,” “suspicious,” or “malicious”) about the application. As one example, a verdict may be “malicious” even if only one “malicious” action was taken by the application (e.g., an attempt was made to contact a known malicious domain or an attempt to exfiltrate sensitive information was observed). As another example, points may be assigned to the actions taken (e.g., based on severity, if found, how reliable the action is to predict malicious intent, etc.). A verdict may then be assigned by dynamic analysis engine 310 (or coordinator 304, if applicable) based on the number of points associated with the dynamic analysis results. In some embodiments, a final verdict associated with a sample is made (e.g., by coordinator 304) based on a combination of report 308 and report 312.

[0063] V. Automated Fuzzy Hash-Based Signature Collection

[0064] As mentioned above, malicious individuals are constantly searching for new ways to prevent security infrastructure from detecting the malicious nature of their malware. One frequently used approach is for malware authors to create versions (often with subtle differences) of a given piece of malware, so that while a first signature (e.g., stored in database 146 and usable by data appliance 102) may successfully flag the first piece of malware as malicious, the same signature does not match new variants of the malware, and the new malware variants remain undetected (e.g., by data appliance 102). One way to counter this technique is for security platform 122 to use a fuzzy hashing scheme. An example of a fuzzy hashing scheme is “ssdeep,” which can efficiently compute context-triggered piecewise hashes (CTPHs), also known as fuzzy hashes. Fuzzy hashes can be used to detect new instances of malware that are similar to, but not necessarily identical to, known malware. As malware authors continue to revise and release variants of their malware, fuzzy hashes can be very useful in identifying and mitigating the potential harm that such new malware may cause. Unfortunately, fuzzy hashes have drawbacks. In particular, they can result in both false positives (beneficial samples incorrectly flagged as malicious) and false negatives (malicious samples incorrectly classified as benign). In various embodiments, one task performed by security platform 122 is malware signature generation.And, as described in more detail below, in various embodiments, security platform 122 includes an automatic fuzzy hash signature generator 150 that can efficiently and automatically generate fuzzy hash-based signatures that minimize both false positives and false negatives.

[0065] 4A illustrates one embodiment of a process for performing command detection and malware control. In some embodiments, process 400 is implemented by system 300 of FIG. 3 and includes:

[0066] At 410, the system monitors network traffic sessions.

[0067] At 420, the system uses a deep learning model to perform automatic feature identification for real-time malicious command and control traffic detection based on request headers of monitored network traffic sessions.

[0068] In some embodiments, the system extracts request headers from a network traffic session. In some embodiments, the request headers are associated with HTTP requests. In some embodiments, the request headers are tokenized to generate character tokens and word tokens. Character tokens can be described as single character words. Character tokens and word tokens can be “symbols,” including letters and numbers, for example, as defined in an ASCII table. In some embodiments, tokenization includes tokenizing special characters to obtain words, such that the words end with a special character. In some embodiments, there is no requirement that any word end with a special character. In some embodiments, special characters are removed during the tokenization operation. Examples of special characters include “ / ”, “\”, “$”, “#”, “;”, etc. In some embodiments, the character tokens and word tokens are filtered or cleaned up (e.g., words and / or characters that appear twice in the request header are removed).

[0069] 4B shows one embodiment of a process for performing automatic feature identification. In some embodiments, process 4200 is an implementation of operation 420 of FIG. 4A and includes:

[0070] At 4210, the system extracts a request header from the network traffic session. In some embodiments, the system pads the request header to a fixed length (e.g., the fixed length is 500 characters, 600 characters, 700 characters, etc.). In some embodiments, the system uses a lexical index map to determine words from numbers.

[0071] At 4220, the system performs tokenization of the request header to generate character tokens and word tokens. In some embodiments, special characters in the request header are tokenized as word tokens.

[0072] At 4230, the system feeds the character tokens and word tokens into an embedding layer of a deep learning model to find a group of features. In some embodiments, the deep learning model corresponds to a neural network. In some embodiments, the embedding layer is multiplied by a filter matrix to obtain a one-dimensional convolutional neural network (1D CNN). In some embodiments, after obtaining the 1D CNN, the elements of the 1D CNN are reduced by max-pooling the elements. In some embodiments, the max-pooled elements are fed into a bidirectional long short-term memory (Bi-LSTM) with attention to obtain contextual relationships between features. After the contextual relationships are obtained, the features with the highest contextual relationship scores are determined to obtain a group of features. In some embodiments, the group of features is fed into a fully connected layer of a deep learning model, such as a neural network, and results are obtained from the deep learning model.

[0073] 4C shows one embodiment of a process for feeding character and word tokens to an embedding layer of a deep learning model to find groups of features. In some embodiments, process 42300 is an implementation of operation 4230 and includes:

[0074] At 42310, the system multiplies the embedding layer by a filter matrix to obtain a convolutional layer. In some embodiments, the embedding layer is multiplied by the filter matrix to obtain a first element of the convolutional layer, and then the filter matrix is ​​shifted down one row to a different set of elements of the embedding layer to obtain a second element of the convolutional layer, and so on, until all of the elements of the convolutional layer are obtained. In some embodiments, the filter matrix is ​​a k×Y matrix, where k is an integer less than the number of rows of the embedding layer (e.g., 2, 3, 4, 5, etc.), and Y is the number of columns of the filter matrix (e.g., 300, 400, etc.). In some embodiments, each element of the filter matrix is ​​a randomly generated number.

[0075] At 42320, the system max-pools multiple elements of a convolutional layer to obtain a group of features. In some embodiments, the system obtains the maximum value from the pool of elements. In some embodiments, the pool corresponds to a fixed number of elements of the convolutional layer (e.g., 3, 5, 10, 15, etc.). In some embodiments, the system obtains the minimum value from the pool of elements. In some embodiments, the system obtains the average value or mean from the pool of elements. In some embodiments, max-pooling, min-pooling, or mean-pooling is used to reduce the feature set.

[0076] In some embodiments, after the feature set is identified, a cost function is determined.

[0077] Figure 5 shows an example request header. In some embodiments, the request header is padded with characters so that the request header is a fixed length (e.g., 500 characters, 600 characters, etc.). In some embodiments, commonly used characters are placed in the request header. In some embodiments, special characters in the request header are used for tokenization. In some embodiments, numbers and words that appear more than once are cleaned up so that duplicate numbers and words appear only once after tokenization. For example, the words in the first line of the example request header include GET, sobaka, gif, 12db3cf, 98861835, and HTTP.

[0078] In some embodiments, the tokens in the request header are converted to an integer encoding and fed to the embedding layer when used to perform command detection and malware control within the firewall.

[0079] FIG. 6 shows one example of an embedding layer. In this example, words extracted from multiple request headers are listed in columns. In one example, the number of words in a column is 200, 500, 600, 700, etc. In some embodiments, the number of items in a column corresponds to all of the different words extracted from the various request headers. Also, in this example, the number of elements in a row of the embedding layer is 300. In this example, the embedding layer is a 600 x 300 matrix. In some embodiments, the embedding layer is initialized so that each element in the embedding layer is a random number.

[0080] Figure 7 shows an example of one-dimensional convolution. In some embodiments, the filter matrix is ​​composed of random elements, with k elements in the columns, where k is an integer at least 1, and N elements in the rows, where N is, for example, 300. For example, k may be 2, 4, 5, 10, 11, etc. In some embodiments, the number of elements in the rows of the filter matrix is ​​the same as the number of elements in the rows of the embedding layer. In this example, the filter column size is set to 5. In some embodiments, the number of elements in the rows is 100, 200, etc.

[0081] The embedding layer is multiplied by a filter matrix to output the first element of a one-dimensional (1D) convolution (e.g., elements of the embedding layer are multiplied by corresponding elements of the filter matrix, and the products of the various multiplied elements are summed to obtain an element of the 1D convolution). Furthermore, the filter matrix is ​​shifted one column to the right, and the second element of the 1D convolution is calculated. The shifting and calculation can be repeated until the entire 1D convolution is obtained. Note that the second element can be obtained before, after, or simultaneously with the first element. In other words, the order in which the first and second elements (or any of the elements of the 1D convolution) are obtained is not important. In some embodiments, the ID convolution is max-pooled to reduce the number of elements output. In this example, the six elements of the 1D convolution are max-pooled to obtain the maximum value of the group of six elements. In one embodiment, two groups of three elements can each be used for max pooling, so that the result is the two elements that are the maximum values ​​of their respective groups. In this example, the max pooling output is 0.8, which corresponds to the sobaka element.

[0082] FIG. 8 shows one embodiment of a model architecture involving convolution.

[0083] In this example, the model architecture includes multiple request headers. After being tokenized, the multiple request headers can form a set of embedding layers, which are multiplied by filter matrices with various widths to obtain a set of 1D convolutions. In some embodiments, the set of 1D convolutions is max-pooled to obtain a reduced set of elements.

[0084] FIG. 9 illustrates an example of bidirectional long-short-term memory with attention. As an example, a reduced set of elements is input into a bidirectional long-short-term memory (LSTM) to identify two elements that are related to each other. In some embodiments, the LSTM has feedback connections, so that as each element passes through the LSTM cell, the LSTM cell calculates a score based on the elements it has seen previously (front to back). In a Bi-LSTM, these scores (first scores) can also be calculated based on elements the LSTM cell will see later (back to front), and the first scores can be stored in the cell state (the LSTM cell's memory). The LSTM cell can also calculate only the scores of the intermediate elements and store the scores of the intermediate elements (second scores) in a hidden state. To obtain a relationship score, both of these scores (first and second scores) are multiplied. After the reduced set of elements is input into the bidirectional LSTM, the bidirectional LSTM outputs a set of related elements, where pairs of elements have a contextual relationship based on the relationship score. In some embodiments, pairs of correlated elements are used as inputs to a deep learning network.

[0085] FIG. 10 shows one example of a fully connected layer in a deep learning network.

[0086] In this example, the set of related elements (x1, x2, …, x m) is input to a fully connected layer of a deep learning network, and values ​​of y and 1-y are output from the fully connected layer. In one example, the deep learning network is a neural network. In some embodiments, y represents the likelihood that the sample is malicious, and (1-y) represents the likelihood that the sample is benign. For example, y is 0.99 and 1-y is 0.01. In some embodiments, the fully connected layer learns how to classify a set of related elements. In this example, y closer to 1 means the sample is more likely to be malicious, and y closer to 0 means the sample is more likely to be benign. In this example, using a threshold of 0.99, the fully connected network indicates that the sample is malicious, and the truth found in the request header confirms that the sample is malicious.

[0087] FIG. 11 shows one example of a cost function.

[0088] In some embodiments, the cost function corresponds to cross-entropy, which is trained through a stochastic gradient descent and backpropagation algorithm. n corresponds to the probability output from the deep learning network, and t n represents the sample truth. In some embodiments, t nis a label in the request header, and the label can be malicious (1) or benign (0). The embedding layer and filter matrix can then be trained using a cost function. For example, the result of the cost function is multiplied by each element of the embedding layer to obtain a new embedding layer, and the result of the cost function is multiplied by each element of the filter matrix to obtain a new filter matrix. The entire process is then repeated using the new embedding layer and new filter matrix. In some embodiments, during training of the embedding layer and filter matrix, the embedding layer and filter matrix are updated multiple times to obtain improved model accuracy and reduced model loss.

[0089] After the model (including the embedding layer, CNN layer, bidirectional LSTM layer, and fully connected layer) is trained, the model may be deployed to the cloud or the firewall itself, so that the cloud or firewall can use the model to perform malicious command and control traffic detection in real time.

[0090] FIG. 12 shows one example of results from model training. The accuracy of the model is evaluated using a real-world test data set or using the training data set. For the training data set, the accuracy of the model steadily increases after each epoch or iteration until the accuracy reaches approximately 0.995. Conversely, for the training data set, the model loss steadily decreases after each epoch or iteration until the loss reaches approximately 0.005. For the real-world test data set, the accuracy of the model steadily increases after each epoch or iteration until an accuracy plateau of approximately 0.98. Conversely, for the training data set, the model loss steadily decreases after each epoch or iteration until a loss plateau of approximately 0.02.

[0091] Although the foregoing embodiments have been described in some detail for purposes of clarity of understanding, the invention is not limited to the details provided. There are many alternative ways of implementing the invention. The disclosed embodiments are illustrative and not restrictive.

Claims

1. 1. A system including a processor and a memory, The processor: Monitor network traffic sessions, and using a deep learning model to perform automatic feature identification for real-time malicious command and control traffic detection based on request headers of the monitored network traffic sessions; It is structured as follows: performing automatic feature identification for real-time malicious command and control traffic detection; extracting the request header from the network traffic session; performing tokenization of the request header to generate character tokens and word tokens; and feeding the character tokens and the word tokens into an embedding layer of the deep learning model to find groups of features; and said providing comprises: multiplying the embedding layer with a filter matrix to obtain a convolutional layer; multiplying the embedding layer with the filter matrix at a first position to obtain a first element of the convolutional layer; Shifting the filter matrix down one row along the embedded layer to obtain a second position of the filter matrix; and multiplying the embedding layer with the filter matrix at the second location to obtain a second element of the convolutional layer; and max-pooling elements of the convolutional layer to obtain the group of features; The memory includes: a processor coupled to said processor and providing instructions to said processor; It is configured as follows: system.

2. performing automatic feature identification for real-time malicious command and control traffic detection; extracting the request header from the network traffic session; performing tokenization of the request header to generate character tokens and word tokens; and feeding the character tokens and the word tokens into an embedding layer of the deep learning model to find groups of features; The system of claim 1 , comprising:

3. performing automatic feature identification for real-time malicious command and control traffic detection; finding contextual relationships between features in the group of features using a Bidirectional Long Short-Term Memory (Bi-LSTM) after the max-pooling of the plurality of elements is performed; The system of claim 1 , comprising:

4. The processor further comprises: predicting a label for a HyperText Transfer Protocol (HTTP) session based on a probability score using a fully connected layer of the deep learning model; The system of claim 1 , configured to:

5. The processor further comprises: predicting a label for a HyperText Transfer Protocol (HTTP) session based on a probability score using a fully connected layer of the deep learning model; It is structured as follows: The deep learning model corresponds to a neural network. The system of claim 1 .

6. monitoring network traffic sessions; using a deep learning model to perform automatic feature identification for real-time malicious command and control traffic detection based on request headers of the monitored network traffic sessions; predicting a label for a HyperText Transfer Protocol (HTTP) session based on the probability score using a fully connected layer of the deep learning model; A method comprising:

7. performing automatic feature identification for real-time malicious command and control traffic detection; extracting the request header from the network traffic session; performing tokenization of the request header to generate character tokens and word tokens; and feeding the character tokens and the word tokens into an embedding layer of the deep learning model to find groups of features; The method of claim 6, comprising:

8. The deep learning model corresponds to a neural network. The method of claim 6.

9. A computer program stored on a non-transitory computer-readable medium, the computer program comprising computer instructions; When executed, the instructions cause the computer to: monitoring network traffic sessions; using a deep learning model to perform automatic feature identification for real-time malicious command and control traffic detection based on request headers of the monitored network traffic sessions; predicting a label for a HyperText Transfer Protocol (HTTP) session based on the probability score using a fully connected layer of the deep learning model; A computer program that performs the above.

10. performing automatic feature identification for real-time malicious command and control traffic detection; extracting the request header from the network traffic session; performing tokenization of the request header to generate character tokens and word tokens; and feeding the character tokens and the word tokens into an embedding layer of the deep learning model to find groups of features; 10. The computer program of claim 9, comprising:

11. The deep learning model corresponds to a neural network.

10. A computer program according to claim 9.

Images