Embodiments of the disclosure relate to the field of cyber security. More specifically, embodiments of the disclosure relate to a malware detection technique for performing an analysis of a group of objects, an object or a sub-object to determine whether further analysis should be performed on the group of objects, the object or the sub-object.
Current network security appliances receive large amounts of data to analyze, possibly prior to passing to one or more endpoint devices. The large amounts of data make timely analysis difficult as analyzing the entire amount of received data is time-consuming and processing-intensive. Therefore, current network security appliances attempt to employ a filtering process that acts to determine whether portions of the received data exhibit some characteristics of suspiciousness prior to performing an in-depth analysis on the one or more portions of the received data.
However, current filtering techniques are reactive and attempt to match extracted features or other indicators of known malware with a portion of the received data in order to determine whether the portion of received data is suspicious. Specifically, malware detection systems within network security appliances often parse received data attempting to identify and then match a feature of the received data with an indicator of known malware to assess suspiciousness or even maliciousness. This technique often leads to false positives as benign (e.g., non-malicious) data may share an indicator with malware. As a result, in-depth malware analysis may be performed on the benign data, wasting time and requiring unnecessary processing. Of course, where the indicator is a fingerprint or signature in the form of a hash of known malware, the chance of a match with benign data is greatly reduced, but such a fingerprint or signature is often not available (e.g., as is the case with ‘zero day’ malware).
Many different malware detection approaches can suffer the effects of false positives. Known Intrusion Protection Systems (IPS) and Intrusion Detection Systems (IDS) are noteworthy for producing an enormous rate of false positives. Known “two-stage” advanced malware detection systems deployed at the periphery of a network employ a first static analysis stage used to filter incoming data before submitting that portion deemed suspicious for second-stage dynamic analysis via execution in a virtual environment. In such systems, the static analysis is configured to avoid false negatives and, as a trade-off, can unfortunately tag benign data as suspicious and then submit those false positives for dynamic analysis.
Additionally, received data may contain one or more features that seem benign in an isolated manner but, combined with other seemingly suspicious, malicious or benign features, are actually part of a malicious cyber-attack.
Embodiments of the invention are illustrated by way of example and not by way of limitation in the figures of the accompanying drawings, in which like references indicate similar elements and in which:
Referring to
Various embodiments of the disclosure relate to a real-time traffic analysis that determines whether a portion of received data should be provided to a static analysis logic and/or a dynamic analysis logic for an in-depth analysis. Such a real-time traffic analysis improves detection of exploits, malware attacks and/or anomalous characteristics/behaviors as the initial analysis performed by a real-time traffic analysis logic determines whether at least a portion of the received data has at least a first level of suspiciousness and/or maliciousness to warrant an in-depth analysis by either a static analysis logic and/or a dynamic analysis logic.
Real-time traffic analysis seeks to utilize extracted features of malware (which may themselves provide an indication that the portion of received data is suspicious and/or malicious), and/or seemingly benign features (which in isolation may not provide an indication that the portion of received data is suspicious and/or malicious) to create a more tailored, or directed, analysis. Real-time traffic analysis utilizes one or more “virtual features,” which may be each a combination of one or more features, typically expressed as a logical expression. Additionally, a condition may be applied to each feature within the virtual feature. A condition applied to a feature seeks to limit the values evaluated during real-time traffic analysis to those that, through experiential knowledge and/or machine learning, are known to be suspicious and/or malicious (the application of a condition to a feature may be referred to as a feature-condition pairing). Thus, the combination of feature-condition pairings within a logical expression (e.g., feature-condition pairings separated by logical operators comprising a virtual feature) leads to a more tailored analysis. The use of one or more virtual features to determine whether a portion of received data exhibits at least a first threshold of suspiciousness, maliciousness and/or anomalous characteristics and/or behaviors prior to performing an in-depth static and/or dynamic analysis, leads to fewer false positives. Thus, real-time traffic analysis enables a malware/threat detection system (e.g., deployed within a network appliance) to determine whether a portion of data exhibits at least a first threshold of suspiciousness, maliciousness and/or anomalous characteristics and/or behaviors more efficiently and accurately than pre-filter mechanisms that merely employ feature and/or signature matching techniques.
In one embodiment, the threat detection system receives an object to analyze. Subsequently, the object is passed to a real-time traffic analysis (RTTA) logic within the threat detection system. The RTTA logic parses the object looking for features of a predefined feature set. During parsing, the RTTA logic maintains a representation of the detected features of the predefined feature set as “observations,” and the value of each instance of the observation, if applicable. In one embodiment, the representation of values of detected features maintained by the RTTA logic may be a value for every instance of a detected feature (e.g., a size value for every embedded object) or a count of the number of instances of a feature (e.g., the number of JavaScript instances, embedded objects, Universal Record Locators (URLs) or other features that may appear multiple times within an object or portion of network traffic). In a second embodiment, the representation of detected features maintained by the RTTA logic may be a subset of the values of every instance of a detected feature. In such an embodiment, the RTTA logic may maintain the representation of detected features by eliding certain, similar values (e.g., omit duplicate values and/or merge similar values into ranges) of a detected feature. Upon completion of parsing, the representation of the values of detected features may be recorded in a storage device for accessing during an evaluation performed by the RTTA logic.
Once the object has been parsed and any values of observations have been recorded, the RTTA logic evaluates each feature-condition pairing set forth in the virtual feature against the value, or set of all values of the corresponding observation. As is defined below, the virtual feature is a combination of one or more feature-condition pairings, wherein the combination may be represented as a logical expression. Thus, in instances in which an observation has a value, the set of all values of an observation is paired with one or more conditions. In some embodiments, depending on the content of the received data, an observation may have a plurality of values (e.g., when observationX, for example, is the size of an attachment to an email, observationX will have a plurality of values when, for example, an email under analysis includes a plurality of attachments, wherein at least a first attachment has a different size than a second attachment).
Following the evaluation of each feature-condition pairing against the value, or set of all values of the corresponding observation, the RTTA logic generates an observation vector based on the feature-condition pairing evaluation and determines whether the observation vector is a member of the truth set corresponding to the virtual feature. A notification that the virtual feature was observed is provided to a RTTA score determination logic within the threat detection system. The threat detection system then generates a score indicating the level of suspiciousness and/or maliciousness of the portion of analyzed received data. In one embodiment, when the score is above a first threshold, the reporting logic may generate an alert that the object is malicious. When the score is greater than a second threshold but lower than the first threshold, the object may be provided to the static analysis logic and/or the dynamic analysis logic for further analysis. When the score is less than the second threshold, the threat detection system may determine no further analysis is needed (e.g., the object is benign).
The use of one or more virtual features by a threat detection system enables several advantages over current systems by providing a more efficient and flexible analysis. Specifically, the analysis performed by the RTTA using one or more virtual features enables the RTTA to combine observable features with conditions derived via experiential knowledge and/or machine learning to target particular exploits, vulnerabilities or malware. Additionally, an analysis including evaluating feature-condition pairings of a virtual feature using at least one or more values of a representative set of observed values within an object provides increased efficiency by eliminating the need to analyze all observed values using a rule-based detection scheme.
In the following description, certain terminology is used to describe features of the invention. For example, in certain situations, both terms “logic” and “engine” are representative of hardware, firmware and/or software that is configured to perform one or more functions. As hardware, logic (or engine) may include circuitry having data processing or storage functionality. Examples of such circuitry may include, but are not limited or restricted to a microprocessor, one or more processor cores, a programmable gate array, a microcontroller, a controller, an application specific integrated circuit, wireless receiver, transmitter and/or transceiver circuitry, semiconductor memory, or combinatorial logic.
Logic (or engine) may be software in the form of one or more software modules, such as executable code in the form of an executable application, an application programming interface (API), a subroutine, a function, a procedure, an applet, a servlet, a routine, source code, object code, a shared library/dynamic link library, or one or more instructions. These software modules may be stored in any type of a suitable non-transitory (computer-readable) storage medium, or transitory storage medium (e.g., electrical, optical, acoustical or other form of propagated signals such as carrier waves, infrared signals, or digital signals). Examples of non-transitory storage medium may include, but are not limited or restricted to a programmable circuit; a semiconductor memory; non-persistent storage such as volatile memory (e.g., any type of random access memory “RAM”); persistent storage such as non-volatile memory (e.g., read-only memory “ROM”, power-backed RAM, flash memory, phase-change memory, etc.), a solid-state drive, hard disk drive, an optical disc drive, or a portable memory device. As firmware, the executable code is stored in persistent storage.
According to one embodiment, the term “malware” may be construed broadly as any code or activity that initiates a malicious attack and/or operations associated with anomalous or unwanted behavior. For instance, malware may correspond to a type of malicious computer code that executes an exploit to take advantage of a vulnerability, for example, to harm or co-opt operation of a network device or misappropriate, modify or delete data. Malware may also correspond to an exploit, namely information (e.g., executable code, data, command(s), etc.) that attempts to take advantage of a vulnerability in software and/or an action by a person gaining unauthorized access to one or more areas of a network device to cause the network device to experience undesirable or anomalous behaviors. The undesirable or anomalous behaviors may include a communication-based anomaly or an execution-based anomaly, which, for example, could (1) alter the functionality of an network device executing application software in an atypical manner (a file is opened by a first process where the file is configured to be opened by a second process and not the first process); (2) alter the functionality of the network device executing that application software without any malicious intent; and/or (3) provide unwanted functionality which may be generally acceptable in another context. Additionally, malware may be code that initiates unwanted behavior which may be, as one example, uploading a contact list to cloud storage without receiving permission from the user. For convenience, the terms “malware” and “exploit” shall be used interchangeably herein unless the context requires otherwise.
The term “processing” may include launching an application wherein launching should be interpreted as placing the application in an open state and performing simulations of actions typical of human interactions with the application. For example, the application, an Internet browsing application may be processed such that the application is opened and actions such as visiting a website, scrolling the website page, and activating a link from the website are performed (e.g., the performance of simulated human interactions).
The term “network device” may be construed as any electronic device with the capability of connecting to a network, downloading and installing mobile applications. Such a network may be a public network such as the Internet or a private network such as a wireless data telecommunication network, wide area network, a type of local area network (LAN), or a combination of networks. Examples of a network device may include, but are not limited or restricted to, a laptop, a mobile phone, a tablet, etc. Herein, the terms “network device,” “endpoint device,” and “mobile device” will be used interchangeably. The terms “mobile application” and “application” should be interpreted as software developed to run specifically on a mobile network device.
The term “malicious” may represent a probability (or level of confidence) that the object is associated with a malicious attack or known vulnerability. For instance, the probability may be based, at least in part, on (i) pattern matches; (ii) analyzed deviations in messaging practices set forth in applicable communication protocols (e.g., HTTP, TCP, etc.) and/or proprietary document specifications (e.g., Adobe PDF document specification); (iii) analyzed compliance with certain message formats established for the protocol (e.g., out-of-order commands); (iv) analyzed header or payload parameters to determine compliance, (v) attempts to communicate with external servers during processing in one or more VMs, (vi) attempts to access memory allocated to the application during virtual processing, and/or other factors that may evidence unwanted or malicious activity.
The term “virtual feature” may be interpreted as a combination of one or more feature-condition pairings, where the combination may be suspicious, malicious or unwanted. Additionally, a first virtual feature may be used as a feature within a second virtual feature. In one embodiment, the combination may be expressed as a logical expression having one or more “terms,” wherein a term may include one or more feature-condition pairings.
The term “feature” may be interpreted as a static trait that may be included in or exhibited by an object, group of objects or sub-object. Examples of features include, but are not limited or restricted to, a size of an object or sub-object, presence of an embedded object, size of an embedded object, number of embedded objects, presence of a URL in the object, number of URLs in the object, presence of a predefined signature, adherence or non-adherence to a predefined rule or protocol.
The term “observation” may be interpreted as features actually observed/detected within object, sub-object, etc. (for example, during or after parsing once the incoming traffic has been received).
The term “condition” may be interpreted as whether a predefined characteristic is present within the portion of network traffic being analyzed (e.g., a flow, a group of objects, an object, and/or a sub-object). Additionally, a condition may be a numeric evaluation such that a determination is made as to whether the set of all observed values of the feature include a particular number, intersect a given range, and/or contain any members greater than or less than a predefined threshold.
The term “observation vector” may be interpreted as a representation of the results of an evaluation of each condition with its corresponding feature, as evaluated for each feature-condition pairing of a single, virtual feature. In one embodiment, such a representation may take the form of a binary construct which may be understood as a vector or a one dimensional array. Herein, the term “observation vector” will be used but the use is not intended to limit the scope of the disclosure. In one example, a condition may be the presence of a feature. In a second example, a condition may be the size of the feature is greater than or equal to a predefined threshold. A condition may be applied to more than one feature (e.g., determining the presence of more than one feature) and/or a feature may be evaluated by more than one feature-condition pairing (e.g., a first term, as described below, of the virtual feature may determine whether a feature is greater than a first threshold and a second term of the virtual feature may determine whether the feature is less than or equal to a second threshold).
The term “truth set” may be interpreted as a representation of the one or more possible results of the evaluation of the feature-condition pairings of a virtual feature based on the values of the observations (e.g., detected features) that satisfy the terms of the corresponding virtual feature, where there is one truth set per virtual feature. The representation of the truth set may take the form of, for example, a set of binary vectors, wherein each binary vector represents a result of an evaluation of the feature-condition pairings of the virtual feature. All vectors included in the truth set represent solutions to the corresponding virtual feature.
Lastly, the terms “or” and “and/or” as used herein are to be interpreted as inclusive or meaning any one or any combination. Therefore, “A, B or C” or “A, B and/or C” mean “any of the following: A; B; C; A and B; A and C; B and C; A, B and C.” An exception to this definition will occur only when a combination of elements, functions, steps or acts are in some way inherently mutually exclusive.
The invention may be utilized by a cyber-security platform for performing a real-time traffic analysis of a group of objects, an object and/or a sub-object to determine whether the group of objects, the object and/or the sub-object is to be provided to a static analysis logic and/or a dynamic analysis logic for further analysis as to whether the group of objects, the object and/or the sub-object is suspicious, malicious or unwanted. As this invention is susceptible to embodiments of many different forms, it is intended that the present disclosure is to be considered as an example of the principles of the invention and not intended to limit the invention to the specific embodiments shown and described.
Referring to
In one embodiment, the network switch 162 may capture network traffic, make a copy of the network traffic, pass the network traffic to the appropriate endpoint device(s) 163 and pass the copy of the network traffic to the threat detection system 110. In a second embodiment, the network switch 162 may capture the network traffic and pass the network traffic to the threat detection system 110 for processing prior to passing the network traffic to the appropriate endpoint device(s) 163. In such an embodiment, the network traffic will only be passed to the appropriate endpoint device(s) 163 if the analysis of the network traffic does not indicate that the network traffic is associated with malicious, anomalous and/or unwanted characteristics and/or behaviors.
The threat detection system 110 includes a communication interface 111, a storage device 112, a real-time traffic analysis (RTTA) logic 113, a RTTA score determination logic 114, a static analysis logic 120, a dynamic analysis logic 130, a classification logic 140, and a reporting logic 150.
As shown, the threat detection system 110 is communicatively coupled with the cloud computing services 170, the Internet and one or more endpoint devices 163 via the communication interface 111, which directs at least a portion of the network traffic to the RTTA logic 113. The RTTA logic 113 includes one or more modules that, when executed by one or more processors, performs a real-time traffic analysis on the portion of the network traffic by analyzing the portion of the network traffic in light of one or more features and/or virtual features. When the real-time traffic analysis results in a score that is greater than a first threshold, the portion of the network traffic is provided to the static analysis logic 120 and/or the dynamic analysis 130. The static analysis logic 120 may include one or more software modules that, when executed by one or more processors, performs static scanning on a particular object, namely heuristics, exploit signature checks and/or vulnerability signature checks for example. The static analysis logic 120 and the dynamic analysis logic 130 may be one or more software modules executed by the same processor or different processors, where these different processors may be located within the same processor package (e.g., different processor cores) and/or located at remote or even geographically remote locations that are communicatively coupled (e.g., by a dedicated communication link) or a network.
More specifically, as shown, static analysis logic 120 may be configured with heuristics logic 121, exploit matching logic 122, and/or vulnerability matching logic 123. Heuristics logic 121 is adapted for analysis of certain portions of an object under analysis (e.g., the object may include a binary file) to determine whether any portion corresponds to either (i) a “suspicious” identifier such as either a particular Uniform Resource Locator “URL” that has previously been determined as being associated with known exploits, a particular source or destination (IP or MAC) address that has previously been determined as being associated with known exploits; or (ii) a particular exploit pattern. When deployed, the exploit matching logic 122 may be adapted to perform exploit signature checks, which may involve a comparison of an object under analysis against one or more pre-stored exploit signatures (e.g., pre-configured and predetermined attack patterns) from signatures database 124. Additionally or in the alternative, the static analysis logic 120 may be configured with vulnerability matching logic 123 that is adapted to perform vulnerability signature checks, namely a process of uncovering deviations in messaging practices set forth in applicable communication protocols (e.g., HTTP, TCP, etc.). The term “signature” designates an indicator of a set of characteristics and/or behaviors exhibited by one or more exploits that may not be unique to those exploit(s). Thus, a match of the signature may indicate to some level of probability, often well less than 100%, that an object constitutes an exploit. In some contexts, those of skill in the art have used the term “signature” as a unique identifier or “fingerprint,” for example, of a specific virus or virus family (or other exploit), which is generated for instance as a hash of its machine code, and that is a special sub-case for purposes of this disclosure.
The classification logic 140 may be configured to receive the static-based results (e.g., results from static analysis, metadata associated with the incoming network traffic, etc.), the VM-based results and/or the RTTA analysis results. According to one embodiment of the disclosure, the classification logic 140 comprises prioritization logic 141 and score determination logic 142. The prioritization logic 141 may be configured to apply weighting to results provided from the RTTA logic 113, the dynamic analysis logic 130 and/or the static analysis logic 120. Thereafter, the classification logic 140 may route the classification results comprising the weighting and/or prioritization applied to the RTTA results, the static-based results and/or the VM-based results to the reporting logic 150. The classification results may, among others, classify any malware and/or exploits detected into a family of malware and/or exploits, describe the malware and/or exploits and provide the metadata associated with any object(s) within which the malware and/or exploits were detected. Specifically, real-time traffic analysis using one or more virtual features may provide a tailored analysis such that each virtual feature may be directed to detecting characteristics typically representative of a particular exploit and/or type of attack (e.g., a ROP attack). Thus, use of the RTTA results may improve classification of a portion of network traffic (e.g., an object). The reporting logic 150 may generate an alert for one or more endpoint devices 163 and/or route the alert to a network administrator for further analysis. In addition, the reporting logic 150 may store the classification results (including the RTTA results, the static-based results and the VM-based results) in the storage device 112 for future reference. In one embodiment, results of the static analysis and/or the dynamic analysis may be provided to the RTTA logic 113 and/or the RTTA score determination logic 114. The RTTA logic 113 may evaluate one or more virtual features using the static analysis and/or the dynamic analysis results. The RTTA score determination logic 114 may utilize the results of the RTTA logic 113, the static analysis results and/or the dynamic analysis results to determine a score indicating a level of suspiciousness and/or maliciousness of the object. Additionally, the results of the evaluation performed by the RTTA logic 113 and/or the score determined by the RTTA score determination logic 114 may be provided to the classification logic 140 for use in classifying malware detected within the object.
When the static analysis logic 120 is provided at least a portion of the network traffic following a real-time traffic analysis by the RTTA logic 113, the static analysis logic 120 may perform a static analysis on the portion of network traffic. Subsequently, the static analysis logic 120 may route suspicious objects (and, in many cases, even previously classified malicious objects) to the dynamic analysis logic 130. In one embodiment, the dynamic analysis logic 130 is configured to provide, at least, an analysis of a binary included in the received network traffic and/or suspicious object(s) from the static analysis logic 120.
Upon receiving at least an object from the communication interface 111 and/or the static analysis logic 120, the dynamic analysis logic 130 performs processing within one or more VMs on the binary, e.g., the object is processed within the one or more VMs 1311-131j (where j≥1). The processing may occur within one or more virtual machine instances (VMs), which may be provisioned with a guest image associated with a prescribed software profile. Each guest image may include a software application and/or an operating system (OS). Each guest image may further include one or more monitors, namely software components that are configured to observe and capture run-time behavior of an object under analysis during processing within the virtual machine. During the processing within the virtual machine, the object is analyzed.
1. Logical Representation
The processor(s) 200 is further coupled to persistent storage 210 via a second transmission medium 203. According to one embodiment of the disclosure, persistent storage 210 may include (a) the static analysis logic 120 including a heuristics logic 121, an exploit matching logic 122, a vulnerability matching logic 123, and a signatures database 124, (b) a dynamic analysis logic 130 including one or more VMs 1311-131j, a virtual machine manager (VMM) 132, and a score determination logic 133, (c) a classification logic 140 including a prioritization logic 141, and a score determination logic 142, (d) a real-time traffic analysis (RTTA) logic 113, (e) a RTTA score determination logic 114, and (f) a reporting logic 150. Of course, when implemented as hardware, one or more of these logic units could be implemented separately from each other.
Additionally, although not shown, the RTTA logic 113 and/or the RTTA score determination logic 114 may be incorporated within any of the modules illustrated in
Referring to
At block 303, during parsing, the RTTA logic maintains a representation of detected features of the predefined feature set as “observations.” For example, as illustrated in
Once the object has been parsed and any values of observations have been recorded, the RTTA logic evaluates each feature-condition pairing set forth in the virtual feature against the set of all the value(s) of the corresponding observation (block 304). As is defined above, the virtual feature is a combination of one or more feature-condition pairings, wherein the combination may be represented as a logical expression. Thus, each value of an observation is paired with one or more conditions. In some embodiments, depending on the content of the network traffic, an observation may have a plurality of values (e.g., when observationX, for example, is the size of an attachment to an email, observationX will have a plurality of values when the email under analysis includes a plurality of attachments, wherein at least a first attachment has a different size than a second attachment).
Following the evaluation of each feature-condition pairing for each value of the corresponding observation, the RTTA logic generates an observation vector based on the feature-condition pairing evaluation (block 305). The RTTA logic subsequently determines whether the observation vector is a member of the truth set corresponding to the virtual feature (block 306). In one embodiment, the determination of whether the observation vector is a member of the truth set may be done by using the observation vector as an index into a truth table representing the truth set (e.g., whether the observation vector corresponds to a value within the truth table). When the observation vector is a member of the truth set, mark the virtual feature as “observed” (block 307).
When the virtual feature is marked as observed (e.g., the observation vector is a member of the truth set corresponding to the virtual feature), a notification that the virtual feature was observed is provided to the RTTA score determination logic. When the score generated by the RTTA score determination logic, based on, inter alia, the observed virtual feature is greater than a predefined threshold, the object is provided to the static analysis logic and/or the dynamic analysis logic for further analysis (block 308).
Referring to
Optionally, the results of the real-time traffic analysis may be provided to a classification logic to aid in classification of the object by potentially providing results of an analysis using the virtual feature that may be directed at detecting a specific exploit or type of attack.
Referring to
The feature set 410 represents the features that the real-time traffic analysis logic will attempt to detect while parsing the object. Herein, the feature set 410 includes the two features as illustrated boxes 411 and 413. The feature of box 411 (FeatureA) is an embedded object, as illustrated in box 412. As will be shown below in
Referring to
Additionally, as is shown in box 421, a condition may be whether a feature (herein, FeatureA) has been observed. The example feature-condition pairing corresponding to FeatureA represents that the real-time traffic analysis logic will evaluate whether the presence of FeatureA (an embedded object) has been observed. In contrast to the numeric FeatureN, the number of embedded objects is not important, the feature-condition pairing is directed toward the presence of the feature, and thus, the number of instances of an embedded object greater than one does not change the outcome of the condition evaluation.
Referring to
Specifically, the left most column corresponds to the feature-condition pairing set forth in box 421 of
In one embodiment, the virtual feature 400, the feature set illustrated in table 410, the feature-condition pairings illustrated in table 420 and the truth set illustrated in table 430 are generated prior to analysis of the object. Therefore, in one embodiment, a network appliance has been preconfigured with the virtual feature 400, the feature set illustrated in table 410, the feature-condition pairings illustrated in table 420 and the truth set illustrated in table 430 prior to receipt of an object to analyze.
The receipt of an object for analysis by a threat detection system and the analysis of the object by, at least, the real-time traffic analysis logic within the threat detection system will be discussed below in conjunction with a discussion of
2. Parse Objects Looking for Features
Upon receiving network traffic (or alternatively, one or more objects, flows, group of objects, etc., may be received by the threat detection system in other manners such as via transfer from a storage device or the like), the communication interface provides at least a portion of the network traffic to the real-time traffic analysis (RTTA) logic. For convenience, the discussion herein will be directed to the analysis of an object, but the scope of the claims is not so limited.
The RTTA logic may parse the object on a per-object or per-sub-object feature basis. This enables the threat detection system to perform real-time traffic analysis at different granularities. A higher granularity may provide more detail and/or information to the static analysis logic and/or the dynamic analysis logic, when the object is passed on. However, performing RTTA at a high level of granularity (e.g., on a sub-object basis) may sometimes result in more processing for RTTA logic. A lower granularity may result in less processing for RTTA logic.
While parsing the object, the RTTA logic attempts to detect the features comprising the feature set (here, FeatureA and FeatureN). When the RTTA logic is evaluating object/sub-object for multiple virtual features, each virtual feature may use a different subset of the predefined feature set. Although not illustrated, the RTTA logic may be preconfigured with more than one virtual feature. In one embodiment, two or more virtual features may include the same subset of the feature set but the virtual features may be different (e.g., a first virtual feature may have a different order of feature-condition pairings separated by different logical operators than a second virtual feature).
3. Record Detected Features as “Observations”
Referring to a presence feature, such as FeatureA of
For example, a first feature may be a size of an embedded object and a second feature may be the number of JavaScript instances in an object. In such an example, referring to the first feature, an observation will correspond to a value for each instance of an embedded object and referring to the second feature, an observation will correspond to a value representing the number of JavaScript instances detected. Referring to a numeric feature, in one embodiment, the RTTA logic maintains the set of all observations corresponding to a feature, because a first observation may not satisfy all feature-condition pairings of the applicable feature but a second observation may satisfy one or more other feature-condition pairings of the applicable feature. Therefore, in order to evaluate the virtual feature using the entire object/sub-object, each observation (i.e., a value) of each detected instance of a numeric feature is to be recorded. Alternatively, in a second embodiment, the RTTA logic may maintain a representation of detected values corresponding to a feature that elides certain, similar values.
In one embodiment, a first numeric feature is the size of an embedded object, the RTTA logic maintains a representation of the set of all observations of embedded objects (a first value represented in the set corresponding to a first detected embedded object and a second value represented in the set corresponding to a second detected embedded object). Note that in such an example, the RTTA logic does not need to maintain duplicates (e.g., when a first embedded object and a second embedded object have the same size, a single entry in the representation of the set of all observations may be sufficient). When a second numeric feature is the number of, for example, JavaScript instances within a portion of network traffic, the RTTA maintains a representation (e.g., a count) of the number of JavaScript instances detected during parsing and records the final numeric value upon completion of the parsing.
Referring to
Herein, ObservationA corresponds to the observed value of Features and a set, ObservationN-1-ObservationN-3, corresponds to the observed values of FeatureN. According to
4. Evaluate Feature-Condition Pairings
As defined above, a “condition” may be either the presence of a feature or a numeric evaluation (e.g., above or below a threshold, within a specific numeric range, etc.). The evaluation of a feature-condition pairing includes determining whether the one or more detected values of an observation intersect with the subset of all possible values of that feature that satisfy the condition. The evaluation of each feature-condition pairing results in a “yes” or “no” answer. This may be represented in any manner such that there are two indicators, one representing an intersection and one representing no intersection (e.g., binary—‘1’ and ‘0’).
Referring to
5. Generate Observation Vector
The observation vector, as defined above, is a binary representation of the evaluation of the feature-condition pairings. Specifically, the observation vector contents are ordered according to ordering of the corresponding feature-condition pairing from the virtual feature.
Referring to
The observation vector of
6. Determine Membership of Observation Vector in Truth Set
As defined above, the truth set corresponding to the virtual feature is a set of the one or more binary vectors that each satisfy the terms of the virtual feature. The determination as to whether the observation vector is a member of the truth set (and thus satisfies the terms of the virtual feature) is done by determining whether the observation vector matches a binary vector within the truth set.
Referring to
7. Mark Virtual Feature as “Observed” and Provide Observed Virtual Feature(s) to Score Determination Logic
Once the observation has been determined to be a member of the truth set, the virtual feature is marked as “observed.” The virtual feature may be marked as observed in the preconfigured feature set, making it available to subsequent virtual features, as well as to the RTTA score determination logic. Alternatively, the RTTA may mark which virtual features, if any, were observed in a separate table and pass the table to the RTTA score determination logic.
The RTTA score determination logic determines a score for the object that indicates a level of suspiciousness for the object. The score may be based on the one or more virtual features observed. In one embodiment, the score may also be based on the value(s) of one or more observations, and/or the presence or absence of one or more values. When the RTTA score determination logic determines a score that is above a predetermined threshold, the RTTA logic passes the object, or portion of network traffic that includes the object, to the static analysis logic and/or the dynamic analysis logic, as such a score indicates at least a first level of suspiciousness and/or malicious that warrants further analysis. In contrast, when the RTTA score determination logic determines a score that is not above the predetermined threshold, the RTTA logic does not provide the object, or portion of network traffic, to the static analysis logic or the dynamic analysis logic but may instead pass the object, or portion of the network traffic, on to one or more endpoint devices.
In another embodiment, the threat detection system including real-time traffic analysis logic may be deployed in an endpoint device. Similar to the deployment discussed above regarding the network appliance, the threat detection system deployed within an endpoint device includes a real-time traffic analysis (RTTA) logic and a RTTA score determination logic. Data received by the endpoint device (e.g., via a network and/or data received via alternative manners, such as through a physical connection) is passed to the RTTA logic which parses the data and attempts to detect one or more features of a predefined feature set from which one or more virtual features are derived. The endpoint device may be pre-configured to include a threat detection system including the virtual feature(s), and the feature set (e.g., the threat detection system may be pre-installed on the endpoint device or may be installed on the endpoint device at any time prior to receipt of the data to be analyzed).
As discussed above, after detecting one or more features, and recording the representation of the values of each instance of that feature, if applicable, the RTTA logic evaluates the feature-condition pairings for a virtual feature using the observed/detected features (and values) and subsequently generates an observation vector based on the evaluation. The RTTA logic determines whether the observation vector is a member of the truth set that satisfies the terms of the virtual feature and, when the observation vector is a member of the truth set, an indication that the virtual feature was observed is passed to the RTTA score determination logic. The RTTA score determination logic determines a score indicating a level of suspiciousness, maliciousness and/or anomalous characteristics and/or behaviors. When the score is above a predetermined threshold, the threat detection system performs in-depth static and/or dynamic analysis on the portion of received data in order to determine whether the portion of data is suspicious, malicious or exhibits anomalous and/or unwanted characteristics and/or behaviors.
In the foregoing description, the invention is described with reference to specific exemplary embodiments thereof. It will, however, be evident that various modifications and changes may be made thereto without departing from the broader spirit and scope of the invention as set forth in the appended claims.
This application claims the benefit of priority on U.S. Provisional Application No. 62/274,024, filed Dec. 31, 2015, the entire contents of which are incorporated by reference herein.
Number | Name | Date | Kind |
---|---|---|---|
4292580 | Ott et al. | Sep 1981 | A |
5175732 | Hendel et al. | Dec 1992 | A |
5319776 | Hile et al. | Jun 1994 | A |
5440723 | Arnold et al. | Aug 1995 | A |
5490249 | Miller | Feb 1996 | A |
5657473 | Killean et al. | Aug 1997 | A |
5802277 | Cowlard | Sep 1998 | A |
5842002 | Schnurer et al. | Nov 1998 | A |
5960170 | Chen et al. | Sep 1999 | A |
5978917 | Chi | Nov 1999 | A |
5983348 | Ji | Nov 1999 | A |
6088803 | Tso et al. | Jul 2000 | A |
6092194 | Touboul | Jul 2000 | A |
6094677 | Capek et al. | Jul 2000 | A |
6108799 | Boulay et al. | Aug 2000 | A |
6154844 | Touboul et al. | Nov 2000 | A |
6269330 | Cidon et al. | Jul 2001 | B1 |
6272641 | Ji | Aug 2001 | B1 |
6279113 | Vaidya | Aug 2001 | B1 |
6298445 | Shostack et al. | Oct 2001 | B1 |
6357008 | Nachenberg | Mar 2002 | B1 |
6424627 | Sorhaug et al. | Jul 2002 | B1 |
6442696 | Wray et al. | Aug 2002 | B1 |
6484315 | Ziese | Nov 2002 | B1 |
6487666 | Shanklin et al. | Nov 2002 | B1 |
6493756 | O'Brien et al. | Dec 2002 | B1 |
6550012 | Villa et al. | Apr 2003 | B1 |
6775657 | Baker | Aug 2004 | B1 |
6831893 | Ben Nun et al. | Dec 2004 | B1 |
6832367 | Choi et al. | Dec 2004 | B1 |
6895550 | Kanchirayappa et al. | May 2005 | B2 |
6898632 | Gordy et al. | May 2005 | B2 |
6907396 | Muttik et al. | Jun 2005 | B1 |
6941348 | Petry | Sep 2005 | B2 |
6971097 | Wallman | Nov 2005 | B1 |
6981279 | Arnold et al. | Dec 2005 | B1 |
7007107 | Ivchenko et al. | Feb 2006 | B1 |
7028179 | Anderson et al. | Apr 2006 | B2 |
7043757 | Hoefelmeyer et al. | May 2006 | B2 |
7058822 | Edery et al. | Jun 2006 | B2 |
7069316 | Gryaznov | Jun 2006 | B1 |
7080407 | Zhao et al. | Jul 2006 | B1 |
7080408 | Pak et al. | Jul 2006 | B1 |
7093002 | Wolff et al. | Aug 2006 | B2 |
7093239 | van der Made | Aug 2006 | B1 |
7096498 | Judge | Aug 2006 | B2 |
7100201 | Izatt | Aug 2006 | B2 |
7107617 | Hursey et al. | Sep 2006 | B2 |
7159149 | Spiegel et al. | Jan 2007 | B2 |
7213260 | Judge | May 2007 | B2 |
7231667 | Jordan | Jun 2007 | B2 |
7240364 | Branscomb et al. | Jul 2007 | B1 |
7240368 | Roesch et al. | Jul 2007 | B1 |
7243371 | Kasper et al. | Jul 2007 | B1 |
7249175 | Donaldson | Jul 2007 | B1 |
7287278 | Liang | Oct 2007 | B2 |
7308716 | Danford et al. | Dec 2007 | B2 |
7328453 | Merkle, Jr. et al. | Feb 2008 | B2 |
7346486 | Ivancic et al. | Mar 2008 | B2 |
7356736 | Natvig | Apr 2008 | B2 |
7373664 | Kissel | May 2008 | B2 |
7386888 | Liang et al. | Jun 2008 | B2 |
7392542 | Bucher | Jun 2008 | B2 |
7418729 | Szor | Aug 2008 | B2 |
7428300 | Drew et al. | Sep 2008 | B1 |
7441272 | Durham et al. | Oct 2008 | B2 |
7448084 | Apap et al. | Nov 2008 | B1 |
7458098 | Judge et al. | Nov 2008 | B2 |
7464404 | Carpenter et al. | Dec 2008 | B2 |
7464407 | Nakae et al. | Dec 2008 | B2 |
7467408 | O'Toole, Jr. | Dec 2008 | B1 |
7478428 | Thomlinson | Jan 2009 | B1 |
7480773 | Reed | Jan 2009 | B1 |
7487543 | Arnold et al. | Feb 2009 | B2 |
7496960 | Chen et al. | Feb 2009 | B1 |
7496961 | Zimmer et al. | Feb 2009 | B2 |
7519990 | Xie | Apr 2009 | B1 |
7523493 | Liang et al. | Apr 2009 | B2 |
7530104 | Thrower et al. | May 2009 | B1 |
7540025 | Tzadikario | May 2009 | B2 |
7546638 | Anderson et al. | Jun 2009 | B2 |
7565550 | Liang et al. | Jul 2009 | B2 |
7568233 | Szor et al. | Jul 2009 | B1 |
7584455 | Ball | Sep 2009 | B2 |
7603715 | Costa et al. | Oct 2009 | B2 |
7607171 | Marsden et al. | Oct 2009 | B1 |
7639714 | Stolfo et al. | Dec 2009 | B2 |
7644441 | Schmid et al. | Jan 2010 | B2 |
7657419 | van der Made | Feb 2010 | B2 |
7676841 | Sobchuk et al. | Mar 2010 | B2 |
7698548 | Shelest et al. | Apr 2010 | B2 |
7707633 | Danford et al. | Apr 2010 | B2 |
7712136 | Sprosts et al. | May 2010 | B2 |
7730011 | Deninger et al. | Jun 2010 | B1 |
7739740 | Nachenberg et al. | Jun 2010 | B1 |
7779463 | Stolfo et al. | Aug 2010 | B2 |
7784097 | Stolfo et al. | Aug 2010 | B1 |
7832008 | Kraemer | Nov 2010 | B1 |
7836502 | Zhao et al. | Nov 2010 | B1 |
7849506 | Dansey et al. | Dec 2010 | B1 |
7854007 | Sprosts et al. | Dec 2010 | B2 |
7869073 | Oshima | Jan 2011 | B2 |
7877803 | Enstone et al. | Jan 2011 | B2 |
7904959 | Sidiroglou et al. | Mar 2011 | B2 |
7908660 | Bahl | Mar 2011 | B2 |
7930538 | Israel | Apr 2011 | B1 |
7930738 | Petersen | Apr 2011 | B1 |
7937387 | Frazier et al. | May 2011 | B2 |
7937761 | Bennett | May 2011 | B1 |
7949849 | Lowe et al. | May 2011 | B2 |
7996556 | Raghavan et al. | Aug 2011 | B2 |
7996836 | McCorkendale et al. | Aug 2011 | B1 |
7996904 | Chiueh et al. | Aug 2011 | B1 |
7996905 | Arnold et al. | Aug 2011 | B2 |
8006305 | Aziz | Aug 2011 | B2 |
8010667 | Zhang et al. | Aug 2011 | B2 |
8020206 | Hubbard et al. | Sep 2011 | B2 |
8028338 | Schneider et al. | Sep 2011 | B1 |
8042184 | Batenin | Oct 2011 | B1 |
8045094 | Teragawa | Oct 2011 | B2 |
8045458 | Alperovitch et al. | Oct 2011 | B2 |
8069484 | McMillan et al. | Nov 2011 | B2 |
8087086 | Lai et al. | Dec 2011 | B1 |
8171553 | Aziz et al. | May 2012 | B2 |
8176049 | Deninger et al. | May 2012 | B2 |
8176480 | Spertus | May 2012 | B1 |
8201246 | Wu et al. | Jun 2012 | B1 |
8204984 | Aziz et al. | Jun 2012 | B1 |
8214905 | Doukhvalov et al. | Jul 2012 | B1 |
8220055 | Kennedy | Jul 2012 | B1 |
8225288 | Miller et al. | Jul 2012 | B2 |
8225373 | Kraemer | Jul 2012 | B2 |
8233882 | Rogel | Jul 2012 | B2 |
8234640 | Fitzgerald et al. | Jul 2012 | B1 |
8234709 | Viljoen et al. | Jul 2012 | B2 |
8239944 | Nachenberg et al. | Aug 2012 | B1 |
8260914 | Ranjan | Sep 2012 | B1 |
8266091 | Gubin et al. | Sep 2012 | B1 |
8286251 | Eker et al. | Oct 2012 | B2 |
8291499 | Aziz et al. | Oct 2012 | B2 |
8307435 | Mann et al. | Nov 2012 | B1 |
8307443 | Wang et al. | Nov 2012 | B2 |
8312545 | Tuvell et al. | Nov 2012 | B2 |
8321936 | Green et al. | Nov 2012 | B1 |
8321941 | Tuvell et al. | Nov 2012 | B2 |
8332571 | Edwards, Sr. | Dec 2012 | B1 |
8365286 | Poston | Jan 2013 | B2 |
8365297 | Parshin et al. | Jan 2013 | B1 |
8370938 | Daswani et al. | Feb 2013 | B1 |
8370939 | Zaitsev et al. | Feb 2013 | B2 |
8375444 | Aziz et al. | Feb 2013 | B2 |
8381299 | Stolfo et al. | Feb 2013 | B2 |
8401982 | Satish | Mar 2013 | B1 |
8402529 | Green et al. | Mar 2013 | B1 |
8464340 | Ahn et al. | Jun 2013 | B2 |
8479174 | Chiriac | Jul 2013 | B2 |
8479276 | Vaystikh et al. | Jul 2013 | B1 |
8479291 | Bodke | Jul 2013 | B1 |
8510827 | Leake et al. | Aug 2013 | B1 |
8510828 | Guo et al. | Aug 2013 | B1 |
8510842 | Amit et al. | Aug 2013 | B2 |
8516478 | Edwards et al. | Aug 2013 | B1 |
8516590 | Ranadive et al. | Aug 2013 | B1 |
8516593 | Aziz | Aug 2013 | B2 |
8522348 | Chen et al. | Aug 2013 | B2 |
8528086 | Aziz | Sep 2013 | B1 |
8533824 | Hutton et al. | Sep 2013 | B2 |
8539582 | Aziz et al. | Sep 2013 | B1 |
8549638 | Aziz | Oct 2013 | B2 |
8555391 | Demir et al. | Oct 2013 | B1 |
8561177 | Aziz et al. | Oct 2013 | B1 |
8566476 | Shiffer et al. | Oct 2013 | B2 |
8566946 | Aziz et al. | Oct 2013 | B1 |
8584094 | Dadhia et al. | Nov 2013 | B2 |
8584234 | Sobel et al. | Nov 2013 | B1 |
8584239 | Aziz et al. | Nov 2013 | B2 |
8595834 | Xie et al. | Nov 2013 | B2 |
8627476 | Satish et al. | Jan 2014 | B1 |
8635696 | Aziz | Jan 2014 | B1 |
8682054 | Xue et al. | Mar 2014 | B2 |
8682812 | Ranjan | Mar 2014 | B1 |
8689333 | Aziz | Apr 2014 | B2 |
8695096 | Zhang | Apr 2014 | B1 |
8713631 | Pavlyushchik | Apr 2014 | B1 |
8713681 | Silberman et al. | Apr 2014 | B2 |
8726392 | McCorkendale et al. | May 2014 | B1 |
8739280 | Chess et al. | May 2014 | B2 |
8776229 | Aziz | Jul 2014 | B1 |
8782792 | Bodke | Jul 2014 | B1 |
8789172 | Stolfo et al. | Jul 2014 | B2 |
8789178 | Kejriwal et al. | Jul 2014 | B2 |
8793278 | Frazier et al. | Jul 2014 | B2 |
8793787 | Ismael et al. | Jul 2014 | B2 |
8805947 | Kuzkin et al. | Aug 2014 | B1 |
8806647 | Daswani et al. | Aug 2014 | B1 |
8832829 | Manni et al. | Sep 2014 | B2 |
8850570 | Ramzan | Sep 2014 | B1 |
8850571 | Staniford et al. | Sep 2014 | B2 |
8881234 | Narasimhan et al. | Nov 2014 | B2 |
8881271 | Butler, II | Nov 2014 | B2 |
8881282 | Aziz et al. | Nov 2014 | B1 |
8898788 | Aziz et al. | Nov 2014 | B1 |
8935779 | Manni et al. | Jan 2015 | B2 |
8949257 | Shiffer et al. | Feb 2015 | B2 |
8984638 | Aziz et al. | Mar 2015 | B1 |
8990939 | Staniford et al. | Mar 2015 | B2 |
8990944 | Singh et al. | Mar 2015 | B1 |
8997219 | Staniford et al. | Mar 2015 | B2 |
9009822 | Ismael et al. | Apr 2015 | B1 |
9009823 | Ismael et al. | Apr 2015 | B1 |
9015814 | Zakorzhevsky | Apr 2015 | B1 |
9027135 | Aziz | May 2015 | B1 |
9071638 | Aziz et al. | Jun 2015 | B1 |
9104867 | Thioux et al. | Aug 2015 | B1 |
9106630 | Frazier et al. | Aug 2015 | B2 |
9106694 | Aziz et al. | Aug 2015 | B2 |
9118715 | Staniford et al. | Aug 2015 | B2 |
9159035 | Ismael et al. | Oct 2015 | B1 |
9171160 | Vincent et al. | Oct 2015 | B2 |
9176843 | Ismael et al. | Nov 2015 | B1 |
9189627 | Islam | Nov 2015 | B1 |
9195829 | Goradia et al. | Nov 2015 | B1 |
9197664 | Aziz et al. | Nov 2015 | B1 |
9223972 | Vincent et al. | Dec 2015 | B1 |
9225740 | Ismael et al. | Dec 2015 | B1 |
9241010 | Bennett et al. | Jan 2016 | B1 |
9251343 | Vincent et al. | Feb 2016 | B1 |
9262635 | Paithane et al. | Feb 2016 | B2 |
9268936 | Butler | Feb 2016 | B2 |
9275229 | LeMasters | Mar 2016 | B2 |
9282109 | Aziz et al. | Mar 2016 | B1 |
9292686 | Ismael et al. | Mar 2016 | B2 |
9294501 | Mesdaq et al. | Mar 2016 | B2 |
9300686 | Pidathala et al. | Mar 2016 | B2 |
9306960 | Aziz | Apr 2016 | B1 |
9306974 | Aziz et al. | Apr 2016 | B1 |
9311479 | Manni et al. | Apr 2016 | B1 |
9355247 | Thioux et al. | May 2016 | B1 |
9356944 | Aziz | May 2016 | B1 |
9363280 | Rivlin et al. | Jun 2016 | B1 |
9367681 | Ismael et al. | Jun 2016 | B1 |
9398028 | Karandikar et al. | Jul 2016 | B1 |
9413781 | Cunningham et al. | Aug 2016 | B2 |
9426071 | Caldejon et al. | Aug 2016 | B1 |
9430646 | Mushtaq et al. | Aug 2016 | B1 |
9432389 | Khalid et al. | Aug 2016 | B1 |
9438613 | Paithane et al. | Sep 2016 | B1 |
9438622 | Staniford et al. | Sep 2016 | B1 |
9438623 | Thioux et al. | Sep 2016 | B1 |
9459901 | Jung et al. | Oct 2016 | B2 |
9467460 | Otvagin et al. | Oct 2016 | B1 |
9483644 | Paithane et al. | Nov 2016 | B1 |
9495180 | Ismael | Nov 2016 | B2 |
9497213 | Thompson et al. | Nov 2016 | B2 |
9507935 | Ismael et al. | Nov 2016 | B2 |
9516057 | Aziz | Dec 2016 | B2 |
9519782 | Aziz et al. | Dec 2016 | B2 |
9536091 | Paithane et al. | Jan 2017 | B2 |
9537972 | Edwards et al. | Jan 2017 | B1 |
9560059 | Islam | Jan 2017 | B1 |
9565202 | Kindlund et al. | Feb 2017 | B1 |
9591015 | Amin et al. | Mar 2017 | B1 |
9591020 | Aziz | Mar 2017 | B1 |
9594904 | Jain et al. | Mar 2017 | B1 |
9594905 | Ismael et al. | Mar 2017 | B1 |
9594912 | Thioux et al. | Mar 2017 | B1 |
9609007 | Rivlin et al. | Mar 2017 | B1 |
9626509 | Khalid et al. | Apr 2017 | B1 |
9628498 | Aziz et al. | Apr 2017 | B1 |
9628507 | Haq et al. | Apr 2017 | B2 |
9633134 | Ross | Apr 2017 | B2 |
9635039 | Islam et al. | Apr 2017 | B1 |
9641546 | Manni et al. | May 2017 | B1 |
9654485 | Neumann | May 2017 | B1 |
9661009 | Karandikar et al. | May 2017 | B1 |
9661018 | Aziz | May 2017 | B1 |
9674298 | Edwards et al. | Jun 2017 | B1 |
9680862 | Ismael et al. | Jun 2017 | B2 |
9690606 | Ha et al. | Jun 2017 | B1 |
9690933 | Singh et al. | Jun 2017 | B1 |
9690935 | Shiffer et al. | Jun 2017 | B2 |
9690936 | Malik et al. | Jun 2017 | B1 |
9736179 | Ismael | Aug 2017 | B2 |
9740857 | Ismael et al. | Aug 2017 | B2 |
9747446 | Pidathala et al. | Aug 2017 | B1 |
9756074 | Aziz et al. | Sep 2017 | B2 |
9773112 | Rathor et al. | Sep 2017 | B1 |
9781144 | Otvagin et al. | Oct 2017 | B1 |
9787700 | Amin et al. | Oct 2017 | B1 |
9787706 | Otvagin et al. | Oct 2017 | B1 |
9792196 | Ismael et al. | Oct 2017 | B1 |
9824209 | Ismael et al. | Nov 2017 | B1 |
9824211 | Wilson | Nov 2017 | B2 |
9824216 | Khalid et al. | Nov 2017 | B1 |
9825976 | Gomez et al. | Nov 2017 | B1 |
9825989 | Mehra et al. | Nov 2017 | B1 |
9838408 | Karandikar et al. | Dec 2017 | B1 |
9838411 | Aziz | Dec 2017 | B1 |
9838416 | Aziz | Dec 2017 | B1 |
9838417 | Khalid et al. | Dec 2017 | B1 |
9846776 | Paithane et al. | Dec 2017 | B1 |
9876701 | Caldejon et al. | Jan 2018 | B1 |
9888016 | Amin et al. | Feb 2018 | B1 |
9888019 | Pidathala et al. | Feb 2018 | B1 |
9910988 | Vincent et al. | Mar 2018 | B1 |
9912644 | Cunningham | Mar 2018 | B2 |
9912681 | Ismael et al. | Mar 2018 | B1 |
9912684 | Aziz et al. | Mar 2018 | B1 |
9912691 | Mesdaq et al. | Mar 2018 | B2 |
9912698 | Thioux et al. | Mar 2018 | B1 |
9916440 | Paithane et al. | Mar 2018 | B1 |
9921978 | Chan et al. | Mar 2018 | B1 |
9934376 | Ismael | Apr 2018 | B1 |
9934381 | Kindlund et al. | Apr 2018 | B1 |
9946568 | Ismael et al. | Apr 2018 | B1 |
9954890 | Staniford et al. | Apr 2018 | B1 |
9973531 | Thioux | May 2018 | B1 |
10002252 | Ismael et al. | Jun 2018 | B2 |
10019338 | Goradia et al. | Jul 2018 | B1 |
10019573 | Silberman et al. | Jul 2018 | B2 |
10025691 | Ismael et al. | Jul 2018 | B1 |
10025927 | Khalid et al. | Jul 2018 | B1 |
10027689 | Rathor et al. | Jul 2018 | B1 |
10027690 | Aziz et al. | Jul 2018 | B2 |
10027696 | Rivlin et al. | Jul 2018 | B1 |
10033747 | Paithane et al. | Jul 2018 | B1 |
10033748 | Cunningham et al. | Jul 2018 | B1 |
10033753 | Islam et al. | Jul 2018 | B1 |
10033759 | Kabra et al. | Jul 2018 | B1 |
10050998 | Singh | Aug 2018 | B1 |
10068091 | Aziz et al. | Sep 2018 | B1 |
10075455 | Zafar et al. | Sep 2018 | B2 |
10083302 | Paithane et al. | Sep 2018 | B1 |
10084813 | Eyada | Sep 2018 | B2 |
10089461 | Ha et al. | Oct 2018 | B1 |
10097573 | Aziz | Oct 2018 | B1 |
10104102 | Neumann | Oct 2018 | B1 |
10108446 | Steinberg et al. | Oct 2018 | B1 |
10121000 | Rivlin et al. | Nov 2018 | B1 |
10122746 | Manni et al. | Nov 2018 | B1 |
10133863 | Bu et al. | Nov 2018 | B2 |
10133866 | Kumar et al. | Nov 2018 | B1 |
10146810 | Shiffer et al. | Dec 2018 | B2 |
10148693 | Singh et al. | Dec 2018 | B2 |
10165000 | Aziz et al. | Dec 2018 | B1 |
10169585 | Pilipenko et al. | Jan 2019 | B1 |
10176321 | Abbasi et al. | Jan 2019 | B2 |
10181029 | Ismael et al. | Jan 2019 | B1 |
10191861 | Steinberg et al. | Jan 2019 | B1 |
10192052 | Singh et al. | Jan 2019 | B1 |
10198574 | Thioux et al. | Feb 2019 | B1 |
10200384 | Mushtaq et al. | Feb 2019 | B1 |
10210329 | Malik et al. | Feb 2019 | B1 |
10216927 | Steinberg | Feb 2019 | B1 |
10218740 | Mesdaq et al. | Feb 2019 | B1 |
10242185 | Goradia | Mar 2019 | B1 |
20010005889 | Albrecht | Jun 2001 | A1 |
20010047326 | Broadbent et al. | Nov 2001 | A1 |
20020018903 | Kokubo et al. | Feb 2002 | A1 |
20020038430 | Edwards et al. | Mar 2002 | A1 |
20020091819 | Melchione et al. | Jul 2002 | A1 |
20020095607 | Lin-Hendel | Jul 2002 | A1 |
20020116627 | Farbotton et al. | Aug 2002 | A1 |
20020144156 | Copeland | Oct 2002 | A1 |
20020162015 | Tang | Oct 2002 | A1 |
20020166063 | Lachman et al. | Nov 2002 | A1 |
20020169952 | DiSanto et al. | Nov 2002 | A1 |
20020184528 | Shevenell et al. | Dec 2002 | A1 |
20020188887 | Largman et al. | Dec 2002 | A1 |
20020194490 | Halperin et al. | Dec 2002 | A1 |
20030021728 | Sharpe et al. | Jan 2003 | A1 |
20030074578 | Ford et al. | Apr 2003 | A1 |
20030084318 | Schertz | May 2003 | A1 |
20030101381 | Mateev et al. | May 2003 | A1 |
20030115483 | Liang | Jun 2003 | A1 |
20030188190 | Aaron et al. | Oct 2003 | A1 |
20030191957 | Hypponen et al. | Oct 2003 | A1 |
20030200460 | Morota et al. | Oct 2003 | A1 |
20030212902 | van der Made | Nov 2003 | A1 |
20030229801 | Kouznetsov et al. | Dec 2003 | A1 |
20030237000 | Denton et al. | Dec 2003 | A1 |
20040003323 | Bennett et al. | Jan 2004 | A1 |
20040006473 | Mills et al. | Jan 2004 | A1 |
20040015712 | Szor | Jan 2004 | A1 |
20040019832 | Arnold et al. | Jan 2004 | A1 |
20040047356 | Bauer | Mar 2004 | A1 |
20040083408 | Spiegel et al. | Apr 2004 | A1 |
20040088581 | Brawn et al. | May 2004 | A1 |
20040093513 | Cantrell et al. | May 2004 | A1 |
20040111531 | Staniford et al. | Jun 2004 | A1 |
20040117478 | Triulzi et al. | Jun 2004 | A1 |
20040117624 | Brandt et al. | Jun 2004 | A1 |
20040128355 | Chao et al. | Jul 2004 | A1 |
20040165588 | Pandya | Aug 2004 | A1 |
20040236963 | Danford et al. | Nov 2004 | A1 |
20040243349 | Greifeneder et al. | Dec 2004 | A1 |
20040249911 | Alkhatib et al. | Dec 2004 | A1 |
20040255161 | Cavanaugh | Dec 2004 | A1 |
20040268147 | Wiederin et al. | Dec 2004 | A1 |
20050005159 | Oliphant | Jan 2005 | A1 |
20050021740 | Bar et al. | Jan 2005 | A1 |
20050033960 | Vialen et al. | Feb 2005 | A1 |
20050033989 | Poletto et al. | Feb 2005 | A1 |
20050050148 | Mohammadioun et al. | Mar 2005 | A1 |
20050086523 | Zimmer et al. | Apr 2005 | A1 |
20050091513 | Mitomo et al. | Apr 2005 | A1 |
20050091533 | Omote et al. | Apr 2005 | A1 |
20050091652 | Ross et al. | Apr 2005 | A1 |
20050108562 | Khazan et al. | May 2005 | A1 |
20050114663 | Cornell et al. | May 2005 | A1 |
20050125195 | Brendel | Jun 2005 | A1 |
20050149726 | Joshi et al. | Jul 2005 | A1 |
20050157662 | Bingham et al. | Jul 2005 | A1 |
20050183143 | Anderholm et al. | Aug 2005 | A1 |
20050201297 | Peikari | Sep 2005 | A1 |
20050210533 | Copeland et al. | Sep 2005 | A1 |
20050238005 | Chen et al. | Oct 2005 | A1 |
20050240781 | Gassoway | Oct 2005 | A1 |
20050262562 | Gassoway | Nov 2005 | A1 |
20050265331 | Stolfo | Dec 2005 | A1 |
20050283839 | Cowburn | Dec 2005 | A1 |
20060010495 | Cohen et al. | Jan 2006 | A1 |
20060015416 | Hoffman et al. | Jan 2006 | A1 |
20060015715 | Anderson | Jan 2006 | A1 |
20060015747 | Van de Ven | Jan 2006 | A1 |
20060021029 | Brickell et al. | Jan 2006 | A1 |
20060021054 | Costa et al. | Jan 2006 | A1 |
20060031476 | Mathes et al. | Feb 2006 | A1 |
20060047665 | Neil | Mar 2006 | A1 |
20060070130 | Costea et al. | Mar 2006 | A1 |
20060075496 | Carpenter et al. | Apr 2006 | A1 |
20060095968 | Portolani et al. | May 2006 | A1 |
20060101516 | Sudaharan et al. | May 2006 | A1 |
20060101517 | Banzhof et al. | May 2006 | A1 |
20060117385 | Mester et al. | Jun 2006 | A1 |
20060123477 | Raghavan et al. | Jun 2006 | A1 |
20060143709 | Brooks et al. | Jun 2006 | A1 |
20060150249 | Gassen et al. | Jul 2006 | A1 |
20060161983 | Cothrell et al. | Jul 2006 | A1 |
20060161987 | Levy-Yurista | Jul 2006 | A1 |
20060161989 | Reshef et al. | Jul 2006 | A1 |
20060164199 | Gilde et al. | Jul 2006 | A1 |
20060173992 | Weber et al. | Aug 2006 | A1 |
20060179147 | Tran et al. | Aug 2006 | A1 |
20060184632 | Marino et al. | Aug 2006 | A1 |
20060191010 | Benjamin | Aug 2006 | A1 |
20060221956 | Narayan et al. | Oct 2006 | A1 |
20060236393 | Kramer et al. | Oct 2006 | A1 |
20060242709 | Seinfeld et al. | Oct 2006 | A1 |
20060248519 | Jaeger et al. | Nov 2006 | A1 |
20060248582 | Panjwani et al. | Nov 2006 | A1 |
20060251104 | Koga | Nov 2006 | A1 |
20060288417 | Bookbinder et al. | Dec 2006 | A1 |
20070006288 | Mayfield et al. | Jan 2007 | A1 |
20070006313 | Porras et al. | Jan 2007 | A1 |
20070011174 | Takaragi et al. | Jan 2007 | A1 |
20070016951 | Piccard et al. | Jan 2007 | A1 |
20070019286 | Kikuchi | Jan 2007 | A1 |
20070033645 | Jones | Feb 2007 | A1 |
20070038943 | FitzGerald et al. | Feb 2007 | A1 |
20070064689 | Shin et al. | Mar 2007 | A1 |
20070074169 | Chess et al. | Mar 2007 | A1 |
20070079379 | Sprosts | Apr 2007 | A1 |
20070094730 | Bhikkaji et al. | Apr 2007 | A1 |
20070101435 | Konanka et al. | May 2007 | A1 |
20070128855 | Cho et al. | Jun 2007 | A1 |
20070142030 | Sinha et al. | Jun 2007 | A1 |
20070143827 | Nicodemus et al. | Jun 2007 | A1 |
20070156895 | Vuong | Jul 2007 | A1 |
20070157180 | Tillmann et al. | Jul 2007 | A1 |
20070157306 | Elrod et al. | Jul 2007 | A1 |
20070168988 | Eisner et al. | Jul 2007 | A1 |
20070171824 | Ruello et al. | Jul 2007 | A1 |
20070174915 | Gribble et al. | Jul 2007 | A1 |
20070192500 | Lum | Aug 2007 | A1 |
20070192858 | Lum | Aug 2007 | A1 |
20070198275 | Malden et al. | Aug 2007 | A1 |
20070208822 | Wang et al. | Sep 2007 | A1 |
20070220607 | Sprosts et al. | Sep 2007 | A1 |
20070240218 | Tuvell et al. | Oct 2007 | A1 |
20070240219 | Tuvell et al. | Oct 2007 | A1 |
20070240220 | Tuvell et al. | Oct 2007 | A1 |
20070240222 | Tuvell et al. | Oct 2007 | A1 |
20070250930 | Aziz et al. | Oct 2007 | A1 |
20070256132 | Oliphant | Nov 2007 | A2 |
20070271446 | Nakamura | Nov 2007 | A1 |
20080005782 | Aziz | Jan 2008 | A1 |
20080018122 | Zierler et al. | Jan 2008 | A1 |
20080028463 | Dagon et al. | Jan 2008 | A1 |
20080040710 | Chiriac | Feb 2008 | A1 |
20080046781 | Childs et al. | Feb 2008 | A1 |
20080066179 | Liu | Mar 2008 | A1 |
20080072326 | Danford et al. | Mar 2008 | A1 |
20080077793 | Tan et al. | Mar 2008 | A1 |
20080080518 | Hoeflin et al. | Apr 2008 | A1 |
20080086720 | Lekel | Apr 2008 | A1 |
20080098476 | Syversen | Apr 2008 | A1 |
20080120722 | Sima et al. | May 2008 | A1 |
20080134178 | Fitzgerald et al. | Jun 2008 | A1 |
20080134334 | Kim et al. | Jun 2008 | A1 |
20080141376 | Clausen et al. | Jun 2008 | A1 |
20080184367 | McMillan et al. | Jul 2008 | A1 |
20080184373 | Traut et al. | Jul 2008 | A1 |
20080189787 | Arnold et al. | Aug 2008 | A1 |
20080201778 | Guo et al. | Aug 2008 | A1 |
20080209557 | Herley et al. | Aug 2008 | A1 |
20080215742 | Goldszmidt et al. | Sep 2008 | A1 |
20080222729 | Chen et al. | Sep 2008 | A1 |
20080263665 | Ma et al. | Oct 2008 | A1 |
20080295172 | Bohacek | Nov 2008 | A1 |
20080301810 | Lehane et al. | Dec 2008 | A1 |
20080307524 | Singh et al. | Dec 2008 | A1 |
20080313738 | Enderby | Dec 2008 | A1 |
20080320594 | Jiang | Dec 2008 | A1 |
20090003317 | Kasralikar et al. | Jan 2009 | A1 |
20090007100 | Field et al. | Jan 2009 | A1 |
20090013408 | Schipka | Jan 2009 | A1 |
20090031423 | Liu et al. | Jan 2009 | A1 |
20090036111 | Danford et al. | Feb 2009 | A1 |
20090037835 | Goldman | Feb 2009 | A1 |
20090044024 | Oberheide et al. | Feb 2009 | A1 |
20090044274 | Budko et al. | Feb 2009 | A1 |
20090064332 | Porras et al. | Mar 2009 | A1 |
20090077666 | Chen et al. | Mar 2009 | A1 |
20090083369 | Marmor | Mar 2009 | A1 |
20090083855 | Apap et al. | Mar 2009 | A1 |
20090089879 | Wang et al. | Apr 2009 | A1 |
20090094697 | Provos et al. | Apr 2009 | A1 |
20090113425 | Ports et al. | Apr 2009 | A1 |
20090125976 | Wassermann et al. | May 2009 | A1 |
20090126015 | Monastyrsky et al. | May 2009 | A1 |
20090126016 | Sobko et al. | May 2009 | A1 |
20090133125 | Choi et al. | May 2009 | A1 |
20090144823 | Lamastra et al. | Jun 2009 | A1 |
20090158430 | Borders | Jun 2009 | A1 |
20090172815 | Gu et al. | Jul 2009 | A1 |
20090187992 | Poston | Jul 2009 | A1 |
20090193293 | Stolfo et al. | Jul 2009 | A1 |
20090198651 | Shiffer et al. | Aug 2009 | A1 |
20090198670 | Shiffer et al. | Aug 2009 | A1 |
20090198689 | Frazier et al. | Aug 2009 | A1 |
20090199274 | Frazier et al. | Aug 2009 | A1 |
20090199296 | Xie et al. | Aug 2009 | A1 |
20090228233 | Anderson et al. | Sep 2009 | A1 |
20090241187 | Troyansky | Sep 2009 | A1 |
20090241190 | Todd et al. | Sep 2009 | A1 |
20090265692 | Godefroid et al. | Oct 2009 | A1 |
20090271867 | Zhang | Oct 2009 | A1 |
20090300415 | Zhang et al. | Dec 2009 | A1 |
20090300761 | Park et al. | Dec 2009 | A1 |
20090328185 | Berg et al. | Dec 2009 | A1 |
20090328221 | Blumfield et al. | Dec 2009 | A1 |
20100005146 | Drako et al. | Jan 2010 | A1 |
20100011205 | McKenna | Jan 2010 | A1 |
20100017546 | Poo et al. | Jan 2010 | A1 |
20100030996 | Butler, II | Feb 2010 | A1 |
20100031353 | Thomas et al. | Feb 2010 | A1 |
20100037314 | Perdisci et al. | Feb 2010 | A1 |
20100043073 | Kuwamura | Feb 2010 | A1 |
20100054278 | Stolfo et al. | Mar 2010 | A1 |
20100058474 | Hicks | Mar 2010 | A1 |
20100064044 | Nonoyama | Mar 2010 | A1 |
20100077481 | Polyakov et al. | Mar 2010 | A1 |
20100083376 | Pereira et al. | Apr 2010 | A1 |
20100115621 | Staniford et al. | May 2010 | A1 |
20100132038 | Zaitsev | May 2010 | A1 |
20100154056 | Smith et al. | Jun 2010 | A1 |
20100180344 | Malyshev et al. | Jul 2010 | A1 |
20100192223 | Ismael et al. | Jul 2010 | A1 |
20100220863 | Dupaquis et al. | Sep 2010 | A1 |
20100235831 | Dittmer | Sep 2010 | A1 |
20100251104 | Massand | Sep 2010 | A1 |
20100281102 | Chinta et al. | Nov 2010 | A1 |
20100281541 | Stolfo et al. | Nov 2010 | A1 |
20100281542 | Stolfo et al. | Nov 2010 | A1 |
20100287260 | Peterson et al. | Nov 2010 | A1 |
20100299754 | Amit et al. | Nov 2010 | A1 |
20100306173 | Frank | Dec 2010 | A1 |
20110004737 | Greenebaum | Jan 2011 | A1 |
20110025504 | Lyon et al. | Feb 2011 | A1 |
20110041179 | St Hlberg | Feb 2011 | A1 |
20110047594 | Mahaffey et al. | Feb 2011 | A1 |
20110047620 | Mahaffey et al. | Feb 2011 | A1 |
20110055907 | Narasimhan et al. | Mar 2011 | A1 |
20110078794 | Manni et al. | Mar 2011 | A1 |
20110093951 | Aziz | Apr 2011 | A1 |
20110099620 | Stavrou et al. | Apr 2011 | A1 |
20110099633 | Aziz | Apr 2011 | A1 |
20110099635 | Silberman et al. | Apr 2011 | A1 |
20110113231 | Kaminsky | May 2011 | A1 |
20110145918 | Jung et al. | Jun 2011 | A1 |
20110145920 | Mahaffey et al. | Jun 2011 | A1 |
20110145934 | Abramovici et al. | Jun 2011 | A1 |
20110167493 | Song et al. | Jul 2011 | A1 |
20110167494 | Bowen et al. | Jul 2011 | A1 |
20110173213 | Frazier et al. | Jul 2011 | A1 |
20110173460 | Ito et al. | Jul 2011 | A1 |
20110219449 | St. Neitzel et al. | Sep 2011 | A1 |
20110219450 | McDougal et al. | Sep 2011 | A1 |
20110225624 | Sawhney et al. | Sep 2011 | A1 |
20110225655 | Niemela et al. | Sep 2011 | A1 |
20110247072 | Staniford et al. | Oct 2011 | A1 |
20110265182 | Peinado et al. | Oct 2011 | A1 |
20110289582 | Kejriwal et al. | Nov 2011 | A1 |
20110302587 | Nishikawa et al. | Dec 2011 | A1 |
20110307954 | Melnik et al. | Dec 2011 | A1 |
20110307955 | Kaplan et al. | Dec 2011 | A1 |
20110307956 | Yermakov et al. | Dec 2011 | A1 |
20110314546 | Aziz et al. | Dec 2011 | A1 |
20120023593 | Puder et al. | Jan 2012 | A1 |
20120054869 | Yen et al. | Mar 2012 | A1 |
20120066698 | Yanoo | Mar 2012 | A1 |
20120079596 | Thomas et al. | Mar 2012 | A1 |
20120084859 | Radinsky et al. | Apr 2012 | A1 |
20120096553 | Srivastava et al. | Apr 2012 | A1 |
20120110667 | Zubrilin et al. | May 2012 | A1 |
20120117652 | Manni et al. | May 2012 | A1 |
20120121154 | Xue et al. | May 2012 | A1 |
20120124426 | Maybee et al. | May 2012 | A1 |
20120174186 | Aziz et al. | Jul 2012 | A1 |
20120174196 | Bhogavilli et al. | Jul 2012 | A1 |
20120174218 | McCoy et al. | Jul 2012 | A1 |
20120198279 | Schroeder | Aug 2012 | A1 |
20120210423 | Friedrichs et al. | Aug 2012 | A1 |
20120222121 | Staniford et al. | Aug 2012 | A1 |
20120255015 | Sahita et al. | Oct 2012 | A1 |
20120255017 | Sallam | Oct 2012 | A1 |
20120260342 | Dube et al. | Oct 2012 | A1 |
20120266244 | Green et al. | Oct 2012 | A1 |
20120278886 | Luna | Nov 2012 | A1 |
20120297489 | Dequevy | Nov 2012 | A1 |
20120330801 | McDougal et al. | Dec 2012 | A1 |
20120331553 | Aziz et al. | Dec 2012 | A1 |
20130014259 | Gribble et al. | Jan 2013 | A1 |
20130036472 | Aziz | Feb 2013 | A1 |
20130047257 | Aziz | Feb 2013 | A1 |
20130074185 | McDougal et al. | Mar 2013 | A1 |
20130086684 | Mohler | Apr 2013 | A1 |
20130097699 | Balupar et al. | Apr 2013 | A1 |
20130097706 | Titonis et al. | Apr 2013 | A1 |
20130111587 | Goel et al. | May 2013 | A1 |
20130117852 | Stute | May 2013 | A1 |
20130117855 | Kim et al. | May 2013 | A1 |
20130139264 | Brinkley et al. | May 2013 | A1 |
20130160125 | Likhachev et al. | Jun 2013 | A1 |
20130160127 | Jeong et al. | Jun 2013 | A1 |
20130160130 | Mendelev et al. | Jun 2013 | A1 |
20130160131 | Madou et al. | Jun 2013 | A1 |
20130167236 | Sick | Jun 2013 | A1 |
20130174214 | Duncan | Jul 2013 | A1 |
20130185789 | Hagiwara et al. | Jul 2013 | A1 |
20130185795 | Winn et al. | Jul 2013 | A1 |
20130185798 | Saunders et al. | Jul 2013 | A1 |
20130191915 | Antonakakis et al. | Jul 2013 | A1 |
20130196649 | Paddon et al. | Aug 2013 | A1 |
20130227691 | Aziz et al. | Aug 2013 | A1 |
20130246370 | Bartram et al. | Sep 2013 | A1 |
20130247186 | LeMasters | Sep 2013 | A1 |
20130263260 | Mahaffey et al. | Oct 2013 | A1 |
20130291109 | Staniford et al. | Oct 2013 | A1 |
20130298243 | Kumar et al. | Nov 2013 | A1 |
20130318038 | Shiffer et al. | Nov 2013 | A1 |
20130318073 | Shiffer et al. | Nov 2013 | A1 |
20130325791 | Shiffer et al. | Dec 2013 | A1 |
20130325792 | Shiffer et al. | Dec 2013 | A1 |
20130325871 | Shiffer et al. | Dec 2013 | A1 |
20130325872 | Shiffer et al. | Dec 2013 | A1 |
20140032875 | Butler | Jan 2014 | A1 |
20140053260 | Gupta et al. | Feb 2014 | A1 |
20140053261 | Gupta et al. | Feb 2014 | A1 |
20140130158 | Wang et al. | May 2014 | A1 |
20140137180 | Lukacs et al. | May 2014 | A1 |
20140165203 | Friedrichs | Jun 2014 | A1 |
20140169762 | Ryu | Jun 2014 | A1 |
20140179360 | Jackson et al. | Jun 2014 | A1 |
20140181131 | Ross | Jun 2014 | A1 |
20140189687 | Jung et al. | Jul 2014 | A1 |
20140189866 | Shiffer et al. | Jul 2014 | A1 |
20140189882 | Jung et al. | Jul 2014 | A1 |
20140237600 | Silberman et al. | Aug 2014 | A1 |
20140280245 | Wilson | Sep 2014 | A1 |
20140283037 | Sikorski et al. | Sep 2014 | A1 |
20140283063 | Thompson et al. | Sep 2014 | A1 |
20140328204 | Klotsche et al. | Nov 2014 | A1 |
20140337836 | Ismael | Nov 2014 | A1 |
20140344926 | Cunningham et al. | Nov 2014 | A1 |
20140351935 | Shao et al. | Nov 2014 | A1 |
20140380473 | Bu et al. | Dec 2014 | A1 |
20140380474 | Paithane et al. | Dec 2014 | A1 |
20150007312 | Pidathala | Jan 2015 | A1 |
20150096022 | Vincent et al. | Apr 2015 | A1 |
20150096023 | Mesdaq et al. | Apr 2015 | A1 |
20150096024 | Haq et al. | Apr 2015 | A1 |
20150096025 | Ismael | Apr 2015 | A1 |
20150180886 | Staniford et al. | Jun 2015 | A1 |
20150186645 | Aziz et al. | Jul 2015 | A1 |
20150199513 | Ismael et al. | Jul 2015 | A1 |
20150199531 | Ismael et al. | Jul 2015 | A1 |
20150199532 | Ismael et al. | Jul 2015 | A1 |
20150220735 | Paithane et al. | Aug 2015 | A1 |
20150372980 | Eyada | Dec 2015 | A1 |
20160004869 | Ismael et al. | Jan 2016 | A1 |
20160006756 | Ismael et al. | Jan 2016 | A1 |
20160044000 | Cunningham | Feb 2016 | A1 |
20160127393 | Aziz et al. | May 2016 | A1 |
20160191547 | Zafar et al. | Jun 2016 | A1 |
20160191550 | Ismael et al. | Jun 2016 | A1 |
20160261612 | Mesdaq et al. | Sep 2016 | A1 |
20160285914 | Singh et al. | Sep 2016 | A1 |
20160301703 | Aziz | Oct 2016 | A1 |
20160335110 | Paithane et al. | Nov 2016 | A1 |
20170083703 | Abbasi et al. | Mar 2017 | A1 |
20180013770 | Ismael | Jan 2018 | A1 |
20180048660 | Paithane et al. | Feb 2018 | A1 |
20180121316 | Ismael et al. | May 2018 | A1 |
20180288077 | Siddiqui et al. | Oct 2018 | A1 |
Number | Date | Country |
---|---|---|
2439806 | Jan 2008 | GB |
2490431 | Oct 2012 | GB |
02006928 | Jan 2002 | WO |
0223805 | Mar 2002 | WO |
2007117636 | Oct 2007 | WO |
2008041950 | Apr 2008 | WO |
2011084431 | Jul 2011 | WO |
2011112348 | Sep 2011 | WO |
2012075336 | Jun 2012 | WO |
2012145066 | Oct 2012 | WO |
2013067505 | May 2013 | WO |
Entry |
---|
Didier Stevens, “Malicious PDF Documents Explained”, Security & Privacy, IEEE, IEEE Service Center, Los Alamitos, CA, US, vol. 9, No. 1, Jan. 1, 2011, pp. 80-82, XP011329453, ISSN: 1540-7993, DOI: 10.1109/MSP.2011.14. |
Hiroshi Shinotsuka, Malware Authors Using New Techniques to Evade Automated Threat Analysis Systems, Oct. 26, 2012, http://www.symantec.com/connect/blogs/, pp. 1-4. |
Khaled Salah et al: “Using Cloud Computing to Implement a Security Overlay Network”, Security & Privacy, IEEE, IEEE Service Center, Los Alamitos, CA, US, vol. 11, No. 1, Jan. 1, 2013 (Jan. 1, 2013). |
Lastline Labs, The Threat of Evasive Malware, Feb. 25, 2013, Lastline Labs, pp. 1-8. |
Vladimir Getov: “Security as a Service in Smart Clouds—Opportunities and Concerns”, Computer Software and Applications Conference (COMPSAC), 2012 IEEE 36th Annual, IEEE, Jul. 16, 2012 (Jul. 16, 2012). |
“Mining Specification of Malicious Behavior”—Jha et al, UCSB, Sep. 2007 https://www.cs.ucsb.edu/.about.chris/research/doc/esec07.sub.-mining.pdf-. |
“Network Security: NetDetector—Network Intrusion Forensic System (NIFS) Whitepaper”, (“NetDetector Whitepaper”), (2003). |
“When Virtual is Better Than Real”, IEEEXplore Digital Library, available at, http://ieeexplore.ieee.org/xpl/articleDetails.isp?reload=true&arnumbe- r=990073, (Dec. 7, 2013). |
Abdullah, et al., Visualizing Network Data for Intrusion Detection, 2005 IEEE Workshop on Information Assurance and Security, pp. 100-108. |
Adetoye, Adedayo , et al., “Network Intrusion Detection & Response System”, (“Adetoye”), (Sep. 2003). |
Apostolopoulos, George; hassapis, Constantinos; “V-eM: A cluster of Virtual Machines for Robust, Detailed, and High-Performance Network Emulation”, 14th IEEE International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, Sep. 11-14, 2006, pp. 117-126. |
Aura, Tuomas, “Scanning electronic documents for personally identifiable information”. Proceedings of the 5th ACM workshop on Privacy in electronic society. ACM, 2006. |
Baecher, “The Nepenthes Platform: An Efficient Approach to collect Malware”, Springer-verlag Berlin Heidelberg, (2006), pp. 165-184. |
Baldi, Mario; Risso, Fulvio; “A Framework for Rapid Development and Portable Execution of Packet-Handling Applications”, 5th IEEE International Symposium Processing and Information Technology, Dec. 21, 2005, pp. 233-238. |
Bayer, et al., “Dynamic Analysis of Malicious Code”, J Comput Virol, Springer-Verlag, France., (2006), pp. 67-77. |
Boubalos, Chris , “extracting syslog data out of raw pcap dumps, seclists.org, Honeypots mailing list archives”, available at http://seclists.org/honeypots/2003/q2/319 (“Boubalos”), (Jun. 5, 2003). |
Chaudet, C., et al., “Optimal Positioning of Active and Passive Monitoring Devices”, International Conference on Emerging Networking Experiments and Technologies, Proceedings of the 2005 ACM Conference on Emerging Network Experiment and Technology, CoNEXT '05, Toulousse, France, (Oct. 2005), pp. 71-82. |
Chen, P. M. and Noble, B. D., “When Virtual is Better Than Real, Department of Electrical Engineering and Computer Science”, University of Michigan (“Chen”) (2001). |
Cisco “Intrusion Prevention for the Cisco ASA 5500-x Series” Data Sheet (2012). |
Cisco, Configuring the Catalyst Switched Port Analyzer (SPAN) (“Cisco”), (1992). |
Clark, John, Sylvian Leblanc,and Scott Knight. “Risks associated with usb hardware trojan devices used by insiders.” Systems Conference (SysCon), 2011 IEEE International. IEEE, 2011. |
Cohen, M.I. , “PyFlag—An advanced network forensic framework”, Digital investigation 5, Elsevier, (2008), pp. S112-S120. |
Costa, M. , et al., “Vigilante: End-to-End Containment of Internet Worms”, SOSP '05, Association for Computing Machinery, Inc., Brighton U.K., (Oct. 23-26, 2005). |
Crandall, J.R. , et al., “Minos:Control Data Attack Prevention Orthogonal to Memory Model”, 37th International Symposium on Microarchitecture, Portland, Oregon, (Dec. 2004). |
Deutsch, P. , “Zlib compressed data format specification version 3.3” RFC 1950, (1996). |
Distler, “Malware Analysis: An Introduction”, SANS Institute InfoSec Reading Room, SANS Institute, (2007). |
Dunlap, George W. , et al., “ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay”, Proceeding of the 5th Symposium on Operating Systems Design and Implementation, USENIX Association, (“Dunlap”), (Dec. 9, 2002). |
Excerpt regarding First Printing Date for Merike Kaeo, Designing Network Security (“Kaeo”), (2005). |
Filiol, Eric , et al., “Combinatorial Optimisation of Worm Propagation on an Unknown Network”, International Journal of Computer Science 2.2 (2007). |
FireEye Malware Analysis & Exchange Network, Malware Protection System, FireEye Inc., 2010. |
FireEye Malware Analysis, Modern Malware Forensics, FireEye Inc., 2010. |
FireEye v.6.0 Security Target, pp. 1-35, Version 1.1, FireEye Inc., May 2011. |
Gibler, Clint, et al. AndroidLeaks: automatically detecting potential privacy leaks in android applications on a large scale. Springer Beriin Heidelberg, 2012. |
Goel, et al., Reconstructing System State for Intrusion Analysis, Apr. 2008 SIGOPS Operating Systems Review, vol. 42 Issue 3, pp. 21-28. |
Gregg Keizer: “Microsoft's HoneyMonkeys Show Patching Windows Works”, Aug. 8, 2005, XP055143386, Retrieved from the Internet: URL:http://www.informationweek.com/microsofts-honeymonkeys-show-patching-windows-works/d/d-d/1035069? [retrieved on Jun. 1, 2016]. |
Heng Yin et al, Panorama: Capturing System-Wide Information Flow for Malware Detection and Analysis, Research Showcase @ CMU, Carnegie Mellon University, 2007. |
Hjelmvik, Erik , “Passive Network Security Analysis with NetworkMiner”, (IN)Secure, Issue 18, (Oct. 2008), pp. 1-100. |
Idika et al., A-Survey-of-Malware-Detection-Techniques, Feb. 2, 2007, Department of Computer Science, Purdue University. |
IEEE Xplore Digital Library Sear Results for “detection of unknown computer worms”. Http//ieeexplore.ieee.org/searchresult.jsp?SortField=Score&SortOrder=desc- &ResultC . . . , (Accessed on Aug. 28, 2009). |
Isohara, Takamasa, Keisuke Takemori, and Ayumu Kubota. “Kernel-based behavior analysis for android malware detection.” Computational intelligence and Security (CIS), 2011 Seventh International Conference on. IEEE, 2011. |
Kaeo, Merike , “Designing Network Security”, (“Kaeo”), (Nov. 2003). |
Kevin A Roundy et al: “Hybrid Analysis and Control of Malware”, Sep. 15, 2010, Recent Advances in Intrusion Detection, Springer Berlin Heidelberg, Berlin, Heidelberg, pp. 317-338, XP019150454 ISBN:978-3-642-15511-6. |
Kim, H. , et al., “Autograph: Toward Automated, Distributed Worm Signature Detection”, Proceedings of the 13th Usenix Security Symposium (Security 2004), San Diego, (Aug. 2004), pp. 271-286. |
King, Samuel T., et al., “Operating System Support for Virtual Machines”, (“King”), (2003). |
Krasnyansky, Max , et al., Universal TUN/TAP driver, available at https://www.kernel.org/doc/Documentation/networking/tuntap.txt (2002) (“Krasnyansky”). |
Kreibich, C. , et al., “Honeycomb-Creating Intrusion Detection Signatures Using Honeypots”, 2nd Workshop on Hot Topics in Networks (HotNets-11), Boston, USA, (2003). |
Kristoff, J. , “Botnets, Detection and Mitigation: DNS-Based Techniques”, NU Security Day, (2005), 23 pages. |
Leading Colleges Select FireEye to Stop Malware-Related Data Breaches, FireEye Inc., 2009. |
Li et al., A VMM-Based System Call Interposition Framework for Program Monitoring, Dec. 2010, IEEE 16th International Conference on Parallel and Distributed Systems, pp. 706-711. |
Liljenstam, Michael , et al., “Simulating Realistic Network Traffic for Worm Warning System Design and Testing”, Institute for Security Technology studies, Dartmouth College (“Liljenstam”), (Oct. 27, 2003). |
Lindorfer, Martina, Clemens Kolbitsch, and Paolo Milani Comparetti. “Detecting environment-sensitive malware.” Recent Advances in Intrusion Detection. Springer Berlin Heidelberg, 2011. |
Lok Kwong et al: “DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis”, Aug. 10, 2012, XP055158513, Retrieved from the Internet: URL:https://www.usenix.org/system/files/conference/usenixsecurity12/sec12- -final107.pdf [retrieved on Dec. 15, 2014]. |
Marchette, David J., “Computer Intrusion Detection and Network Monitoring: A Statistical Viewpoint”, (“Marchette”), (2001). |
Margolis, P.E. , “Random House Webster's ‘Computer & Internet Dictionary 3rd Edition’”, ISBN 0375703519, (Dec. 1998). |
Moore, D. , et al., “Internet Quarantine: Requirements for Containing Self-Propagating Code”, INFOCOM, vol. 3, (Mar. 30-Apr. 3, 2003), pp. 1901-1910. |
Morales, Jose A., et al., ““Analyzing and exploiting network behaviors of malware””, Security and Privacy in Communication Networks. Springer Berlin Heidelberg, 2010. 20-34. |
Miori, Detecting Unknown Computer Viruses, 2004, Springer-Verlag Berlin Heidelberg. |
Natvig, Kurt, “SANDBOXII: Internet”, Virus Bulletin Conference, (“Natvig”), (Sep. 2002). |
NetBIOS Working Group. Protocol Standard for a NetBIOS Service on a TCP/UDP transport: Concepts and Methods. STD 19, RFC 1001, Mar. 1987. |
Newsome, J. , et al., “Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software”, In Proceedings of the 12th Annual Network and Distributed System Security, Symposium (NDSS '05), (Feb. 2005). |
Newsome, J. , et al., “Polygraph: Automatically Generating Signatures for Polymorphic Worms”, In Proceedings of the IEEE Symposium on Security and Privacy, (May 2005). |
Nojiri, D. , et al., “Cooperation Response Strategies for Large Scale Attack Mitigation”, DARPA Information Survivability Conference and Exposition, vol. 1, (Apr. 22-24, 2003), pp. 293-302. |
Oberheide et al., CloudAV.sub.--N-Version Antivirus in the Network Cloud, 17th USENIX Security Symposium USENIX Security '08 Jul. 28-Aug. 1, 2008 San Jose, CA. |
Reiner Sailer, Enriquillo Valdez, Trent Jaeger, Roonald Perez, Leendertvan Doorn, John Linwood Griffin, Stefan Berger., sHype: Secure Hypervisor Appraoch to Trusted Virtualized Systems (Feb. 2, 2005) (“Sailer”). |
Silicon Defense, “Worm Containment in the Internal Network”, (Mar. 2003), pp. 1-25. |
Singh, S. , et al., “Automated Worm Fingerprinting”, Proceedings of the ACM/USENIX Symposium on Operating System Design and Implementation, San Francisco, California, (Dec. 2004). |
Spitzner, Lance , “Honeypots: Tracking Hackers”, (“Spizner”), (Sep. 17, 2002). |
The Sniffers's Guide to Raw Traffic available at: yuba.stanford.edu/.about.casado/pcap/section1.html, (Jan. 6, 2014). |
Thomas H. Ptacek, and Timothy N. Newsham , “Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection”, Secure Networks, (“Ptacek”), (Jan. 1998). |
U.S. Pat. No. 8,171,553 filed Apr. 20, 2006, Inter Parties Review Decision dated Jul. 10, 2015. |
U.S. Pat. No. 8,291,499 filed Mar. 16, 2012, Inter Parties Review Decision dated Jul. 10, 2015. |
Venezia, Paul, “NetDetector Captures Intrusions”, InfoWorld Issue 27, (“Venezia”), (Jul. 14, 2003). |
Wahid et al., Characterising the Evolution in Scanning Activity of Suspicious Hosts, Oct. 2009, Third International Conference on Network and System Security, pp. 344-350. |
Whyte, et al., “DNS-Based Detection of Scanning Works in an Enterprise Network”, Proceedings of the 12th Annual Network and Distributed System Security Symposium, (Feb. 2005), 15 pages. |
Williamson, Matthew M., “Throttling Viruses: Restricting Propagation to Defeat Malicious Mobile Code”, ACSAC Conference, Las Vegas, NV, USA, (Dec. 2002), pp. 1-9. |
Yuhei Kawakoya et al: “Memory behavior-based automatic malware unpacking in stealth debugging environment”, Malicious and Unwanted Software (Malware), 2010 5th International Conference on, IEEE, Piscataway, NJ, USA, Oct. 19, 2010, pp. 39-46, XP031833827, ISBN:978-1-4244-8-9353-1. |
Zhang et al., The Effects of Threading, Infection Time, and Multiple-Attacker Collaboration on Malware Propagation, Sep. 2009, IEEE 28th International Symposium on Reliable Distributed Systems, pp. 73-82. |
Number | Date | Country | |
---|---|---|---|
62274024 | Dec 2015 | US |