System and method of detecting delivery of malware using cross-customer data

Information

  • Patent Grant
  • 9363280
  • Patent Number
    9,363,280
  • Date Filed
    Friday, August 22, 2014
    10 years ago
  • Date Issued
    Tuesday, June 7, 2016
    8 years ago
Abstract
According to one embodiment, a computerized method comprises receiving a set of indicators of compromise (IOCs) associated with a known malware of a first message type from a first source and receiving one or more IOCs (IOC(s)) from a second source that is different from the first source. Thereafter, a determination is made as to whether the received IOC(s) from the second source correspond to the set of IOCs received from the first source. If so, information associated with at least the set of IOCs is used to locate a malware of the first message type that is undetected at the second source.
Description
FIELD

Embodiments of the disclosure relate to the field of cybersecurity. More specifically, embodiments of the disclosure relate to a system and method for conducting a predictive analysis, based on information from a first customer, as to when indicators of compromise (IOCs) experienced by a second customer are caused by receipt of an undetected malicious electronic message.


GENERAL BACKGROUND

Currently, there exist a number of malware delivery techniques. A commonly used malware delivery technique involves the transmission of a malicious electronic mail (email) message to a computer or device controlled by a targeted user. Based on user activity, the malicious email message causes the computer to become infected. More specifically, the malicious email message may be structured to lure the targeted user to select a Uniform Resource Locator (URL) within the malicious email message which, upon selection, establishes communications with a web server that, unbeknownst to the user, is malicious. Thereafter, malware is uploaded and sensitive information may be subsequently downloaded from the infected computer.


For the last few years, anti-virus and email filtering industries have developed tools and techniques to identify and isolate potentially infected email messages. However, these traditional tools and techniques are not effective in detecting certain types of advanced, malicious email messages. To address this detection gap, one type of security appliance has been solely developed (and is currently available) to analyze an email message and determine whether the email message is likely infected with malware. In particular, this email analytic appliance analyzes incoming email messages, namely its header, content, links and attachments, in order to identify the presence of malware. Upon discovery of a malicious email message, the email analytic appliance alerts security personnel to quarantine the malicious email message and cleanse the infected computer.


Many customers deploy dedicated email analysis appliances as well as network monitoring appliances. However, some customers do not operate dedicated email analytic appliances. Instead, most of these customers simply deploy one or more security appliances that are configured to monitor network communications with one or more network devices to identify indicators of compromise (IOCs), namely malicious behaviors that suggest the presence of malware on a particular network device or particular network devices. While these types of security appliances are able to identify the presence of malware on a particular computer, they are not configured to analyze email messages for the presence of malware within these messages. As a result, without an email analytic appliance, a customer has no ability to reliably prevent delivery of malicious to targeted victim of attack. Protection against malicious email messages becomes more complex as the messages may lay dormant in the user's inbox for days or even weeks. This lack of detection has prolonged adverse effects on network security as subsequent malicious attacks may persist months later as long as the malicious email message is stored at an email server of the enterprise network and/or stored locally at a computer having access to the network.





BRIEF DESCRIPTION OF THE DRAWINGS

Embodiments of the invention are illustrated by way of example and not by way of limitation in the figures of the accompanying drawings, in which like references indicate similar elements and in which:



FIG. 1 is an exemplary block diagram of a communication network 100 deploying an embodiment of the invention.



FIG. 2A is a block diagram of an exemplary embodiment of the management platform 110 of FIG. 1.



FIG. 2B is a block diagram of an exemplary embodiment of a logical representation of the management platform 110 of FIG. 1.



FIG. 3 is an illustrative embodiment of the operations conducted by the management platform 110 of FIG. 1 for conducting a predictive analysis.



FIG. 4 is a detailed embodiment of the operations in conducting predictive analysis by the management platform.



FIG. 5 is an exemplary embodiment of the predictive analysis conducted by the management platform in determining a threat level that signifies a degree of confidence that the detected IOCs are caused by a malicious electronic message.



FIG. 6 is an exemplary embodiment of a first response scheme that includes selection of different response levels by the management platform based on the determined threat level.



FIG. 7 is an exemplary embodiment of a second response scheme by the management platform upon determining specific threat levels for the detected IOCs.





DETAILED DESCRIPTION

Various embodiments of the disclosure relate to a platform and method for determining whether one or more indicators of compromise (IOCs) detected by a second customer (e.g., second source) have been caused by receipt of a malicious electronic message, even when no malicious electronic message has been directly observed by the second customer. More specifically, the platform is configured to conduct a predictive analysis that determines, based on a sufficient correspondence between IOCs detected by the second customer and IOCs associated with a particular malicious electronic message as detected and/or observed by one or more customers different than the second customer (e.g., a first source), whether the detected IOCs received from the second customer are caused by receipt of a malicious electronic message that is proximate in time and/or similar in content to the particular malicious electronic message.


According to one embodiment of the disclosure, a management platform receives anomalous behaviors, namely IOCs, from multiple customers having different security deployments. Herein, a first customer deploys at least a message analytic appliance that is specifically designed to protect against attacks delivered via malicious electronic messages such as email messages that includes a malicious attachment, a malicious text message, or the like. One example of a message analytic appliance is an email analytic appliance is a FireEye® EX™ security platform manufactured by FireEye, Inc. of Milpitas, Calif. The email analytic appliance performs an analysis on email messages directed to the first customer in efforts to determine whether there is a high probability of the email messages being part of a malicious attack.


Thereafter, the management platform qualifies heuristics associated with the IOCs from the second customer. In qualifying these heuristics, the management platform determines whether or not a triggering event has occurred, which causes a predictive analysis to be conducted on the detected IOCs from the second customer. According to one embodiment of the disclosure, the triggering event may include a significant increase or shift in volume of a given type of IOC by a particular (second) customer, where the increase or shift exceeds a prescribed threshold (e.g., a prescribed total number, a selected increase or decrease in number or percentage, etc.). The triggering event signifies to the management platform that the particular customer has a prescribed likelihood (e.g., greater than 50%, greater than 70%, or greater than 90%) that it is experiencing a malicious attack.


After qualifying heuristics associated with the detected IOCs from the second customer, the management platform conducts a predictive analysis that evaluates whether these detected IOCs correspond to a set (e.g., a sequence, a particular group, etc.) of IOCs associated with known malware of a first message type that has been detected by another (first) customer. This first message type may include electronic mail (email) messaging having a format in accordance with RFC 5322 or another email format, text messaging having a format in accordance with Short Message Service (SMS), or any other recognized or proprietary communication format. For instance, the IOCs associated with known malware of a first electronic message type may include (1) a set of IOCs associated with an email message that has been previously detected at the first customer as being malicious, (2) a set of IOCs associated with a text message that has been previously detected at the first customer as being malicious, or another type of transmission. Whether the detected IOCs correspond to the set of IOCs is based on a selected degree of correlation needed between the detected IOCs and the set of IOCs associated with known malware of the first message type, where the level of correlation may be static in nature or may vary dynamically based on desired warning trigger levels, current work load of the management platform, or the like. This degree of correlation may also be referred to as “degree of correspondence”.


Thereafter, once the detected IOCs are initially determined to be associated with malware of the first message type (e.g., a non-detected malicious electronic message such as a malicious email message, a malicious text message, a malicious global satellite positioning “GPS” message, website post message, etc.), the predictive analysis conducted by the management platform further determines a threat level, which signifies a level of confidence that the detected IOCs are caused by a malicious electronic message. The threat level may be based, at least in part, on the degree of correspondence determined by the management platform between the detected IOCs from the second customer and the set of IOCs associated with known malicious messages. Also, the threat level may be based on the manner in which the IOCs associated with the malicious electronic message(s) have been uncovered. As an example, the threat level may be based, at least in part, on the following: (1) similarity in type or order of the detected IOCs to the set of IOCs associated with the malicious electronic message; (2) whether the set IOCs associated with the malicious electronic message were detected or observed; (3) timing of the detected IOCs compared to the IOCs associated with the malicious electronic message; and/or (4) a sudden change in magnitude (e.g., number) of one or more of the detected IOCs compared to the level before the IOC(s) were detected in malicious electronic message at first customer.


For instance, as an illustrative embodiment, the predictive analysis is conducted to determine a threat level based on (i) a qualification of heuristics at the second customer, (ii) a determination of correspondence between detected IOCs from the second customer and IOCs associated with one or more known malicious electronic messages from the first customer, and/or (iii) a determination as to the manner in which the IOCs from the first customer (and perhaps other customers) were uncovered (e.g., detected and/or observed IOCs). Where the management platform determines that the IOC(s) provided by the second customer correspond to one or more IOCs detected by the first customer, a first threat level is assigned.


Similarly, upon determining that the IOC(s) provided by the second customer correspond to one or more IOCs observed by the first customer, the management platform assigns a second threat level. Given that the first customer is actually observing IOCs rather than detecting IOCs through virtual processing operations observed in a run-time environment such as may be established in a virtual machine running in a threat detection platform (and implemented in a host, endpoint, server, dedicated appliance or other electronic device), a greater threat level may be assigned.


Lastly, where the management platform determines that the IOC(s) provided by the second customer correspond to one or more IOCs observed by multiple customers, including the first customer, a third threat level is assigned. The third threat level may signify a malware campaign is being conducted.


In summary, an embodiment of the invention is directed to utilizing IOCs that are correlated with malware that has infected a first customer (e.g., first source) in efforts to determine, based on analysis of IOCs detected at second customer (e.g., a different source than the first source), a likelihood that identical malware or similar malware (e.g., of the same malware family or polymorphic malware) has also infected one or more network devices at the second customer. This likelihood may be classified according to a plurality of threat levels that may be the same as or differ from the measured likelihood by the first customer of the IOCs being associated with malware. These threat levels may be based on whether the IOCs were detected (e.g., through static analysis of an object under analysis or dynamic processing of the object in a run-time environment) or observed in network traffic in flight or content (e.g., files) at rest as monitored by the first customer. However, it is contemplated that the threat levels may be associated with any threshold of associated maliciousness risk or probability, which may be static (fixed) or dynamic (variable, e.g., based on prevailing conditions and/or user threat tolerance and user preference at a particular time), in order to provide the second customer with information as to the likelihood of one of more network devices being infected with a certain type of known malware.


I. Terminology


In the following description, certain terminology is used to describe aspects of the invention. For example, in certain situations, both terms “logic” and “engine” are representative of hardware, firmware and/or software that is configured to perform one or more functions. As hardware, logic (or engine) may include circuitry having data processing or storage functionality. Examples of such processing circuitry may include, but is not limited or restricted to one or more processors or processor cores; a programmable gate array; a microcontroller; an application specific integrated circuit; receiver, transmitter and/or transceiver circuitry; semiconductor memory; or combinatorial logic.


Logic (or engine) may be in the form of one or more software modules, such as executable code in the form of an executable application, an application programming interface (API), a subroutine, a function, a procedure, an applet, a servlet, a routine, source code, object code, a shared library/dynamic load library, or one or more instructions. These software modules may be stored in any type of a suitable non-transitory storage medium, or transitory storage medium (e.g., electrical, optical, acoustical or other form of propagated signals such as carrier waves, infrared signals, or digital signals). Examples of a “non-transitory storage medium” may include, but are not limited or restricted to a programmable circuit; non-persistent storage such as volatile memory (e.g., any type of random access memory “RAM”); persistent storage such as non-volatile memory (e.g., read-only memory “ROM”, power-backed RAM, flash memory, phase-change memory, etc.), a solid-state drive, hard disk drive, an optical disc drive, or a portable memory device; and/or a semiconductor memory. As firmware, the executable code is stored in persistent storage.


The term “message” generally refers to information transmitted in a prescribed format, where each message may be in the form of one or more packets or frames, a Hypertext Transfer Protocol (HTTP) based transmission, or any other series of bits having the prescribed format. For instance, a message may include an electronic message such as an electronic mail (email) message; a text message in accordance with a SMS-based or non-SMS based format; an instant message in accordance with Session Initiation Protocol (SIP); or a series of bits in accordance with another messaging protocol. The message may be part of a “flow,” namely a series of related packets that are communicated during a single communication session (e.g., Transport Control Protocol “TCP” session), between a source network device and a destination network device.


The term “malware” may be broadly construed as any information or action that is directed to adversely affect or disrupt operability of an electronic device, surreptitiously gather stored information and/or gain access to systems, or cause human interaction that results in unintended or unexpected outcomes. The malware may include an exploit that takes advantage of a software vulnerability, an advanced persistent threat (APT), or the like.


The term “transmission medium” is a physical or logical communication path within a network device such as an endpoint device, which is an electronic device with data processing and/or network connectivity such as, for example, a server; a stationary or portable computer including a desktop computer, laptop, electronic reader, netbook or tablet; a smart phone; a video-game console; wearable technology (e.g., watch phone, etc.). For instance, the communication path may include wired and/or wireless segments. Examples of wired and/or wireless segments include electrical wiring, optical fiber, cable, bus trace, or a wireless channel using infrared, radio frequency (RF), or any other wired/wireless signaling mechanism.


The term “computerized” generally represents that any corresponding operations are conducted by hardware in combination with software and/or firmware. Also, a “set” of items generally relates a plurality of items although, in some case, a set may be broadly defined as including a single item. One type of “set” is a “sequence” of items that feature a particular order of occurrence.


Lastly, the terms “or” and “and/or” as used herein are to be interpreted as inclusive or meaning any one or any combination. Therefore, “A, B or C” or “A, B and/or C” mean “any of the following: A; B; C; A and B; A and C; B and C; A, B and C.” An exception to this definition will occur only when a combination of elements, functions, steps or acts are in some way inherently mutually exclusive.


As this invention is susceptible to embodiments of many different forms, it is intended that the present disclosure is to be considered as an example of the principles of the invention and not intended to limit the invention to the specific embodiments shown and described.


II. General Architecture


Referring to FIG. 1, an exemplary block diagram of a communication network 100 deploying an embodiment of the invention is shown. Herein, the communication network 100 comprises a management platform 110 communicatively coupled to a plurality of customers 1201-120M (M≧2, M=2 for this embodiment) via a network 130. The network 130 may include a public network such as the Internet, a private network (e.g., a local area network “LAN”, wireless LAN, etc.), or a combination thereof. It is contemplated that the number and type of customers 1201-120M, which are communicatively coupled to the same management platform 110, may be selected based on a variety of parameters, including industry or agency type (e.g., technology, manufacturing, energy, health care, entertainment, financial services, banking, governmental, etc.); field type (e.g., electronic component manufacturing, Internet services, etc.); geographical location of the customer; and/or requested level of service. It is contemplated that the grouping of customers 1201-120M based on certain parameters may improve detection as some malicious attacks may be industry, field and/or geographic specific.


Herein, each customer 1201, . . . , or 120M may be broadly construed as a network-based entity, which includes one or more threat detection platforms (TDPs) where each TDP is configured to analyze information propagating into and/or from the network-based entity and upload one or more detected indicators of compromise (IOCs) destined for the management platform 110. The network-based entity may represent an organization, a subset of the organization (e.g. a subsidiary where different customers may be different subsidiaries that are part of the same parent organization, a division, group, etc.), a particular enterprise network, or the like.


According to one embodiment of the disclosure, as shown in FIG. 1, the first customer 1201 may include, at least in part, one or more threat detection platforms (TDPs), such as a first TDP 1401 and a second TDP 1402 for this embodiment. As shown, the first TDP 1401 is a network device that includes message analysis logic 150 and a second TDP 1402 is a network device operating as a web-based security appliance that includes network traffic analysis logic 160. Similarly, a second customer 1202 may include, at least in part, one or more threat detection platforms (TDPs), such as a third TDP 1403 in this embodiment.


As described below in detail, the message analysis logic 150 of the first TDP 1401 is configured to conduct a specific analysis of the content of a message of a first format type (e.g., email messages, text messages, etc.) transmitted and/or received over the network 130. Based on this analysis, the first TDP 1401 is capable of determining whether a malicious attack originated from a malicious electronic message and the particular malicious electronic message. The second network traffic analysis logic 160 of the second TDP 1402 is configured to conduct an analysis of information associated with network traffic over the network 130 in efforts to determine if this information suggests the presence of a malicious attack. But, without the first TDP 1401, the second TDP 1402 is unable to determine whether the origin of the malicious attack is from a malicious electronic message.


More specifically, according to one embodiment of the disclosure, the first TDP 1401 is deployed in a customer's public network (sometimes referred to as the “Demilitarized Zone” or “DMZ”), where email servers most often reside. Of course, the location of the TDP 1401 may vary, provided that the TDP 1401 has access to the communication path of the transmitted messages and is communicatively coupled to the management platform 110. For instance, the TDP 1401 could be deployed outside of customer's premises. For instance, where the message is a SMS message, the TDP 1401 could be deployed in a cell carrier network. Furthermore, the TDP 1401 may be part of cloud services, or even deployed within an endpoint device (e.g., smartphone, computer, etc.).


Herein, the message analysis logic 150 enables the first TDP 1401 to operate, at least in part, as an email analytic appliance by performing an analysis of one or more portions of an incoming email message, namely its header, content, links and/or attachments. This analysis may be performed by one or more virtual machines (hereinafter “virtual machine(s)” or “VM(s)” 170) deployed within the first TDP 1401. Each of the virtual machine(s) may be configured with a software profile, which corresponds to a particular message management application (e.g., Microsoft® Outlook, iPad™ native email application, native email application on Windows® Phone 8, etc.) that is being used by a network device deployed within the same enterprise network as the first TDP 1401. The virtual machine(s) may be configured to support concurrent virtual execution of a variety of different software configurations in efforts to verify that a malicious email message is part of a malicious attack.


The virtual machine(s), in combination with other logic (e.g., processing logic 175) within the first TDP 1401, are adapted to simulate the receipt and execution of content associated with the malicious email message within a run-time environment as expected by the email message. For instance, the processing logic 175 is configured to emulate and provide anticipated signaling to the virtual machine(s) during virtual processing.


As an example, the processing logic 175 may be adapted to provide, and sometimes modify, information (e.g., an Internet Protocol “IP” address, etc.) associated with an email message under analysis in order to control return signaling back to a virtual execution environment that includes the virtual machines. Hence, the processing logic 175 may suppress (e.g., discard) the return network traffic so that the return network traffic is not transmitted to the network 130.


Unlike the first TDP 1401, both the second TDP 1402 and the third TDP 1403 include network traffic analysis logic 160, which operates as a web-based security appliance by analyzing information associated with network traffic over the network 130 to determine if the information suggests the occurrence of a malicious attack. By itself without operability of the first TDP 1401, neither the second TDP 1402 nor the third TDP 1403 is able to determine the origin of the malicious attack. An illustrative example of the network traffic analysis logic 160 is illustrated as the MCD System in a prior U.S. Patent Application entitled “Dynamically Remote Tuning of Malware Content Detection System,” U.S. patent application Ser. No. 14/231,216 filed Mar. 31, 2014, the contents of which are incorporated by reference.


Referring still to FIG. 1, the management platform 110 is adapted to receive information from the plurality of customers 1201-120M, notably TDPs 1401-1403. As shown, the first TDP 1401 and the second TDP 1402 are associated with the first customer 1201 and the third TDP 1403 is associated with a second customer 1202. Upon receipt of information from the TDPs 1401-1403, the management platform 110 qualifies heuristics associated with the received information in order to determine if the received information indicates that a malicious attack is occurring. Of course, certain heuristics may be specifically selected for analysis during the qualification operations, as these specific heuristics may be directed to functionality normally targeted by a malware attack via a malicious email message. The “heuristics” may encompass rules, policies, statistics, signatures, hash values, or other determinative attributes or characteristics of received information under analysis, and thus, qualification of the heuristics involves analysis of the received information based on the heuristics.


As an illustrative example, after receipt of received information including indicators of compromise (IOCs), namely information associated with anomalous behaviors detected by network traffic analysis logic 160 within the TDP 1403, the management platform 110 qualifies the heuristics associated with the IOCs in order to determine whether a triggering event has occurred, which identifies that a malicious (email-based) attack may be occurring at the second customer 1202. For instance, the management platform 110 may determine whether a particular IOC-based threshold has been met (e.g., exceeds or falls below the threshold). As an example, the particular IOC-based threshold may be associated with an average number of a certain type of IOC detected by multiple TDPs with network traffic analysis logic (or perhaps TDP 1403 by itself) over a prescribed amount of time. This threshold is met if the detected IOCs are equal to or greater in number that the IOC average. Of course, other types of thresholds may be used, including a preselected number of total IOCs that may be dependent or independent of type, mere presence of a particular type of IOC, or the like.


If the IOC heuristics have been qualified, the management platform 110 conducts a predictive analysis associated with the detected IOCs received from the TDP 1403 to determine if these IOCs correspond to a set of IOCs associated with known malware of a first message type that are provided from the TDP 1401. For instance, the amount of similarity between the detected IOCs and the set of IOCs associated with the known malware of the first message type in order to determine whether the detected IOCs correspond to the set of IOCs may be static or dynamic in nature (e.g., the degree of correspondence between detected IOCs and the IOCs associated with the known malware may vary based on the operating state of the management platform 110). For instance, when the management platform 110 is operating in a first operating state, the degree of correspondence may be set at a high level where the detected IOCs need to be present and in the same chronological order as the set of IOCs associated with the known malware. Alternatively, when the management platform 110 is operating in a second operating state, the degree of correspondence may be set at a lower level where the detected IOCs correspond to the known malware IOCs if multiple (but not all) IOCs of the detected IOCs are present in the set of IOCs.


When the IOC heuristics have been qualified and the predictive analysis concludes, with a certain degree of confidence that the detected IOCs are associated with a malicious attack originating from a malicious email message, the management platform 110 determines a type of response. As an illustrative example, the management platform 110 may adjust the threat level, which is associated with the degree of confidence that the detected IOCs are caused by a malicious electronic message, based on whether the set of IOCs associated with the known malware of the first message type are detected by the TDP 1201 during static and/or virtual processing of the malicious electronic message or are actual observed behavior(s) by a network device communicatively coupled to the TDP 1403. Herein, actual observed behavior(s) are assigned a higher threat level than detected behavior(s). More details of the assignment of threat level are described in FIG. 6.


Referring now to FIG. 2A, a block diagram of an exemplary embodiment of the management platform 110 is shown. Herein, the management platform 110 includes processing circuitry 200 that are coupled to communication interface logic 210 via a first transmission medium 220. Communication interface logic 210 enables communications with customers 1201-120M, notably one or more TDP 1401-1403 deployed by the customers as shown in FIG. 1. According to one embodiment of the disclosure, communication interface logic 210 may be implemented as a physical interface including one or more ports for wired connectors. Additionally, or in the alternative, communication interface logic 210 may be implemented with one or more radio units for supporting wireless communications with other electronic devices.


As shown, processing circuitry 200 is further coupled to a data storage 230, IOC management logic 240, predictive analysis logic 250, alert generation logic 260 and remediation logic 270. According to one embodiment of the disclosure, the IOC management logic 240 is configured to acquire information associated with detected and/or observed anomalous behaviors (IOCs) from the customers 1201-120M, where the IOCs may be acquired based upon actions by security personnel manually controlling the maintenance platform 110 to obtain the IOCs in response to an event or an elapsed period of time. Alternatively, the IOCs from the customers 1201-120M may be received automatically in accordance with a periodic or aperiodic uploading of the IOCs. The uploading may be accomplished by a push, pull or polling technique in which the TDPs 1401-1403 are configured to automatically transmit the IOCs in response to an activity (e.g., detection of the triggering event that identifies that a malicious, email-based attack may be occurring) and/or expiration of an elapsed period of time.


Upon receiving IOCs from TDPs 1401-1403 shown in FIG. 1, the IOC management logic 240 stores the received IOCs within the data store 230, which may be organized to identify which IOCs are received from which customers and which IOCs are associated with known malware associated with a particular message type. For instance, the IOCs may be organized to identify which IOCs are associated with known malicious electronic messages, where these IOCs include the anomalous behaviors and/or metadata associated with the malicious electronic messages. Examples of the metadata may include the arrival time of the message and/or profile information associated with the recipient, which may include one or more of the following: geographical origin of the recipient, group membership, company type, industry type, or the like.


Thereafter, the IOC management logic 240 qualifies heuristics associated with the detected IOCs from the third TDP 1403 of FIG. 1 by determining whether a triggering event has occurred to denote that a malicious attack due to a non-detected malicious electronic message may be occurring at the second customer 1202. The triggering event activates predictive analysis logic 250, which causes a predictive analysis to be conducted on the detected IOCs from the second customer 1202 of FIG. 1. As described above, the triggering event may include an increase or shift in volume of a given type of IOC by a particular (second) customer that exceeds a prescribed threshold.


More specifically, the predictive analysis logic 250 conducts a predictive analysis that evaluates whether the detected IOCs from the second customer 1202 of FIG. 1 correspond to a set of IOCs associated with known malware of a first message type that has been detected by another customer (e.g., first customer 1201). For instance, the set of IOCs may be associated with a known type of malicious email message or a known type of malicious text message.


Thereafter, once the detected IOCs are initially determined to be associated with a non-detected malicious (email or text) message, the predictive analysis logic 250 further determines a threat level, which signifies a degree of confidence that the detected IOCs are caused by a malicious email message or a malicious text message. The threat level may be based, at least in part, on the degree of correspondence determined by the predictive analysis logic 250 between the detected IOCs from the second customer 1202 of FIG. 1 and the set of IOCs associated with known malicious electronic messages. Additionally, the threat level may be based on the manner in which the set of IOCs associated with the malicious electronic message(s) was uncovered, where observed IOCs provide a greater weighting and a higher threat level than detected IOCs and observations by multiple customers increase the threat level.


The alert generation logic 260 and the remediation logic 270 perform operations based, at least in part, on the determined threat level. For instance, in response to computation of a first threat level, the alert generation logic 260 may merely issue an alert to security personnel of the second customer. However, in response to computation of a first threat level, the alert generation logic 260 may generate multiple alerts, in which the alerts may be sent through different mediums (e.g., network email, text message, automated cellular telephone call, etc.). Also, the remediation logic 270 may operate to provide suggested actions to remediate the potential malicious email message (e.g., search email servers for email messages associated with a particular phrase in the subject line or originating from a particular domain, specific attachment, specific size, originated from a specific source IP or MAC address, arrival time within a particular time period (e.g., range in minutes, hours or days), block the potential malicious email message from being opened or processed, and/or automatically delete the potential malicious email message with or without user notification).


Referring now to FIG. 2B, a block diagram of an exemplary embodiment of a logical representation of the management platform 110 is shown. Herein, the management platform 110 includes processing circuitry 200 that are coupled to the communication interface logic 210 via the first transmission medium 220 as well as the data store 230 and persistent storage 280 via a second transmission medium 225.


According to one embodiment of the disclosure, persistent storage 280 may include (a) the IOC management logic 240; (b) the predictive analysis logic 250; (c) the alert generation logic 260; and (d) the remediation logic 270. Of course, when implemented partially or fully in hardware, one or more of these logic units could be implemented separately from each other.


Referring now to FIG. 3, an illustrative embodiment of the operations conducted by the management platform 110 of FIG. 1 for conducting a predictive analysis, based on IOCs provided from a first customer, to determine that a malicious attack is being conducted by a malicious electronic message on a second customer is shown. The management platform 110 receives and stores IOC information from a plurality of customers, including at least one set of IOCs associated with known malicious electronic message from the first customer and detected IOCs from the second customer (blocks 300 and 310).


Thereafter, the management platform qualifies heuristics associated with the detected IOCs from the second customer in order to establish evidence of a potential presence of a malicious electronic message of a first message type at the second customer (block 320). Thereafter, the management platform evaluates heuristics associated with selected IOCs, which may be part or all of the detected IOCs, and determines if the evaluated heuristics qualify for issuance of an alert message and/or remediation (blocks 330 and 340).


Referring to FIG. 4, a detailed embodiment of the operations conducted by the management platform as set forth in FIG. 3 for conducting predictive analysis is shown. The management platform 110 receives and stores IOC information from a plurality of customers, including at least one set of IOCs associated with known malicious electronic message from the first customer and detected IOCs from the second customer (blocks 400 and 410).


Thereafter, the management platform qualifies heuristics associated with the IOCs from the second customer by determining whether a triggering event has occurred that causes a predictive analysis to be conducted on the detected IOCs from the second customer (block 420). For instance, as an illustrative example, the triggering event may include a condition where the detected IOCs from the second customer indicate that a selected threshold has been met (e.g., a particular increase or decrease in volume of a given type or types of IOCs has occurred, etc.).


After determining that a triggering event has occurred, the management platform conducts a predictive analysis that evaluates whether these detected IOCs correspond to a set of IOCs associated with known malware of a first message type that has been detected by first customer (blocks 430 and 435). For instance, as an illustrative example, the ordering and content of the IOCs are compared with the set of IOCs.


Thereafter, once the detected IOCs are determined to correspond to the set of IOCs, a predictive analysis is conducted by the management platform to determine a threat level that signifies a degree of confidence that the detected IOCs are caused by a malicious electronic message (block 440). The threat level may be based, at least in part, on a qualification of heuristics at the second customer, such as the degree of correspondence determined by the management platform between the detected IOCs from the second customer and the set of IOCs associated with known malicious electronic messages. Also, the threat level may be based on the manner in which the IOCs associated with the malicious electronic message(s) were uncovered. As an example, the threat level may be based, at least in part, on the following: (1) similarity of the detected IOCs to the set of IOCs associated with the malicious electronic message; (2) whether the set IOCs associated with the malicious electronic message were detected or observed; and/or (3) timing of the detected IOCs compared to the IOCs associated with the malicious electronic message.


As an illustrative embodiment, as shown in FIG. 5, a first determination is made as to whether there is sufficient qualification of IOC heuristics at the second customer compared to IOCs detected at the first customer and associated with a malicious electronic message (block 500). If there are sufficient qualifications in that the detected IOCs of the second customer correspond to IOCs detected by the first customer, a first threat level is assigned (block 510). Otherwise, no threat level is assigned to signify that there is no apparent correspondence between the detected IOCs at the second customer and IOCs associated with a malicious electronic message.


Thereafter, a second determination is made as to whether there is sufficient qualification of IOC heuristics at the second customer compared to IOCs observed at the first customer and associated with a malicious electronic message (block 520). If there are sufficient qualifications in that the detected IOCs of the second customer correspond to IOCs observed by the first customer, a second threat level is assigned (block 530). Otherwise, the predictive analysis maintains that the detected IOCs from the second customer to the assigned first threat level.


Lastly, a third determination is made as to whether there is sufficient qualification of IOC heuristics at the second customer compared to IOCs observed at multiple customers, inclusive of the first customer (block 540). If there are sufficient qualifications in that the detected IOCs of the second customer correspond to IOCs observed by multiple customers including the first customer, a third threat level is assigned (block 550). Otherwise, the predictive analysis maintains that the detected IOCs from the second customer to the assigned second threat level.


Referring back to FIG. 4, a particular type of response is selected based on the determined threat level (block 450). For instance, in accordance with an illustrative embodiment shown in FIG. 6, after the management platform has determined the threat level associated with detected IOCs under analysis from the second customer (block 600), the threat level is used to determine the response type (blocks 610-650). More specifically, if the qualification results in a first threat level, a first level response is conducted (blocks 610 and 620). As an illustrative example, an alert message may be sent to security personnel associated with the second customer with information pertaining to a potential malicious email message that may be stored within one of its email servers.


Similarly, if the qualification results in a second threat level, a second level response is conducted (blocks 630 and 640). The second level response may be assigned higher urgency than the first level response. For example, an alert message may be sent to security personnel associated with the second customer with information pertaining to a potential malicious email message that may be stored within one of its email servers along with additional information including contact information for security personnel and/or marketing representatives associated with the management platform.


Otherwise, the qualification resulted in a third threat level, and thus, warrants that a third level response is conducted (block 650). The third level response may be assigned the highest urgency. For example, multiple alert messages may be sent to security personnel associated with the second customer with information pertaining to a potential malicious email message that may be stored within one of its email servers. These alert messages may be successive or through different mediums (e.g., email message, text message over a cellular network, etc.). Additionally, additional information including contact information for security personnel and/or marketing representatives associated with the management platform may be provided.


In lieu of transmitting messages to the customers as shown in FIG. 6, as an alternative embodiment, the particular type of response selected may be directed as to whether a report should be generated that provides aggregated data of potential malicious electronic messages that have not been detected by customers without an email analytic appliance. Herein, as shown in FIG. 7, the management platform determines threat levels for the detected IOCs associated with a plurality of customers without message analytic appliances (block 700). The data associated with the detected IOCs and corresponding threat levels are aggregated based on selected aggregation groups (block 710). These aggregation groups may be subsets or supersets of the grouping supported by the management platform. After aggregating the data associated with the detected IOC(s) and the corresponding threat level information, the management platform generates reports that provide such information according to the selected aggregation groups (block 720).


In the foregoing description, the invention is described with reference to specific exemplary embodiments thereof. It will, however, be evident that various modifications and changes may be made thereto without departing from the broader spirit and scope of the invention as set forth in the appended claims. For instance, the above-described analysis is applicable to electronic messages as well as other types of objects under analysis (e.g. Portable Document Format “PDF” documents, executables, web downloads, etc.).

Claims
  • 1. A computerized method for malware detection conducted by a management platform including processing circuitry and a data store, comprising: receiving a set of indicators of compromise (IOCs) from a first source for storage in the data store, the set of IOCs identified as being caused by a known malware associated with a first message type;receiving, for storage in the data store, one or more IOCs from a second source that is different from the first source where a cause of the one or more IOCs is unknown; andresponsive to a triggering event that includes a shift in volume of a given type of IOC at the second source that exceeds a prescribed threshold, conducting a predictive analysis by the processing circuitry of the one or more IOCs received from the second source to determine whether the received IOCs from the second source correspond to the set of IOCs received from the first source,wherein information associated with at least the set of IOCs is used to locate a malware associated with the first message type that is undetected at the second source and is the cause of the one or more IOCs at the second source.
  • 2. The computerized method of claim 1, wherein the set of IOCs caused by the known malware associated with the first message type includes a set of IOCs associated with an email message that has been previously detected at the first source as being malicious.
  • 3. The computerized method of claim 1, wherein the set of IOCs caused by the known malware associated with the first message type includes a set of IOCs associated with a text message that has been previously detected at the first source as being malicious.
  • 4. The computerized method of claim 1, wherein the triggering event associated with the shift in volume of a given type of IOC at the second source includes an increase in volume of the given type of IOC at the second source that exceeds the prescribed threshold.
  • 5. The computerized method of claim 1, wherein the conducting the predictive analysis of the one or more IOCs received from the second source to determine whether the one or more IOCs received from the second source correspond to the set of IOCs received from the first source comprises determining whether a prescribed number of the received IOCs are present in the set of IOCs associated with the known malware.
  • 6. The computerized method of claim 1, wherein the conducting the predictive analysis of the one or more IOCs received from the second source to determine whether the one or more IOCs received from the second source correspond to the set of IOCs received from the first source comprises determining whether the one or more IOCs received from the second source are present and in the same chronological order as the set of IOCs associated with the known malware.
  • 7. The computerized method of claim 1, wherein a degree of correspondence for determining whether the one or more IOCs received from the second source correspond to the set of IOCs received from the first source is dynamic.
  • 8. The computerized method of claim 1, wherein the determining whether the IOCs received from the second source correspond to the set of IOCs received from the first source further comprises determining a threat level associated with the one or more IOCs, the threat level signifies a degree of confidence that the one or more IOCs are caused by a malicious electronic message;selecting a particular type of response based on the determined threat level.
  • 9. The computerized method of claim 8, the threat level is determined based, at least in part, on whether the set of IOCs from the first source are detected or observed, where a determined correspondence between the one or more IOCs received from the second source and the set of IOCs that have been observed by the first source is assigned a higher threat level than a determined correspondence between the one or more IOCs received from the second source and the set of IOCs detected by the first source.
  • 10. The computerized method of claim 8, wherein the threat level is determined based, at least in part, on a timing of the one or more IOCs compared to a timing of the set of IOCs associated with the known malware that includes an identified malicious electronic message.
  • 11. The computerized method of claim 1, wherein the malware associated with the first message type that is undetected at the second source comprises a first malicious electronic message.
  • 12. The computerized method of claim 11, the information associated with at least the set of IOCs that is used to locate the first malicious electronic message comprises an arrival time of a second malicious electronic message detected at the first source.
  • 13. The computerized method of claim 11, the information associated with at least the set of IOCs that is used to locate the first malicious electronic message further comprises information associated with the one or more IOCs received from the second source that include one or more of (i) a geographical origin of the second source, (ii) a group membership of the second source, (iii) a company type of the second source, or (iv) a type of industry to which the second source belongs.
  • 14. The computerized method of claim 1, wherein the receiving of the set of IOCs from the first source and the receiving of the one or more IOCs from the second source comprises receiving the set of IOCs and the receiving of the one or more IOCs in transit over a network.
  • 15. The computerized method of claim 14, wherein the receiving of one or more IOCs is conducted automatically over a network.
  • 16. A system comprising: processing circuitry;a first logic in communication with the processing circuitry, the first logic is configured to (i) receive a set of indicators of compromise (IOCs) that are detected to have been caused by a known malware associated with a first message type from a first source, (ii) receive one or more IOCs from a second source that is different from the first source where a cause of the one or more IOCs is unknown, and (iii) determine whether a triggering event has occurred that signifies at least a prescribed likelihood that the one or more IOCs from the second source are caused by a undetected malicious electronic message present at the second source; anda second logic in communication with the processing circuitry, the second logic is configured to (i) conduct a predictive analysis that evaluates whether the received IOCs from the second source correspond to the set of IOCs caused by the known malware associated with the first message type, and (ii) determine a threat level, which signifies a level of confidence that the received IOCs from the second source are caused by the undetected malicious electronic message.
  • 17. The system of claim 16, wherein the set of IOCs associated with the known malware includes a set of IOCs associated with an electronic mail message that has been previously detected at the first source as being malicious.
  • 18. The system of claim 16, wherein the set of IOCs associated with the known malware includes a set of IOCs associated with a text message that has been previously detected at the first source as being malicious.
  • 19. The system of claim 16, wherein the second logic determines whether the received IOCs from the second source correspond to the set of IOCs received from the first source occurs in response to the triggering event.
  • 20. The system of claim 19, wherein the triggering event includes an increase in volume of a given type of IOC within the received IOCs from the second source event that exceeds a prescribed threshold.
  • 21. The system of claim 16, wherein the second logic evaluates whether the received IOCs from the second source correspond to the set of IOCs received from the first source by determining whether a particular number of the received IOCs from the second source are present and in the same chronological order as in the set of IOCs associated with the known malware.
  • 22. The system of claim 21, wherein a degree of correspondence for evaluating whether the received IOCs from the second source correspond to the set of IOCs received from the first source is dynamic.
  • 23. The system of claim 21, wherein the second logic, after determining the threat level, selects a particular type of response based on the determined threat level.
  • 24. The system of claim 23, wherein the second logic determines the threat level based, at least in part, on whether the set of IOCs from the first source is detected or observed, where a determined correspondence between the received IOCs and the set of IOCs that have been observed by the first source is assigned a higher threat level than the determined correspondence between the received IOCs and the set of IOCs detected by the first source.
  • 25. The system of claim 16, wherein the second logic determines the threat level based, at least in part, on a timing of the received IOCs compared to a timing of the set of IOCs, the first message type includes an electronic message.
  • 26. A system comprising: processing circuitry; anda memory coupled to the processing circuitry, the memory includes (1) logic that controls receipt of (a) a set of indicators of compromise (IOCs) from a first source and the set of IOCs are identified as being caused by a malicious electronic message of a first message type and (b) one or more IOCs from a second source that is different from the first source where a cause of the one or more IOCs is unknown,(2) logic that conducts a predictive analysis to determine whether the one or more IOCs from the second source are caused by an undetected malicious electronic message, the predictive analysis includes evaluating whether the one or more IOCs from the second source correspond to the set of IOCs associated with the malicious electronic message and determining a threat level, which signifies a level of confidence that the one or more IOCs from the second source are caused by the undetected malicious electronic message, and(3) logic that selects a particular type of response based on the determined threat level.
  • 27. The system of claim 26, wherein the set of IOCs associated with the known malware includes a set of IOCs associated with an electronic mail message that has been previously detected at the first source as being associated with the malicious electronic message.
  • 28. The computerized method of claim 27, wherein the first source is a network device that includes message analysis logic and the second source is a network device operating as a web-based security appliance.
  • 29. The system of claim 26, wherein the logic that conducts the predictive analysis to determine whether the received one or more IOCs from the second source correspond to the set of IOCs associated with the malicious electronic message performs the predictive analysis in response to a triggering event.
  • 30. The system of claim 29, wherein the triggering event includes an increase in volume of a given type of IOC within the received IOCs from the second source event that exceeds a prescribed threshold.
  • 31. The system of claim 26, wherein the logic that conducts the predictive analysis evaluating whether the one or more IOCs from the second source correspond to the set of IOCs associated with the malicious electronic message by determining whether a particular number of the one or more IOCs from the second source are present and in the same chronological order as in the set of IOCs associated with the malicious electronic message.
  • 32. The system of claim 31, wherein the particular number for evaluating whether the one or more IOCs from the second source correspond to the set of IOCs received from the first source is dynamic.
  • 33. The system of claim 26, wherein the logic that conducts the predictive analysis evaluating whether the one or more IOCs from the second source correspond to the set of IOCs associated with the malicious electronic message by determining the threat level based, at least in part, on a timing of the one or more IOCs compared to a timing of the set of IOCs, the first message type includes an electronic message.
  • 34. A computerized method for malware detection conducted by a network device including processing circuitry and a data store, comprising: receiving a set of indicators of compromise (IOCs) from a first source, the set of IOCs identified as being caused by a known malware associated with a first message type;receiving one or more IOCs from a second source that is different from the first source where a cause of the one or more IOCs is unknown; andconducting a predictive analysis of the one or more IOCs received from the second source to determine whether the received IOCs from the second source correspond to the set of IOCs received from the first source by (i) determining a threat level associated with the one or more IOCs, the threat level signifies a degree of confidence that the one or more IOCs are caused by a malicious electronic message, and (ii) selecting a particular type of response based on the determined threat level,wherein information associated with at least the set of IOCs is used to locate a malware associated with the first message type that is undetected at the second source and is the cause of the one or more IOCs at the second source.
  • 35. The computerized method of claim 34, wherein the set of IOCs includes a set of IOCs associated with an email message that has been previously detected at the first source as being malicious.
  • 36. The computerized method of claim 34, wherein the set of IOCs includes a set of IOCs associated with a text message that has been previously detected at the first source as being malicious.
  • 37. The computerized method of claim 34, wherein the conducting the predictive analysis of the one or more IOCs received from the second source to determine whether the received IOCs from the second source correspond to the set of IOCs received from the first source occurs in response to a triggering event.
  • 38. The computerized method of claim 37, wherein the triggering event includes an increase in volume of a given type of IOC at the second source that exceeds a prescribed threshold.
  • 39. The computerized method of claim 34, wherein the conducting the predictive analysis of the one or more IOCs received from the second source to determine whether the one or more IOCs received from the second source correspond to the set of IOCs received from the first source comprises determining whether a prescribed number of the received IOCs are present in the set of IOCs associated with the known malware.
  • 40. The computerized method of claim 34, wherein the conducting the predictive analysis of the one or more IOCs received from the second source to determine whether the one or more IOCs received from the second source correspond to the set of IOCs received from the first source comprises determining whether the one or more IOCs received from the second source are present and in the same chronological order as the set of IOCs associated with the known malware.
  • 41. The computerized method of claim 34, wherein a degree of correspondence for determining whether the one or more IOCs received from the second source correspond to the set of IOCs received from the first source is dynamic.
  • 42. The computerized method of claim 34, the threat level is determined based, at least in part, on whether the set of IOCs from the first source are detected or observed, where a determined correspondence between the one or more IOCs received from the second source and the set of IOCs that have been observed by the first source is assigned a higher threat level than a determined correspondence between the one or more IOCs received from the second source and the set of IOCs detected by the first source.
  • 43. The computerized method of claim 34, wherein the threat level is determined based, at least in part, on a timing of the one or more IOCs compared to a timing of the set of IOCs associated with the known malware that includes an identified malicious electronic message.
  • 44. The computerized method of claim 34, wherein the malware associated with the first message type that is undetected at the second source comprises a first malicious electronic message.
  • 45. The computerized method of claim 44, the information associated with at least the set of IOCs that is used to locate the first malicious electronic message comprises an arrival time of a second malicious electronic message detected at the first source.
  • 46. The computerized method of claim 34, wherein the first source is a network device that includes message analysis logic and the second source is a network device operating as a web-based security appliance.
  • 47. A computerized method for malware detection conducted by a network device including processing circuitry and a data store, comprising: receiving a set of indicators of compromise (IOCs) from a first source, the set of IOCs identified as being caused by a known malware associated with a first message type;receiving one or more IOCs from a second source that is different from the first source where a cause of the one or more IOCs is unknown; andconducting a predictive analysis of the one or more IOCs received from the second source to determine whether the received IOCs from the second source correspond to the set of IOCs received from the first source,wherein information including an arrival time of a malicious electronic message detected at the first source is used to locate a second malicious electronic message of the first message type that is undetected at the second source and is the cause of the one or more IOCs at the second source.
  • 48. The computerized method of claim 47, wherein the information associated with at least the set of IOCs that is used to locate the second malicious electronic message further comprises information associated with the one or more IOCs received from the second source that include one or more of (i) a geographical origin of the second source, (ii) a group membership of the second source, (iii) a company type of the second source, or (iv) a type of industry to which the second source belongs.
US Referenced Citations (489)
Number Name Date Kind
4292580 Ott et al. Sep 1981 A
5175732 Hendel et al. Dec 1992 A
5440723 Arnold et al. Aug 1995 A
5490249 Miller Feb 1996 A
5657473 Killean et al. Aug 1997 A
5842002 Schnurer et al. Nov 1998 A
5978917 Chi Nov 1999 A
6088803 Tso et al. Jul 2000 A
6094677 Capek et al. Jul 2000 A
6108799 Boulay et al. Aug 2000 A
6118382 Hibbs et al. Sep 2000 A
6269330 Cidon et al. Jul 2001 B1
6272641 Ji Aug 2001 B1
6279113 Vaidya Aug 2001 B1
6298445 Shostack et al. Oct 2001 B1
6357008 Nachenberg Mar 2002 B1
6417774 Hibbs et al. Jul 2002 B1
6424627 S.o slashed.rhaug et al. Jul 2002 B1
6442696 Wray et al. Aug 2002 B1
6484315 Ziese Nov 2002 B1
6487666 Shanklin et al. Nov 2002 B1
6493756 O'Brien et al. Dec 2002 B1
6550012 Villa et al. Apr 2003 B1
6700497 Hibbs et al. Mar 2004 B2
6775657 Baker Aug 2004 B1
6831893 Ben Nun et al. Dec 2004 B1
6832367 Choi et al. Dec 2004 B1
6895550 Kanchirayappa et al. May 2005 B2
6898632 Gordy et al. May 2005 B2
6907396 Muttik et al. Jun 2005 B1
6941348 Petry et al. Sep 2005 B2
6971097 Wallman Nov 2005 B1
6981279 Arnold et al. Dec 2005 B1
6995665 Appelt et al. Feb 2006 B2
7007107 Ivchenko et al. Feb 2006 B1
7028179 Anderson et al. Apr 2006 B2
7043757 Hoefelmeyer et al. May 2006 B2
7069316 Gryaznov Jun 2006 B1
7080407 Zhao et al. Jul 2006 B1
7080408 Pak et al. Jul 2006 B1
7093239 van der Made Aug 2006 B1
7096498 Judge Aug 2006 B2
7100201 Izatt Aug 2006 B2
7107617 Hursey et al. Sep 2006 B2
7159149 Spiegel et al. Jan 2007 B2
7213260 Judge May 2007 B2
7231667 Jordan Jun 2007 B2
7240364 Branscomb et al. Jul 2007 B1
7240368 Roesch et al. Jul 2007 B1
7243371 Kasper et al. Jul 2007 B1
7249175 Donaldson Jul 2007 B1
7287278 Liang Oct 2007 B2
7308716 Danford et al. Dec 2007 B2
7328453 Merkle, Jr. et al. Feb 2008 B2
7346486 Ivancic et al. Mar 2008 B2
7356736 Natvig Apr 2008 B2
7386888 Liang et al. Jun 2008 B2
7392542 Bucher Jun 2008 B2
7418729 Szor Aug 2008 B2
7428300 Drew et al. Sep 2008 B1
7441272 Durham et al. Oct 2008 B2
7448084 Apap et al. Nov 2008 B1
7458098 Judge et al. Nov 2008 B2
7464404 Carpenter et al. Dec 2008 B2
7464407 Nakae et al. Dec 2008 B2
7467408 O'Toole, Jr. Dec 2008 B1
7478428 Thomlinson Jan 2009 B1
7480773 Reed Jan 2009 B1
7487543 Arnold et al. Feb 2009 B2
7496960 Chen et al. Feb 2009 B1
7496961 Zimmer et al. Feb 2009 B2
7519990 Xie Apr 2009 B1
7523493 Liang et al. Apr 2009 B2
7530104 Thrower et al. May 2009 B1
7540025 Tzadikario May 2009 B2
7565550 Liang et al. Jul 2009 B2
7568233 Szor et al. Jul 2009 B1
7584455 Ball Sep 2009 B2
7603715 Costa et al. Oct 2009 B2
7607171 Marsden et al. Oct 2009 B1
7639714 Stolfo et al. Dec 2009 B2
7644441 Schmid et al. Jan 2010 B2
7657419 van der Made Feb 2010 B2
7676841 Sobchuk et al. Mar 2010 B2
7698548 Shelest et al. Apr 2010 B2
7707633 Danford et al. Apr 2010 B2
7712136 Sprosts et al. May 2010 B2
7730011 Deninger et al. Jun 2010 B1
7739740 Nachenberg et al. Jun 2010 B1
7779463 Stolfo et al. Aug 2010 B2
7784097 Stolfo et al. Aug 2010 B1
7836502 Zhao et al. Nov 2010 B1
7849506 Dansey et al. Dec 2010 B1
7854007 Sprosts et al. Dec 2010 B2
7869073 Oshima Jan 2011 B2
7877803 Enstone et al. Jan 2011 B2
7895657 Bennett Feb 2011 B2
7904959 Sidiroglou et al. Mar 2011 B2
7908660 Bahl Mar 2011 B2
7930738 Petersen Apr 2011 B1
7937761 Bennett May 2011 B1
7949849 Lowe et al. May 2011 B2
7996556 Raghavan et al. Aug 2011 B2
7996836 McCorkendale et al. Aug 2011 B1
7996904 Chiueh et al. Aug 2011 B1
7996905 Arnold et al. Aug 2011 B2
8006305 Aziz Aug 2011 B2
8010667 Zhang et al. Aug 2011 B2
8020206 Hubbard et al. Sep 2011 B2
8028338 Schneider et al. Sep 2011 B1
8042184 Batenin Oct 2011 B1
8045094 Teragawa Oct 2011 B2
8045458 Alperovitch et al. Oct 2011 B2
8056115 Treinen Nov 2011 B2
8069484 McMillan et al. Nov 2011 B2
8087086 Lai et al. Dec 2011 B1
8171553 Aziz et al. May 2012 B2
8176049 Deninger et al. May 2012 B2
8176480 Spertus May 2012 B1
8204984 Aziz et al. Jun 2012 B1
8214905 Doukhvalov et al. Jul 2012 B1
8220055 Kennedy Jul 2012 B1
8225373 Kraemer Jul 2012 B2
8233882 Rogel Jul 2012 B2
8234640 Fitzgerald et al. Jul 2012 B1
8234709 Viljoen et al. Jul 2012 B2
8239944 Nachenberg et al. Aug 2012 B1
8260914 Ranjan Sep 2012 B1
8266091 Gubin et al. Sep 2012 B1
8286251 Eker et al. Oct 2012 B2
8291496 Bennett Oct 2012 B2
8291499 Aziz et al. Oct 2012 B2
8307435 Mann et al. Nov 2012 B1
8307443 Wang et al. Nov 2012 B2
8312545 Tuvell et al. Nov 2012 B2
8321936 Green et al. Nov 2012 B1
8321941 Tuvell et al. Nov 2012 B2
8332571 Edwards, Sr. Dec 2012 B1
8365286 Poston Jan 2013 B2
8365297 Parshin et al. Jan 2013 B1
8370938 Daswani et al. Feb 2013 B1
8370939 Zaitsev et al. Feb 2013 B2
8375444 Aziz et al. Feb 2013 B2
8381299 Stolfo et al. Feb 2013 B2
8402529 Green et al. Mar 2013 B1
8464340 Ahn et al. Jun 2013 B2
8479174 Chiriac Jul 2013 B2
8479276 Vaystikh et al. Jul 2013 B1
8479291 Bodke Jul 2013 B1
8510827 Leake et al. Aug 2013 B1
8510828 Guo et al. Aug 2013 B1
8510842 Amit et al. Aug 2013 B2
8516478 Edwards et al. Aug 2013 B1
8516590 Ranadive et al. Aug 2013 B1
8516593 Aziz Aug 2013 B2
8522348 Chen et al. Aug 2013 B2
8528086 Aziz Sep 2013 B1
8533824 Hutton et al. Sep 2013 B2
8539582 Aziz et al. Sep 2013 B1
8549638 Aziz Oct 2013 B2
8555391 Demir et al. Oct 2013 B1
8561177 Aziz et al. Oct 2013 B1
8566946 Aziz et al. Oct 2013 B1
8584094 Dadhia et al. Nov 2013 B2
8584234 Sobel et al. Nov 2013 B1
8584239 Aziz et al. Nov 2013 B2
8595834 Xie et al. Nov 2013 B2
8627476 Satish et al. Jan 2014 B1
8635696 Aziz Jan 2014 B1
8682054 Xue et al. Mar 2014 B2
8682812 Ranjan Mar 2014 B1
8689333 Aziz Apr 2014 B2
8695096 Zhang Apr 2014 B1
8713631 Pavlyushchik Apr 2014 B1
8713681 Silberman et al. Apr 2014 B2
8726392 McCorkendale et al. May 2014 B1
8739280 Chess et al. May 2014 B2
8756693 Dube Jun 2014 B2
8776229 Aziz Jul 2014 B1
8782792 Bodke Jul 2014 B1
8789172 Stolfo et al. Jul 2014 B2
8789178 Kejriwal et al. Jul 2014 B2
8793787 Ismael et al. Jul 2014 B2
8805947 Kuzkin et al. Aug 2014 B1
8806647 Daswani et al. Aug 2014 B1
8832829 Manni et al. Sep 2014 B2
8850570 Ramzan Sep 2014 B1
8850571 Staniford et al. Sep 2014 B2
8881234 Narasimhan et al. Nov 2014 B2
8881282 Aziz et al. Nov 2014 B1
8898788 Aziz et al. Nov 2014 B1
8935779 Manni et al. Jan 2015 B2
8984638 Aziz et al. Mar 2015 B1
8990939 Staniford et al. Mar 2015 B2
8990944 Singh et al. Mar 2015 B1
8997219 Staniford et al. Mar 2015 B2
9009822 Ismael et al. Apr 2015 B1
9009823 Ismael et al. Apr 2015 B1
9027135 Aziz May 2015 B1
9071638 Aziz et al. Jun 2015 B1
9104867 Thioux et al. Aug 2015 B1
9106694 Aziz et al. Aug 2015 B2
9118715 Staniford et al. Aug 2015 B2
20010005889 Albrecht Jun 2001 A1
20010047326 Broadbent et al. Nov 2001 A1
20020018903 Kokubo et al. Feb 2002 A1
20020038430 Edwards et al. Mar 2002 A1
20020091819 Melchione et al. Jul 2002 A1
20020095607 Lin-Hendel Jul 2002 A1
20020116627 Tarbotton et al. Aug 2002 A1
20020144156 Copeland Oct 2002 A1
20020162015 Tang Oct 2002 A1
20020166063 Lachman et al. Nov 2002 A1
20020169952 DiSanto et al. Nov 2002 A1
20020184528 Shevenell et al. Dec 2002 A1
20020188887 Largman et al. Dec 2002 A1
20020194490 Halperin et al. Dec 2002 A1
20030074578 Ford et al. Apr 2003 A1
20030084318 Schertz May 2003 A1
20030101381 Mateev et al. May 2003 A1
20030115483 Liang Jun 2003 A1
20030188190 Aaron et al. Oct 2003 A1
20030191957 Hypponen et al. Oct 2003 A1
20030200460 Morota et al. Oct 2003 A1
20030212902 van der Made Nov 2003 A1
20030229801 Kouznetsov et al. Dec 2003 A1
20030237000 Denton et al. Dec 2003 A1
20040003323 Bennett et al. Jan 2004 A1
20040015712 Szor Jan 2004 A1
20040019832 Arnold et al. Jan 2004 A1
20040047356 Bauer Mar 2004 A1
20040083408 Spiegel et al. Apr 2004 A1
20040088581 Brawn et al. May 2004 A1
20040093513 Cantrell et al. May 2004 A1
20040111531 Staniford et al. Jun 2004 A1
20040117478 Triulzi et al. Jun 2004 A1
20040117624 Brandt et al. Jun 2004 A1
20040128355 Chao et al. Jul 2004 A1
20040165588 Pandya Aug 2004 A1
20040236963 Danford et al. Nov 2004 A1
20040243349 Greifeneder et al. Dec 2004 A1
20040249911 Alkhatib et al. Dec 2004 A1
20040255161 Cavanaugh Dec 2004 A1
20040268147 Wiederin et al. Dec 2004 A1
20050005159 Oliphant Jan 2005 A1
20050021740 Bar et al. Jan 2005 A1
20050033960 Vialen et al. Feb 2005 A1
20050033989 Poletto et al. Feb 2005 A1
20050050148 Mohammadioun et al. Mar 2005 A1
20050086523 Zimmer et al. Apr 2005 A1
20050091513 Mitomo et al. Apr 2005 A1
20050091533 Omote et al. Apr 2005 A1
20050091652 Ross et al. Apr 2005 A1
20050108562 Khazan et al. May 2005 A1
20050114663 Cornell et al. May 2005 A1
20050125195 Brendel Jun 2005 A1
20050149726 Joshi et al. Jul 2005 A1
20050157662 Bingham et al. Jul 2005 A1
20050183143 Anderholm et al. Aug 2005 A1
20050201297 Peikari Sep 2005 A1
20050210533 Copeland et al. Sep 2005 A1
20050238005 Chen et al. Oct 2005 A1
20050240781 Gassoway Oct 2005 A1
20050262562 Gassoway Nov 2005 A1
20050265331 Stolfo Dec 2005 A1
20050283839 Cowburn Dec 2005 A1
20060010495 Cohen et al. Jan 2006 A1
20060015416 Hoffman et al. Jan 2006 A1
20060015715 Anderson Jan 2006 A1
20060015747 Van de Ven Jan 2006 A1
20060021029 Brickell et al. Jan 2006 A1
20060021054 Costa et al. Jan 2006 A1
20060031476 Mathes et al. Feb 2006 A1
20060047665 Neil Mar 2006 A1
20060070130 Costea et al. Mar 2006 A1
20060075496 Carpenter et al. Apr 2006 A1
20060095968 Portolani et al. May 2006 A1
20060101516 Sudaharan et al. May 2006 A1
20060101517 Banzhof et al. May 2006 A1
20060117385 Mester et al. Jun 2006 A1
20060123477 Raghavan et al. Jun 2006 A1
20060143709 Brooks et al. Jun 2006 A1
20060150249 Gassen et al. Jul 2006 A1
20060161983 Cothrell et al. Jul 2006 A1
20060161987 Levy-Yurista Jul 2006 A1
20060161989 Reshef et al. Jul 2006 A1
20060164199 Gilde et al. Jul 2006 A1
20060173992 Weber et al. Aug 2006 A1
20060179147 Tran et al. Aug 2006 A1
20060184632 Marino et al. Aug 2006 A1
20060191010 Benjamin Aug 2006 A1
20060221956 Narayan et al. Oct 2006 A1
20060236393 Kramer et al. Oct 2006 A1
20060242709 Seinfeld et al. Oct 2006 A1
20060248519 Jaeger et al. Nov 2006 A1
20060248582 Panjwani et al. Nov 2006 A1
20060251104 Koga Nov 2006 A1
20060288417 Bookbinder et al. Dec 2006 A1
20070006288 Mayfield et al. Jan 2007 A1
20070006313 Porras et al. Jan 2007 A1
20070011174 Takaragi et al. Jan 2007 A1
20070016951 Piccard et al. Jan 2007 A1
20070033645 Jones Feb 2007 A1
20070038943 FitzGerald et al. Feb 2007 A1
20070064689 Shin et al. Mar 2007 A1
20070074169 Chess et al. Mar 2007 A1
20070094730 Bhikkaji et al. Apr 2007 A1
20070101435 Konanka et al. May 2007 A1
20070128855 Cho et al. Jun 2007 A1
20070142030 Sinha et al. Jun 2007 A1
20070143827 Nicodemus et al. Jun 2007 A1
20070156895 Vuong Jul 2007 A1
20070157180 Tillmann et al. Jul 2007 A1
20070157306 Elrod et al. Jul 2007 A1
20070168988 Eisner et al. Jul 2007 A1
20070171824 Ruello et al. Jul 2007 A1
20070174915 Gribble et al. Jul 2007 A1
20070192500 Lum Aug 2007 A1
20070192858 Lum Aug 2007 A1
20070198275 Malden et al. Aug 2007 A1
20070208822 Wang et al. Sep 2007 A1
20070220607 Sprosts et al. Sep 2007 A1
20070240218 Tuvell et al. Oct 2007 A1
20070240219 Tuvell et al. Oct 2007 A1
20070240220 Tuvell et al. Oct 2007 A1
20070240222 Tuvell et al. Oct 2007 A1
20070250930 Aziz et al. Oct 2007 A1
20070256132 Oliphant Nov 2007 A2
20070271446 Nakamura Nov 2007 A1
20080005782 Aziz Jan 2008 A1
20080028463 Dagon et al. Jan 2008 A1
20080032556 Schreier Feb 2008 A1
20080040710 Chiriac Feb 2008 A1
20080046781 Childs et al. Feb 2008 A1
20080066179 Liu Mar 2008 A1
20080072326 Danford et al. Mar 2008 A1
20080077793 Tan et al. Mar 2008 A1
20080080518 Hoeflin et al. Apr 2008 A1
20080086720 Lekel Apr 2008 A1
20080098476 Syversen Apr 2008 A1
20080120722 Sima et al. May 2008 A1
20080134178 Fitzgerald et al. Jun 2008 A1
20080134334 Kim et al. Jun 2008 A1
20080141376 Clausen et al. Jun 2008 A1
20080184373 Traut et al. Jul 2008 A1
20080189787 Arnold et al. Aug 2008 A1
20080201778 Guo et al. Aug 2008 A1
20080209557 Herley et al. Aug 2008 A1
20080215742 Goldszmidt et al. Sep 2008 A1
20080222729 Chen et al. Sep 2008 A1
20080263665 Ma et al. Oct 2008 A1
20080295172 Bohacek Nov 2008 A1
20080301810 Lehane et al. Dec 2008 A1
20080307524 Singh et al. Dec 2008 A1
20080313738 Enderby Dec 2008 A1
20080320594 Jiang Dec 2008 A1
20090003317 Kasralikar et al. Jan 2009 A1
20090007100 Field et al. Jan 2009 A1
20090013408 Schipka Jan 2009 A1
20090031423 Liu et al. Jan 2009 A1
20090036111 Danford et al. Feb 2009 A1
20090037835 Goldman Feb 2009 A1
20090044024 Oberheide et al. Feb 2009 A1
20090044274 Budko et al. Feb 2009 A1
20090064332 Porras et al. Mar 2009 A1
20090077666 Chen et al. Mar 2009 A1
20090083369 Marmor Mar 2009 A1
20090083855 Apap et al. Mar 2009 A1
20090089879 Wang et al. Apr 2009 A1
20090094697 Provos et al. Apr 2009 A1
20090113425 Ports et al. Apr 2009 A1
20090125976 Wassermann et al. May 2009 A1
20090126015 Monastyrsky et al. May 2009 A1
20090126016 Sobko et al. May 2009 A1
20090133125 Choi et al. May 2009 A1
20090144823 Lamastra et al. Jun 2009 A1
20090158430 Borders Jun 2009 A1
20090172815 Gu et al. Jul 2009 A1
20090187992 Poston Jul 2009 A1
20090193293 Stolfo et al. Jul 2009 A1
20090199296 Xie et al. Aug 2009 A1
20090228233 Anderson et al. Sep 2009 A1
20090241187 Troyansky Sep 2009 A1
20090241190 Todd et al. Sep 2009 A1
20090265692 Godefroid et al. Oct 2009 A1
20090271867 Zhang Oct 2009 A1
20090300415 Zhang et al. Dec 2009 A1
20090300761 Park et al. Dec 2009 A1
20090328185 Berg et al. Dec 2009 A1
20090328221 Blumfield et al. Dec 2009 A1
20100005146 Drako et al. Jan 2010 A1
20100011205 McKenna Jan 2010 A1
20100017546 Poo et al. Jan 2010 A1
20100031353 Thomas et al. Feb 2010 A1
20100037314 Perdisci et al. Feb 2010 A1
20100054278 Stolfo et al. Mar 2010 A1
20100115621 Staniford et al. May 2010 A1
20100180344 Malyshev et al. Jul 2010 A1
20100192223 Ismael et al. Jul 2010 A1
20100220863 Dupaquis et al. Sep 2010 A1
20100235831 Dittmer Sep 2010 A1
20100281541 Stolfo et al. Nov 2010 A1
20100281542 Stolfo et al. Nov 2010 A1
20100299754 Amit et al. Nov 2010 A1
20100306173 Frank Dec 2010 A1
20110004737 Greenebaum Jan 2011 A1
20110055907 Narasimhan et al. Mar 2011 A1
20110078794 Manni et al. Mar 2011 A1
20110093951 Aziz Apr 2011 A1
20110099620 Stavrou et al. Apr 2011 A1
20110099633 Aziz Apr 2011 A1
20110113231 Kaminsky May 2011 A1
20110145918 Jung et al. Jun 2011 A1
20110145920 Mahaffey et al. Jun 2011 A1
20110145934 Abramovici et al. Jun 2011 A1
20110167493 Song et al. Jul 2011 A1
20110167494 Bowen et al. Jul 2011 A1
20110173460 Ito et al. Jul 2011 A1
20110219449 St. Neitzel et al. Sep 2011 A1
20110219450 McDougal et al. Sep 2011 A1
20110225624 Sawhney et al. Sep 2011 A1
20110225655 Niemela et al. Sep 2011 A1
20110247072 Staniford et al. Oct 2011 A1
20110265182 Peinado et al. Oct 2011 A1
20110289582 Kejriwal et al. Nov 2011 A1
20110302587 Nishikawa et al. Dec 2011 A1
20110307954 Melnik et al. Dec 2011 A1
20110307955 Kaplan et al. Dec 2011 A1
20110307956 Yermakov et al. Dec 2011 A1
20110314546 Aziz et al. Dec 2011 A1
20120023593 Puder et al. Jan 2012 A1
20120054869 Yen et al. Mar 2012 A1
20120066698 Yanoo Mar 2012 A1
20120079596 Thomas et al. Mar 2012 A1
20120084859 Radinsky et al. Apr 2012 A1
20120110667 Zubrilin et al. May 2012 A1
20120117652 Manni et al. May 2012 A1
20120121154 Xue et al. May 2012 A1
20120124426 Maybee et al. May 2012 A1
20120174186 Aziz et al. Jul 2012 A1
20120174196 Bhogavilli et al. Jul 2012 A1
20120174218 McCoy et al. Jul 2012 A1
20120198279 Schroeder Aug 2012 A1
20120210423 Friedrichs et al. Aug 2012 A1
20120222121 Staniford et al. Aug 2012 A1
20120255015 Sahita et al. Oct 2012 A1
20120255017 Sallam Oct 2012 A1
20120260342 Dube et al. Oct 2012 A1
20120266244 Green et al. Oct 2012 A1
20120278886 Luna Nov 2012 A1
20120297489 Dequevy Nov 2012 A1
20120330801 McDougal et al. Dec 2012 A1
20130014259 Gribble et al. Jan 2013 A1
20130036472 Aziz Feb 2013 A1
20130047257 Aziz Feb 2013 A1
20130074185 McDougal et al. Mar 2013 A1
20130086684 Mohler Apr 2013 A1
20130097699 Balupari et al. Apr 2013 A1
20130097706 Titonis et al. Apr 2013 A1
20130111587 Goel et al. May 2013 A1
20130117852 Stute May 2013 A1
20130117855 Kim et al. May 2013 A1
20130139264 Brinkley et al. May 2013 A1
20130160125 Likhachev et al. Jun 2013 A1
20130160127 Jeong et al. Jun 2013 A1
20130160130 Mendelev et al. Jun 2013 A1
20130160131 Madou et al. Jun 2013 A1
20130167236 Sick Jun 2013 A1
20130174214 Duncan Jul 2013 A1
20130185789 Hagiwara et al. Jul 2013 A1
20130185795 Winn et al. Jul 2013 A1
20130185798 Saunders et al. Jul 2013 A1
20130191915 Antonakakis et al. Jul 2013 A1
20130196649 Paddon et al. Aug 2013 A1
20130227691 Aziz et al. Aug 2013 A1
20130246370 Bartram et al. Sep 2013 A1
20130263260 Mahaffey et al. Oct 2013 A1
20130291109 Staniford et al. Oct 2013 A1
20130298243 Kumar et al. Nov 2013 A1
20140033261 Evans et al. Jan 2014 A1
20140053260 Gupta et al. Feb 2014 A1
20140130158 Wang et al. May 2014 A1
20140137180 Lukacs et al. May 2014 A1
20140169762 Ryu Jun 2014 A1
20140179360 Jackson et al. Jun 2014 A1
20140328204 Klotsche et al. Nov 2014 A1
20140337836 Ismael Nov 2014 A1
20140351935 Shao et al. Nov 2014 A1
20150096025 Ismael Apr 2015 A1
Foreign Referenced Citations (10)
Number Date Country
2439806 Jan 2008 GB
2490431 Oct 2012 GB
0223805 Mar 2002 WO
02006928 Aug 2003 WO
2007117636 Oct 2007 WO
2008041950 Apr 2008 WO
2011084431 Jul 2011 WO
2011112348 Sep 2011 WO
2012075336 Jun 2012 WO
2013067505 May 2013 WO
Non-Patent Literature Citations (73)
Entry
Adobe Systems Incorporated, “PDF 32000-1:2008, Document management—Portable document format—Part1:PDF 1.7”, First Edition, Jul. 1, 2008, 756 pages.
Apostolopoulos, George; hassapis, Constantinos; “V-eM: A cluster of Virtual Machines for Robust, Detailed, and High-Performance Network Emulation”, 14th IEEE International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, Sep. 11-14, 2006, pp. 117-126.
Clark, John, Sylvian Lebianc,and Scott Knight. “Risks associated with usb hardware tuilan devices used by insiders.” Systems Conference (SysCon), 2011 IEEE International. IEEE, 2011.
FireEye Maiware Analyse & Exchange Network, Malware Protection System, FireEye Inc., 2010.
FireEye Malware Analysis, Modern Malware Forensics, FireEye Inc., 2010.
FireEye v.6.0 Security Target, pp. 1-35, Version 1.1, FireEye.Inc., May 2011.
Gibier, Clint, et al. AndroidLeaks: automatically detecting potential privacy leaks in android applications on a large scale. Springer Berlin Heidelberg, 2012.
Gregg Keizer: “Microsoft's HoneyMonkeys Show Patching Windows Works”, Aug. 8, 2005, XP055143386, Retrieved from the Internet: URL:https://web.archive.org/web/20121022220617/http://www.informationweek- .com/microsofts-honeymonkeys-show-patchinig-wi/167600716 [retrieved on Sep. 29, 2014].
Heng Yin et al, Panorama: Capturing System-Wide Information Flow for Maiware Detection and Analysis, Research Showcase @ CMU, Carnegie Mellon University, 2007.
Idika et al., A-Survey-of-Malware-Detection-Techniques, Feb. 2, 2007, Department of Computer Science, Purdue University.
Isohara, Takamasa, Keisuke Takemori, and Ayumu Kubota. “Kernel-based behavior analysis for android malware detection.” Computational Intelligence and Security (CIS), 2011 Seventh International Conference on IEEE, 2011.
Kevin A Rouridy et al: “Hybrid Analysis and Control of Malware”, Sep. 15, 2010, Recent Advances in Intrusion Detection, Springer Berlin Heidelberg, Berlin, Heidelberg, pp. 317-338, XP019150454 ISBN:978-3-642-15511-6.
Leading Colleges Select FireEye to Stop Malware-Related Data Breaches, FreEye Inc., 2009.
Li et al., A VMM-Based System Call Interposition Framework for Program Monitoring, Dec. 2010, IEEE 16th International Conference on Parallel and Distributed Systems, pp. 706-711.
Lindorfer, Martina, Clemens Kolbitsch, and Paolo Milani Comparetti. “Detecting environment-sensitive malware.” Recent Advances in Intrusion Detection. Springer Berlin Heidelberg, 2011.
Mori, Detecting Unknown Computer Viruses, 2004, Springer-Verlag Berlin Heidelberg.
Oberheide et al., CloudAV.sub.-N-Version Antivirus in the Network Cloud, 17th USENIX Security Symposium USENIX Security '08 Jul. 28-Aug. 1, 2008 San Jose, CA.
Wahid et al., Characterising the Evolution in Scanning Activity of Suspicious Hosts, Oct. 2009, Third International Conference on Network and System Security, pp. 344-350.
Yuhei Kawakoya et al: “Memory behavior-based automatic malware unpacking in stealth debugging environment”, Malicious and Unwanted Software (Malware), 2010 5th International Conference on, IEEE, Piscataway, NJ, USA, Oct. 19, 2010, pp. 39-46, XP031833827, ISBN:978-1-4244-8-9353-1.
Zhang et al., The Effects of Threading, Infection Time, and Multiple-Attacker Collaboration on Malware Propagation, Sep. 2009, IEEE 28th International Symposium on Reliable Distributed Systems, pp. 73-82.
“Network Security: NetDetector—Network Intrusion Forensic System (NIFS) Whitepaper”, (“NetDetector Whitepaper”), (2003).
“Packet”, Microsoft Computer Dictionary, Microsoft Press, (Mar. 2002), 1 page.
“When Virtual is Better Than Real”, IEEEXplore Digital Library available at, http://ieeexplore.ieee.org/xpl/articleDetails.jsp?reload=true&arnumbe-r=990073, (Dec. 7, 2013).
Abdullah et al., Visualizing Network Data for Intrusion Detection, 2005 IEEE Workshop on Information Assurance and Security, pp, 100-108.
Adetoye, Adedayo , et al., “Network Intrusion Detection & Response System”, (“Adetoye”), (Sep. 2003).
AltaVista Advanced Search Results. “attack vector identifier”. Http://www.altavista.com/web/results?ltag=ody&pg=aq&aqmode=aqa=Event+Orch-estrator . . . , (Accessed on Sep. 15, 2009).
AltaVista Advanced Search Results. “Event Orchestrator”. Http://www.altavista.com/web/results?ltag=ody&pg=aq&aqmode=aqa=Event+Orch-esrator . . . , (Accessed on Sep. 3, 2009).
Aura, Tuomas, “Scanning electronic documents for personally identifiable information”, Proceedings of the 5th ACM workshop on Privacy in electronic society, ACM, 2006.
Baecher, “The Nepenthes Platform: An Efficient Approach to collect Malware”, Springer-verlag Berlin Heidelberg, (2006), pp. 165-184.
Baidi, Mario; Risso, Fulvio; “A Framework for Rapid Development and Portable Execution of Packet-Handling Applications”, 5th IEEE International Symposium Processing and Information Technology, Dec. 21, 2005, pp. 233-238.
Bayer, et al. “Dynamic Analysis of Malicious Code”, J Comput Virol, Springer-Verlag, France., (2006), pp. 67-77.
Boubalos, Chris , “extracting syslog data out of raw pcap dumps, seclists.org, Honeypots mailing list archives”, available at http://seclists.org/honeypots/2003/q2/319 (“Boubalos”), (Jun. 5, 2003).
Chaudet, C. , et al., “Optimal Positioning of Active and Passive Monitoring Devices”, International Conference on Emerging Networking Experiments and Technologies, Proceedings of the 2005 ACM Conference on Emerging Network Experiment and Technology, CoNEXT '05, Toulousse, France, (Oct. 2005), pp. 71-82.
Cisco “Intrusion Prevention for the Cisco ASA 5500-x Series” Data Sheet (2012).
Cisco, Configuring the Catalyst Switched Port Analyzer (SPAN) (“Cisco”), (1992-2003).
Cohen, M.I. , “PyFlag—An advanced network forensic framework”, Digital investigation 5, Elsevier, (2008), pp. S112-S120.
Costa, M. , et al. “Vigilante: End-to-End Containment of Internet Worms”, SOSP '05, Association for Computing Machinery, Inc., Brighton U.K., (Oct. 23-26, 2005).
Crandall, J.R. , et al., “Minos:Control Data Attack Prevention Orthogonal to Memory Model”, 37th International Symposium on Micoarchitecture, Portland, Oregon, (Dec. 2004).
Deutsch, P. , “Zlib compressed data format specification version 3.3” RFC 1950, (1996).
Distler, “Malware Analysis: An Introduction”, SANS Institute InfoSec Reading Room, SANS Institute, (2007).
Dunlap, George W. , et al., “ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay”, Proceeding of the 5th Symposium on Operating Systems Design and Implementation, USENIX Association, (“Dunlap”), (Dec. 9, 2002).
Excerpt regarding First Printing Date for Menke Kaeo, Designing Network Security (“Kaeo”), (2005).
Filiol, Eric , et al “Combinatorial Optimisation of Worm Propagation on an Unknown Network”, International Journal of Computer Science 2.2 (2007).
Gael, et al., Reconstructing System State for Intrusion Analysis, Apr. 2001 SIGOPS Operating Systems Review, vol. 42 Issue 3, pp. 21-28.
Hjelmvik, Erik;, “Passive Network Security Analysis with NetworkMiner,”, (IN)Secure, Issue 18, (Oct. 2008), pp. 1-100.
IEEE Xplore Digital Library Sear Results for “detection of unknown computer worms”. Http//ieeexplore.ieee.org/searchresult.jsp?SortField=Score&SortOrder=desc- &ResultC . . . (Accessed on Aug. 28, 2009).
Kaeo, Merike “Designing Network Security”, (“Kaeo”), (Nov. 2003).
Kim, H. et al., “Autograph: Toward Automated, Distributed Worm Signature Detection”, Proceedings of the 13th Usenix Security Symposium (Security 2004), San Diego, (Aug. 2004), pp. 271-286.
Krasnyansky, Max , et al., Universal TUN/TAP driver, available at https://www.kernel.org/doc/Documentation/networking/tunlap.txt (2002) (“Krasnyansky”).
Kreibich, C. , et al., “Honeycomb-Creating Intrusion Detection Signatures Using Honeypots”, 2nd Workshop on Hot Topics in Networks (HotNets-11), Boston, USA, (2003).
Kristoff, J. , “Botnets, Detection and Mitigation: DNS-Based Technique”, NU Security Day, (2005), 23 pages.
Lijpenstam, Michael , et al., “Simulating Realistic Network Traffic for Worm Warning System Design and Testing”, Institute for Security Technology studies, Dartmouth College (“Liljenstam”), (Oct. 27, 2003).
Lok Kwong et al: “DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis”, Aug. 10, 2012, XP055158513, Retrieved from the Internet: URL:https://www.usenix.org/system/files/conference/usenixsecurty12/sec12-final107.pdf [retrieved on Dec. 15, 2014].
Marchette David . “Computer Intrusion Detection and Network Monitoring: A Statistical Viewpoint”, (“Marchette”), (2001).
Margolis P.E. “Random House Webster's ‘Computer & Internet Dictionary 3rd Edition’”, ISBN 0375703519, (Dec. 1998).
Moore, D. , et al., “Internet Quarantine: Requirements for Containing Self-Propagating Code”, INFOCOM, vol. 3, (Mar. 30-Apr. 3, 2003), pp. 1901-1910.
Morales, Jose A. et al., ““Analyzing and exploiting network behaviors of malware.””, Security and Privacy in Communication Networks. Springer Berlin Heidelberg, 2010. 20-34.
Natvig, Kurt , “SANDBOXII: Internet”, Virus Bulletin Conference, (“Natvig”), (Sep. 2002).
NetBIOS Working Group. Protocol Standard for a NetBIOS Service on a TCP/UDP transport: Concepts and Methods. STD 19, RFC 1001, Mar. 1987.
Newsome, J. , et al , “Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software”, In Proceedings of the 12th Annual Network and Distrbuted System Security, Symposium (NDSS '05), (Feb. 2005).
Newsome, J. , et al., “Polygraph: Automatically Generating Signatures for Polymorphic Worms” In Proceedings of the IEEE Symposium on Security and Privacy, (May 2005).
Nojiri, D. et al., “Cooperation Response Strategies for Large Scale Attack Mitigation”, DARPA Information Survivability Conference and Exposition, vol. 1, (Apr. 22-24, 2003), pp. 293-302.
Reiner Sailer, Enriquillo Valdez, Trent Jaeger, Roonald Perez, Leendert van Doorn, John Linwood Griffin, Stefan Berger., sHype: Secure Hypervisor Appraoch to Trusted Virtualized Systems (Feb. 2, 2005) (“Sailer”).
Silicon Defense, “Worm Containment in the Internal Network”, (Mar. 2003), pp. 1-25.
Singh S., et al., “Automated Worm Fingerprinting”, Proceedings of the ACM/USENIX Symposium on Operating System Design and Implementation, San Francisco, California, (Dec. 2004).
Spitzner, Lance, “Honeypots: Tracking Hackers”, (“Spizner”), (Sep. 17, 2002).
The Sniffers's Guide to Raw Traffic available at yuba.stanford.edu/.about.casado/pcap/section1.html, (Jan. 6, 2014).
Thomas H. Ptacek, and Timothy N. Newsham, “Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection”, Secure Networks, (“Ptacek”), (Jan. 1998).
US 8,171,553 filed Apr. 20, 2006, Inter Parties Review Decision dated Jul. 10, 2015.
US 8,291,499 filed Mar. 16, 2012, Inter Parties Review Decision dated Jul. 10, 2015.
Venezia, Paul, “NetDetector Captures Intrusions”, InfoWorld Issue 27, (“Venezia”), (Jul. 14, 2003).
Whyte, et al., “DNS-Based Detection of Scanning Works in an Enterprise Network”, Proceedings of the 12th Annual Network and Distributed System Security Symposium, (Feb. 2005), 15 pages.
Williamson, Matthew M., “Throttling Viruses: Restricting Propag tion to Defeat Malicious Mobile Code”, ACSAC Conference, Las Vegas, NV, USA, (Dec. 2002), pp. 1-9.