Verification and enhancement using detection systems located at the network periphery and endpoint devices

Description

FIELD OF THE INVENTION

The present invention relates generally to cyber security and more particularly to verifying and enhancing detection of a cyber-attack on a network.

BACKGROUND OF THE INVENTION

A cyber-attack may employ malware (malicious software), which may include a computer program or file that is harmful to a computer, computer network, and/or user. Conventional antivirus applications may be employed at computers, such as, for example, laptops and servers connectable as nodes (e.g., endpoints) of a network, to identify viruses and other malware using a signature-based approach. Antivirus applications identify malware using an antivirus engine that compares the contents of a file to a database of known malware signatures. Advanced malware often avoids detection by antivirus applications. Advanced malware is often polymorphic in nature, that is, changes its “fingerprint” while maintaining its central malicious functionality, thus avoiding matches against the signature database. Also, advanced malware is often custom-designed for use against targeted users, organizations or industries and not re-used against other targets. As such, targeted malware will often not match signatures of known generic malware. Given that advanced malware is able to circumvent conventional anti-virus analysis, this approach has been determined to be wholly deficient.

Another solution employs a malware detection system to identify malware at the network periphery. In some solutions, detection at the network periphery may utilize a conventional network intrusion detection system (IDS) often incorporated into network firewalls to compare signatures of known malware against traffic for matches while, in other solutions, a two-phase network security appliance (NSA) may be employed. The two-phase approach may compare in-bound network traffic against known characteristics of malware in a static analysis phase and identify malicious behaviors during execution of the content in a dynamic analysis phase.

Detection at the network periphery may be limited by the capability of the malware detection system for precise and effective detection without excessive false positives (wrongly identified attacks) on the one hand (such as is often the case with IDSs), and for timely analysis of behaviors of the network traffic to completely prevent network intrusion on the other (such as may be the case with some NSAs under certain circumstances). Furthermore, the analysis at the network periphery may not provide sufficient information about the particular target or targets (e.g., endpoints) within the network and the potential scope and severity of the attack.

Moreover, the proliferation of malware detection systems and security software has inundated network administrators with security alerts. Actionable intelligence may be buried within these security alerts; however, the sheer number of the alerts makes it difficult for network administrators to identify high priority alerts, a situation exacerbated by the presence of false positives. Moreover, the alerts may not contain sufficient information regarding the progression of the attack once inside the network. Accordingly, a network manager may be unable to identify whether a cyber-attack is in progress or has even occurred and to determine appropriate and timely actions to contain and remediate potential damage.

SUMMARY OF EMBODIMENTS OF THE INVENTION

Aspects of the invention reside in the interoperation of malware detection capabilities of a first network electronic device located for detection at a network periphery and a second network electronic device located for detection at a network node or endpoint device (an “endpoint device”) to verify the presence of a cyber-attack and otherwise to enhance malware detection. The first network electronic device may be embodied as a malware detection system (MDS), for example, an NSA, which receives inbound network traffic (or at least objects contained within the traffic) at the network periphery for analysis to identify those objects containing malware and thereby constituting cyber-attacks. For this purpose, embodiments of the MDS may include an object capture device at or near the periphery of the network and an object analysis component (locally or remotely situated, e.g., in the cloud) for detecting features (e.g., characteristics and/or behaviors) associated with malware. Analysis results of the MDS may be communicated to the endpoint device to guide or influence malware detection on-board the endpoint device. The results of malware detection by the MDS and the endpoint device (the respective “analysis results”) may be correlated to verify and enhance malware detection.

Correlation of the respective analysis results and classification of the object as malicious or benign may be performed by a security logic engine (“SLE”). This SLE may be implemented for example as part of the MDS or in a separate network device such as, for example, a security management console or system. More specifically, the SLE may verify a cyber-attack by synthesizing (combining) the analysis results of the MDS with the analysis results of at least one endpoint device though in many cases with a possibly large group of endpoint devices. The synthesis of the analysis results may enhance the detection of the cyber-attack by identifying further information of the attack.

For example, if an MDS operating at the periphery of a network determines an object contained in network traffic entering the network is likely malicious by analyzing the traffic and in particular the object, the MDS may communicate the results of the analysis to a SLE. In an embodiment, the MDS may utilize a static analysis logic (operable without executing the object) and a dynamic analysis logic (operable to perform behavioral analysis that involves executing the object) to generate analysis results. The SLE (which may be a component of the MDS in some embodiments) may combine the results of the static and dynamic analyses to classify the object as malicious or benign. In addition, to verify the cyber-attack identified by the MDS, an endpoint device (e.g., the endpoint device receiving the network traffic containing malicious object) may monitor the processing of the object during execution to identify characteristics and behaviors to enhance the MDS/SLE determination of maliciousness.

The endpoint device may be configured to monitor the behaviors of objects processed by the device with a view to identifying anomalous behaviors which may be indicative of malware. In an embodiment, the endpoint device processes, e.g., loads the object or otherwise executes the object during its normal operation (e.g. user-initiated processing of a document file, etc.). The endpoint device may collect “events,” that is, information regarding behaviors monitored during processing, and may communicate the events to a SLE to enhance cyber-attack detection. In some embodiments, the endpoint device may include a software agent that monitors the events and, in some embodiments, determines whether the events represent anomalous behaviors. Anomalous behaviors may include unexpected or undesired behaviors (e.g., file accesses, system resource accesses) or unwanted operations that would be acceptable in another context (e.g., locking access to the endpoint device). The endpoint device may communicate the events or just the anomalous behavioral information to the SLE logic for further correlation and classification of the object.

The SLE logic receives analysis results from the MDS and from one or more endpoint devices in the network to verify a cyber-attack by correlating the analysis results from the MDS against those of the one or more endpoint devices. The correlation may result in a threat score or other threat level of maliciousness. Where the correlation score or level exceeds a prescribed first threshold, the determination by the MDS of the object as malware is verified. In some embodiments, the SLE may alternatively or in addition correlate the analysis results from the MDS and the one or more endpoint devices with features associated with known malware to classify the object as malware (or re-classify the object as malware, where the MDS had originally classified the object as merely suspicious) where the correlation score or indicator exceeds a prescribed second threshold, which may be the same or different than the first threshold. Where the MDS determines the malicious object is associated with a select threat level or maliciousness score that level or score may be increased or decreased based on this additional correlation with the features of one or more endpoints and/or of known malware.

In some embodiments the SLE may seek classification of the object as malware as just described, and further, in some embodiments, classify the object as being part of a family of malware based on the combined features of the analysis results of the MDS and the one or more endpoint devices by correlating those analytical results against those of known malware families. Accordingly, this SLE may label the object with the name of a known malware and/or a known family of malware. In some cases, the SLE may extend a known family to encompass an additional malware by adding the features of the object under analysis to the malware family.

In an embodiment, the SLE may combine the analytical results from the MDS and the one or more endpoint devices to obtain further information regarding the nature and extent of a cyber-attack. For this, the SLE determines whether the analysis results from the endpoint device(s) reflect additional features of an attack, additional identification of vulnerable software running on the endpoint device(s) (beyond that running for example in a detection environment on the MDS), or other additional attack context (metadata). The attack context may also include, for example, the target (data, system or human) of the attack, the ultimate purpose of the attack (e.g., data exfiltration), a timestamp indicating when a detection was made at the MDS and each endpoint device, etc. By correlating analytical results from a plurality of endpoint devices, the SLE may determine one or more of the following: hallmarks of related attacks on the network, spreading of malware (infection/compromise) from one endpoint device to another (lateral spread), patient zero (the first endpoint device infected, which may or may not be the destination of the network traffic containing the object), whether the attack represents an Advanced Persistent Threat (APT) or other kind of targeted attack, and/or network or device vulnerable to the cyber-attack. In some embodiments, the SLE may trace the spread of an infection through a network by, for example, comparing the timestamps of verified malicious objects. The compared timestamps of verified malicious objects may be mapped chronologically to identify the patient-zero.

The SLE may issue an alert, e.g., over a network, to a security administrator based on verification of a cyber-attack. The alert may include information providing an assessment of the risk posed by the cyber-attack, information regarding the features of malware involved in the cyber-attack, identification of the endpoint device or devices involved in the attack, and related information such as the software executing on the endpoint device found to be affected or vulnerable. In some embodiments, the SLE alert may enhance or modify information contained in an alert previously issued by the malware detection system and/or endpoint device based on the synthesis of the results.

In some embodiments, the MDS or SLE may communicate to an endpoint device receiving the malicious object (e.g., the endpoint device that was the original destination of the network traffic containing the object) to provide information regarding detected malware features and other attack context (including, for example, indicators of compromise (IOCs)). For example, the MDS or SLE may provide the attack context including IOCs to monitoring logic of an agent on the endpoint device to configure and improve monitoring capabilities of the endpoint device during processing of the object. The MDS or SLE may provide all or a select portion of the attack context, and may do so automatically and, in some embodiments, selectively when a threat level or maliciousness score exceeds a threshold. The configuration of the monitoring logic of the agent may enable or disable select monitoring in the endpoint device, for example, to focus detection on the features (e.g., statically identified characteristics and/or behaviors of the object) identified by the MDS or SLE. The agent may also cause priority or expedited communication to the SLE of detected suspicious or malicious behavior in response to the received attack context, e.g., rather than awaiting polling by the SLE or other periodic reporting. To that end, embodiments advantageously employ a configurable agent, e.g., an agent with multiple or adaptable monitoring functions.

In some embodiments the features collected by the MDS and endpoint device(s) may be used to determine cyber vulnerability, including vulnerability of the network and/or of specific endpoint devices within the network. To that end, embodiments may collect information regarding an attack from a group of endpoint devices, for example, distributed across the network, and correlate that information with the information from the MDS. The collection may be made directly from the endpoint devices themselves or indirectly, such as via a conventional Security Information and Event Manager (STEM) that aggregates the results from the endpoint devices. Moreover, embodiments may collect attack information from endpoint devices running the same software (software profile) as that used by a detection environment of the MDS to detect the attack, and/or may run different software to scope the range of software susceptible or vulnerable to the attack. Moreover, by correlating the collected features with known malware or known malware families, a malicious object may be classified and labeled with the malware name and/or as being part of a named malware family. The MDS or SLE may determine the software configuration(s) susceptible to the malware or malware family. The system may identify endpoint devices vulnerable to the malware or malware family and initiate or transmit an alert, for example, an email, text or other communication signal, to a security administrator referencing those endpoint devices.

In some embodiments, when a threat to the network is identified, the system may issue a special action alert to devices on the network to instigate preventive or remedial action, such as to block or terminate processing of a known malicious object. By terminating processing of the known malicious object, the system may prevent lateral propagation of the malicious object, e.g. the malicious object moving from one endpoint device to another endpoint device. To further prevent lateral propagation, the system may instruct a potentially compromised endpoint device to block select outbound communications, such as those over select network ports.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and further advantages of the embodiments herein may be better understood by referring to the following description in conjunction with the accompanying drawings in which like reference numerals indicate identically or functionally similar elements, of which:

FIG. 1 is a block diagram of a network environment in accordance with one or more embodiments described herein;

FIG. 2 is a block diagram of an endpoint device architecture in accordance with one or more embodiments described herein;

FIG. 3 is a block diagram of a malware detection system (MDS) in accordance with one or more embodiments described herein;

FIG. 4 is a block diagram of a security logic engine in accordance with one or more embodiments described herein;

FIG. 5 is a flowchart of an exemplary method for cyber-attack verification in accordance with one or more embodiments described herein; and

FIG. 6 is a flowchart of an exemplary method to configure improved techniques for enhanced cyber-attack detection in accordance with one or more embodiments described herein.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1 is a block diagram of a network environment 100 that may be advantageously used with one or more embodiments described herein. The network environment 100 may be organized as a plurality of networks, such as a public network 110 and/or a private network 120 (e.g., an organization or enterprise network). According to this embodiment, the public network 110 and the private network 120 are communicatively coupled via network interconnects 130, and provide network connectivity and communication to intermediary computing devices 140, such as network switches, routers and/or firewalls, one or more endpoint device(s) 200, a malware detection system (MDS) 300 and a security logic engine 400.

The intermediary computing devices 140 communicate by exchanging packets or messages (i.e., network traffic) according to a predefined set of protocols, such as the Transmission Control Protocol/Internet Protocol (TCP/IP). However, it should be noted that other protocols, such as the HyperText Transfer Protocol Secure (HTTPS) for example, may be advantageously used with the inventive aspects described herein. In the case of private network 120, the intermediary computing device 140 may include a firewall or other computing device configured to limit or block certain network traffic in an attempt to protect the endpoint devices 200 from unauthorized users and attacks. The endpoint device 200 is communicatively coupled with the security logic engine 400 by the network interconnects 130, and may provide metadata monitored and stored by the endpoint device 200 to the security logic engine 400. The malware detection system 300, security logic engine 400, and optionally one or more intermediary network device 140 are similarly connected by interconnects 130.

As illustrated in FIG. 2 in greater detail, the endpoint device 200 has physical hardware including hardware processors 210, network interface(s) 220, a memory 230, a system interconnect 270, and optionally, a user interface 290. The memory 230 may contain software comprising an operating system (OS) 240, one or more applications 265, an agent 250, event processing and filtering logic 257, and, in some embodiments, an endpoint device classifier 260. The physical hardware (e.g. hardware processors 210, network interfaces(s) 220, memory 230) may be connected for communication by the system interconnect 270, such as a bus. Generally speaking, an endpoint device 200 is a network-connected electronic device, such as a general purpose personal computer, laptop, smart phone, tablet or specialized device such as point of sale (POS) terminal and server.

The hardware processor 210 is a multipurpose, programmable device that accepts digital data as input, processes the input data according to instructions stored in its memory, and provides results as output. One example of the hardware processor 210 is an Intel® microprocessor with its associated instruction set architecture, which is used as a central processing unit (CPU) of the endpoint device 200. Alternatively, the hardware processor 210 may include another type of CPU, a digital signal processor (DSP), an application specific integrated circuit (ASIC), or the like.

The network device(s) 280 may include various input/output (I/O) or peripheral devices, such as a storage device, for example. One type of storage device may include a solid state drive (SSD) embodied as a flash storage device or other non-volatile, solid-state electronic device (e.g., drives based on storage class memory components). Another type of storage device may include a hard disk drive (HDD). Each network device 280 may include one or more network ports containing the mechanical, electrical and/or signaling circuitry needed to connect the endpoint device 200 to the private network 120 to thereby facilitate communications over the system network 100. To that end, the network interface(s) 220 may be configured to transmit and/or receive messages using a variety of communication protocols including, inter alia, TCP/IP and HTTPS. The terms “or” and “and/or” as used herein are to be interpreted as inclusive or meaning any one or any combination. Therefore, “A, B or C” or “A, B and/or C” mean “any of the following: A; B; C; A and B; A and C; B and C; A, B and C.” An exception to this definition will occur only when a combination of elements, functions, steps or acts are in some way inherently mutually exclusive.

The memory 230 may include a plurality of locations that are addressable by the hardware processor 210 and the network interface(s) 220 for storing software (including software applications) and data structures associated with such software. The hardware processor 210 is adapted to manipulate the stored data structures as well as execute the stored software, which includes an operating system (OS) 240, one or more applications 265, an agent 250, and an endpoint device classifier 260.

The operating system (OS) 240 is software that manages hardware (e.g., hardware processors 210, network interface(s) 220, memory 230, network device(s) 280, etc.), software resources, and provides common services for computer programs, such as applications 265. For hardware functions such as input and output (I/O) and memory allocation, the operating system 240 acts as an intermediary between applications 265 and the computer hardware, although the application code is usually executed directly by the hardware and frequently makes system calls to an OS function or be interrupted by it.

The agent 250 is an executable software component configured to monitor the behavior of the applications 265 and/or operating system 240. The agent 250 may be configured to monitor (via monitoring logic 255), and store metadata (e.g., state information, memory accesses, process names, time stamp, etc.) associated with content executed at the endpoint device and/or behaviors (sometimes referred to as “events”) that may be associated with processing activity. Events are behaviors of an object that are processed by one of the user mode processes and are monitored by the agent 250. Examples of these events may include information associated with a newly created process (e.g., process identifier, time of creation, originating source for creation of the new process, etc.), information about the type and location of certain data structures, information associated with an access to certain restricted port or memory address, or the like. The agent 250 may also retrieve and communicate off the endpoint device 200 to a remote electronic device such as the SLE 400 context information such as the contents of the endpoint device's memory or hard drive, and could potentially be configured to modify the contents, such as state information. Moreover, the monitoring logic 255 may be configurable so as to enable or disable the monitoring of select behaviors, activities or processes. In some embodiments, the agent 250 may include an event processing and filtering logic 257, which, for example, applies heuristics, rules or other conditions to the monitored behaviors, to identify anomalous or unexpected behaviors. The processing and filtering logic 257, in some embodiments, may scan content being processed for matches with indicators (signatures). Also, in some embodiments, the agent 250 is configured to provide the events including the metadata to the endpoint device classifier 260 so as to classify the behaviors as suspicious or even malicious. Further information regarding an embodiment of an agent may be had with reference to U.S. Pat. No. 8,949,257 issued Feb. 3, 2015, entitled “Method and System for Collecting and Organizing Data Corresponding to an Event,” the full disclosure of which being incorporated herein by reference.

The agent 250 may receive from the security logic engine 400 and/or malware detection system 300 a communication identifying a malicious object for elevated monitoring or certain specified behaviors, activities or processes to monitor. The communication identifying the malicious object may, by way of example, include a signatures (“fingerprint”), indicators, and/or patterns or sequences of behaviors. Elevated monitoring of the suspicious object may include modifying system settings or configuring the agent 250. System setting modification may include activating additional system monitors (via the monitoring logic 255) to further observe suspicious object execution and expediting communications of detection results to the SLE.

The agent 250 may provide metadata related to the monitored behaviors to the endpoint device classifier or classification engine 260 for classification of an object, e.g., as to threat level. The threat level may be indicated by the classifier 260 in any of various ways, such as indicating the object as malicious or suspicious, where “suspicious” imports less certainty or a lower threat level than a classification of “maliciousness.” The agent 250 and classifier 260 may cooperate to analyze and classify certain observed behaviors of the object, based on monitored events, as indicative of malware. The classifier 260 may also be configured to classify the monitored behaviors as expected and unexpected/anomalous, such as memory access violations, in comparison with behaviors of known malware and known benign content as identified through the use of machine learning techniques and experiential knowledge.

In some embodiments, the agent 250 may utilize rules and heuristics to identify the anomalous behaviors of objects processed by the endpoint device 200. Examples of an anomalous behavior may include a communication-based anomaly, such as an unexpected attempt to establish a network communication, unexpected attempt to transfer data (e.g., GPS data or other location data resulting in a privacy violation, contact lists, etc.), or an anomalous behavior may include an execution anomaly, for example, an unexpected execution of computer program code, an unexpected Application Programming Interface (API) function call, an unexpected alteration of a registry key, or the like. The endpoint device monitoring rules may updated to improve the monitoring capability of the agent 250.

The endpoint device monitoring rules may be periodically or aperiodically updated, with the updates received by the agent 250 from the malware detection system 200 and/or the security logic engine 400. The update may include new or modified event monitoring rules and may set forth the behaviors to monitor. The monitoring logic 255 may be configured to implement the monitoring rules received by the endpoint device agent 250. For example, the agent 250 may be updated with new behavioral monitoring rules which may be provided to the monitoring logic 255, the monitoring logic configures the monitors with the monitoring rules received by the agent 250 for a certain running process or certain application 265, for example, to monitor for spawned additional processes. Alternatively, the behavioral monitoring rules may be received by the endpoint device 200 in response to a request from the endpoint device 200 to determine whether new rules are available, and in response, the new rules are downloaded by the endpoint device 200, provided to the agent 250, used to configure the monitoring logic 255.

In some embodiments an endpoint device 200 may include a separate user interface 290. The user interface 290 may produce a graphical or textual based representation to a user of the endpoint device 200. The user interface 290 provides the user with the ability to interact with the computer. The user interface 290 may not be present for an endpoint device that is not dedicated to a single user or does not require the interaction with a user.

Malware Detection System

Referring now to FIG. 3, the malware detection system 300 can be implemented as a network security appliance. As used herein, an appliance may be embodied as any type of general-purpose or special-purpose computer, including a dedicated computing device, adapted to implement a variety of software architectures relating to exploit and malware detection and related functionality. The term “appliance” should therefore be taken broadly to include such arrangements, in addition to any systems or subsystems configured to support such functionality, whether implemented in one or more network computing devices or other electronic devices, equipment, systems or subsystems. Generally speaking, the malware detection system 300 may be implemented as one or more network-connected electronic devices, which each includes physical hardware comprising hardware processor(s), network interface(s), a memory, a system interconnect, an optional user interface, a system interconnect, which may be arranged and organized as shown in FIG. 2. Accordingly, each of the components of the malware detection system 300 shown in FIG. 3 and described below may be implemented as one or more computer programs or modules executable on one or more processors and stored in memory.

As thus embodied, the malware detection system 300 includes a network interface(s) 310, a static analysis logic 320 comprising at least an indicator scanner 330, and a heuristics engine 335, a dynamic analysis logic 340 comprising at least a scheduler 350, a store of software profiles 355, and one or more virtual machine(s) 360, an event database and logic 362, a classifying engine 380, an indicator generator 385, and a reporting engine 390. The malware analysis may involve static, dynamic and/or an optional emulation analysis, as generally described in U.S. Pat. No. 9,223,972, the entire contents of which are incorporated by reference.

The network interface(s) 310 may receive and capture network traffic transmitted from multiple devices without appreciably affecting the performance of the private network 120 or the devices coupled to the private network 120. In one embodiment, the malware detection system 300 may capture objects contained in network traffic using the network interface(s) 310, make a copy of the objects, pass the objects to the appropriate endpoint device(s) 200 and pass the copy of the objects to the static analysis logic 320 and/or the dynamic analysis logic 340. In another embodiment, the malware detection system 300 may capture the objects using the network interface(s) 310 and pass the objects to the static analysis logic 320 and/or the dynamic analysis logic 340 for processing prior to passing the objects to the appropriate endpoint device(s) 200. In such an embodiment, sometimes called a “blocking deployment,” the objects will only be passed to the appropriate endpoint device(s) 200 (e.g., the destination of the network traffic as identified in network traffic packets) if the analysis of the objects does not indicate that the objects are associated with malicious, anomalous and/or unwanted characteristics and/or behaviors.

The network interface(s) 310 and static analysis logic 320 may be located at the periphery of the private network 120. The periphery of a private network 120 may be located at or near the interconnect(s) 130 between the private network 120 and other networks, e.g., behind a firewall (not shown) on the private network 120. For example, the network interface(s) 310 and static analysis logic 320 components of the malware detection system are located at the private network periphery while the dynamic analysis logic 340, scoring logic (scorer) 370, classifying engine (classifier) 380, indicator generator 385 and reporting engine 390 are each located on a remote server on the private network 120 or on a public network 110 connected to the private network 120 via interconnects 130. Alternatively, all of these components may be co-located at or near the periphery of the private network 120.

The static analysis logic 320 may receive the network traffic to then extract the objects and related metadata, or may receive the objects and related metadata from the network interface(s) 310 already extracted. The term “object” generally refers to a collection of data, whether in transit (e.g., over a network) or at rest (e.g., stored), often having a logical structure or organization that enables it to be classified for purposes of analysis. The static analysis logic 320 may provide the objects to the indicator scanner 330 to identify if the objects match known indicators of malware. The term “indicator” (or “signature”) designates a set of characteristics and/or behaviors exhibited by one or more malware that may or may not be unique to the malware. Thus, a match of the signature may indicate to some level of probability that an object constitutes malware. In some contexts, those of skill in the art have used the term “signature” as a unique identifier or “fingerprint.” For example, a specific malware or malware family, may be represented by an indicator which is generated, for instance, as a hash of its machine code, and that is a special sub-case for purposes of this disclosure. The indicator scanner 330 may incorporate, in memory (not separately shown), a database of known malware indicators. The database of known malware indicators may be updated by receiving through the network interface(s) 310 from the public network 110 or the private network 120, via network interconnects 130, new indicators of malware. The database of indicators may also be updated by the indicator generator 385.

The heuristics engine 335 determines characteristics of the objects and/or network traffic, such as formatting or patterns of their content, and uses such characteristics to determine a probability of maliciousness. The heuristic engine 335 applies heuristics and/or probability analysis to determine if the objects might contain or constitute malware. Heuristics engine 335 is adapted for analysis of certain portions of the network traffic under analysis (e.g., the object may include a binary file) to determine whether a portion corresponds to either: (i) a “suspicious” identifier such as either a particular Uniform Resource Locator “URL” that has previously been determined as being associated with known malware, a particular source or destination (IP or MAC) address that has previously been determined as being associated with known malware; or (ii) a particular malware pattern. The heuristics engine 335 may be adapted to perform comparisons of an object under analysis against one or more pre-stored (e.g., pre-configured and/or predetermined) attack patterns stored in memory (not shown). The heuristics engine 335 may also be adapted to identify deviations in messaging practices set forth in applicable communication protocols (e.g., HTTP, TCP, etc.) exhibited by the traffic packets containing the object, since these deviations are often characteristic of malware. A match of an identifier may indicate, to some level of probability, often well less than 100%, that an object constitutes malware. The identifiers may represent identified characteristics (features) of the potential malware. The heuristics engine 335 may include scoring logic to correlate one or more characteristics of potential malware with a score of maliciousness, the score indicating the level of suspiciousness and/or maliciousness of the object. In one embodiment, when the score is above a first threshold, the heuristic engine 335 may generate an alert that the object is malicious. When the score is greater than a second threshold but lower than the first threshold, the object may be provided to the static analysis logic and/or the dynamic analysis logic for further analysis. When the score is less than the second threshold, the threat detection system may determine no further analysis is needed (e.g., the object is benign).

For dynamic analysis, the static analysis engine 320 provides the object to the scheduler 350. The scheduler 350 is responsible for provisioning and instantiating a virtual machine to execute the object at a schedule time. In some embodiments, the heuristic module 335 transmits the metadata identifying a destination device to the scheduler 350, which can then provision a virtual machine with software (operating system (OS) and one or more applications) and other components appropriate for execution of the network data (data packets or objects), which in some cases are those associated with the destination device. In other embodiments, the scheduler 350 receives one or more data packets of the network traffic from the network interface(s) 310 and analyzes the one or more data packets to identify the destination device. A virtual machine is executable software that is configured to mimic the performance of a device (e.g., the destination device).

The scheduler 350 can configure the virtual machine to mimic the pertinent performance characteristics of a destination device. The virtual machine can be provisioned from the store of software profiles 355. In one example, the scheduler 350 configures the characteristics of the virtual machine to mimic only those features of the destination device that are affected by an object to be executed (opened, loaded, and/or executed) and analyzed. Such features of the destination device can include ports that are to receive the network data, select device drivers that are to respond to the network data and any other devices coupled to or contained within the destination device that can respond to the network data. In other embodiments, the dynamic analysis logic 340 may determine a software profile, and then configures one or more virtual machine(s) 360 with the appropriate ports and capabilities to receive and execute the network data based on that software profile. In other examples, the dynamic analysis logic 340 passes the software profile for the network data to the scheduler 350 which either selects from the store of software profiles 355 or configures the virtual machine based on that profile.

The store of software profiles 355 is configured to store virtual machine images. The store of software profiles 355 can be any storage capable of storing software. In one example, the store of software profiles 355 stores a single virtual machine image that can be configured by the scheduler 350 to mimic the performance of any destination device on the private network 120. The store of software profiles 355 can store any number of distinct virtual machine images that can be configured to simulate the performance of any destination devices when processed in one or more virtual machine(s) 360.

The processing of an object may occur within one or more virtual machine(s), which may be provisioned with one or more software profiles. The software profile may be configured in response to configuration information provided by the scheduler 350, information extracted from the metadata associated with the object, and/or a default analysis software profile. Each software profile may include a software application and/or an operating system. Each of the one or more virtual machine(s) 360 may further include one or more monitors (not separately shown), namely software components that are configured to observe, capture and report information regarding run-time behavior of an object under analysis during processing within the virtual machine. The observed and captured run-time behavior information as well as effects on the virtual machine, otherwise known as features, along with related metadata may be provided to a scoring logic 370.

The scoring logic 370 generates a score used in a decision of maliciousness by the classification engine 380. The score may be a probability value (expressed in any of various ways such as, for example, a numerical value or percent) or other indicator (quantitative or qualitative) of security risk or so-called threat level. The determination of the score of the object processed by the malware detection system 300 may be based on a correlation of each of the features identified by the static analysis logic 320 and dynamic analysis logic 340 respectively. The features are the results of different analyses of the objects. The features may include characteristics, where characteristics include information about the object that do not require execution or “running” of the object. Characteristics may include metadata associated with the object, anomalous formatting or structuring of the object. The features may also include behaviors, where behaviors include information about the object and its activities during its execution or processing. Behaviors may include, but are not limited to, attempted outbound communications over a network connection or with other processes, patterns of activity or inactivity, and/or attempts to access system resources.

The scoring logic 370 may correlate one or more characteristics and monitored behaviors (features) with a weight of maliciousness. The weight of maliciousness reflects experiential knowledge of the respective features (characteristics or monitored behaviors) with those of known malware and benign objects. For example, during processing, the dynamic analysis logic 340 may monitor several behaviors of an object processed in the one or more virtual machine(s) 360, where, during processing, the object (i) executes a program, (ii) the program identifies personally identifiable data (e.g. login information, plain-text stored passwords, credit information), (iii) the program generates and encrypts the data in a new file, (iv) the program executes a network call, and (v) sends the encrypted data via the network connection to a remote server (exfiltrates the data). Each individual event may generate an independent score, weighted by the scoring logic 370, the weight based on experiential knowledge as to the maliciousness of each associated event. The individual scores or a combined score may be provided to the classifying engine 380. Alternatively, in some embodiments, the generation of a combined score may be performed by the classifying engine 380, or the scoring logic 370 and classifying engine 380 may be combined into a single engine.

The classifying engine 380 may be configured to use the scoring information provided by scoring logic 370 to classify the object as malicious, suspicious, or benign. In one embodiment, when the score is above a first threshold, the heuristic engine 335 may generate an alert that the object is malicious. When the score is greater than a second threshold but lower than the first threshold, the object may be provided for further analysis to the static analysis logic and/or the dynamic analysis logic for further analysis. When the score is less than the second threshold, the classifying engine 380 may determine no further analysis is needed (e.g., the object is benign). The threshold of maliciousness may be fixed, modified by as security administrator, and/or modified based on network conditions (for example, if a network is experiencing anomalous network conditions, if many other clients of a similar type are under confirmed attack, etc.). The classifying engine 380 may be configured to classify the object based on the characteristics identified by the static analysis logic 320 and/or the behaviors (expected and unexpected/anomalous) monitored by the dynamic analysis logic 340. In some embodiments, the classifying engine 380 may use only the correlation information provided by the scoring logic 370. That is, a determination of whether the monitored behaviors represent expected or unexpected (anomalous) behaviors is rendered by correlating the monitored behaviors against behaviors of known malware. Results of the static analysis may also be used in the correlation and classification, e.g., by being combined with the results of the dynamic analysis to yield a combined score. In an embodiment, further static analysis and/or dynamic analysis may be performed at the MDS 300 based on the results of correlation and classification engines.

In some embodiments, the classifying engine 380 may provide objects classified as malicious to the indicator generator 385, which may then generate indicators associated with these malicious objects. Additionally, the indicator generator 385 may receive non-malicious objects to generate a suitable indicator associated with non-maliciousness. In some embodiments, the indicators may be “fingerprint” type signatures, formed as a hash of the object. Alternatively, or in addition, the indicators may include identification of observed features, including characteristics and behaviors. The indicators thus generated may be provided to the security logic engine 400 for further enhancement (e.g., with additional indication of features) using results provided by endpoint devices 200. The classifying engine 380 may alternatively bypass the indicator generator 385 if it determines that the analyzed object is not malicious. The indicators may be provided to the indicator scanner 330 for use in inspecting (by scanning) subsequently received objects. In some embodiments, the indicator generator 385 may also distribute the indicators to the endpoint devices 200 and/or the security logic engine 400.

If the malware detection system classifies the object as malicious based on a static analysis results and/or dynamic analysis results, the reporting engine 390 may signal to a network or security administrator for action by an appropriate alert. In an embodiment, the reporting engine 390 may report the indicators (“signatures”) of detected behaviors of a process/object as indicative of malware and organize those indicators as reports for distribution to the endpoint devices 200.

As noted previously, the reporting logic 390 may be configured to generate an alert for transmission external to the malware detection system 300 (e.g., to one or more other endpoint devices 200, to the security logic engine 400, and/or to a network manager). The reporting logic 390 is configured to provide reports via the network interface(s) 310. The security logic engine 400, when external to the MDS 300, e.g., may be configured to perform a management function or a management system may be provided, depending on the embodiment, e.g., to distribute the reports to other MDS within the private network, as well as to nodes within a malware detection services and/or equipment supplier network (e.g., supplier cloud infrastructure) for verification of the indicators and subsequent distribution to other malware detection system and/or among other customer networks. Illustratively, the reports distributed by the management function or system may include the entire or portions of the original indicator reports provided by the MDS 300, or may include new versions that are derived from the original reports.

Security Logic Engine

As shown in FIG. 4, an embodiment of the security logic engine 400 includes a network interface(s) 410, a formatting logic 420, a correlation engine 430, a scoring logic (scorer) 440, a classification engine 450, a labeler 460, an indicator scanner 470, a risk analyzer 480, and a reporting engine 490. Generally speaking, the security logic engine 400 may be implemented as one or more network-connected electronic devices, which include(s) physical hardware comprising hardware processor(s), network interface(s), a memory, a system interconnect, an optional user interface, a system interconnect, arranged and organized as shown in FIG. 2. Each of the logic and engine components (including those just listed above) of the security logic engine 400 may be implemented as computer programs or modules executed by one or more processors and stored in memory.

The network interface(s) 410 can be coupled to a network such as private network 120 (FIG. 1) via the network interconnects 130. The network interface(s) 410 may support communication over a conventional link, such as over an Ethernet connection, USB connection, a FireWire connection, a serial connection, a parallel connection, or an ATA connection. The communication network interface(s) 410 may also support wireless communication (e.g., 802.11 a/b/g/n or wireless USB). It will be apparent to those skilled in the art that the communication network interface(s) 410 can support many wired and wireless standards. Where the SLE 400 is implemented within the MDS 300 and thus availed of network interface(s) 310, the network interface(s) 410 may be eliminated or disabled.

In some embodiments, a formatting logic 420 receives communication data from the network interface(s) 410 (or 310 of FIG. 3) and converts the data into a standardized format to be processed by other modules in the security logic engine 400 if not already in a suitable format. In general, the formatting logic 420 obtains data in disparate formats, which may often be device specific (e.g. an intermediary network device 140, malware detection system 300, endpoint device 200, etc.) or application version specific (e.g., endpoint device agent 250 may provide a particular format in version 1.0 and a different format in version 2.0), and transforms the data into a readily consumable, common format. For example, the formatting logic 420 may transform data associated with a first endpoint device agent 250 to that of a common data format (e.g. JSON, etc.) such that any ensuing analysis and correlation may be provided using a common data format.

The correlation engine 430 may correlate the features received by the security logic engine 400 from an endpoint device 200 and the malware detection system 300 with known behaviors and characteristics of benign and malicious objects. Additionally, the correlation engine 430 may correlate the features received from the endpoint device 200 with those received from the malware detection system 300 to verify the determination of maliciousness obtained by the malware detection system 300 or determine the extent to which the features from these two vantage points (network periphery and endpoint) correlate with one another. The correlations just described in the preceding two sentences can be performed separately or in the same operation depending on the implementation, and in other embodiments one or the other may be eliminated altogether.

The results of the correlation performed by the correlation engine 430 may be provided to a scorer 440. The scorer 440 may generate a score based on each correlation of an observed feature with known behaviors and characteristics of benign and malicious objects. The classification engine 450 may utilize the scores generated by the scorer 440 to classify the object as malicious if it exceeds a threshold. The threshold may be fixed or dynamic. The maliciousness threshold may be “factory-set,” “user-set,” and/or modified based on information received via a network interface(s) 410.

The correlation engine 430 may be configured, depending on the embodiment, (a) to verify a classification of maliciousness made by the malware detection system 300, (b) to provide greater or lesser confidence that an object processed by the malware detection system 300 should be classified as malware, and/or (c) to determine whether the endpoint device 200 has received and is processing malware, and if so, whether the malware is the same as that found by the malware detection system 300. The first of these requires the correlation engine 430 to correlate at least the results of the malware detection system 300 with those of the endpoint device 200. The last of these requires that the correlation engine 430 correlate the features reported by the endpoint device 200 with those of known malware, and compare the correlation results with those obtained by the malware detection system 300.

For example, the correlation engine 430 may receive, over a communication network via network interface(s) 410, (i) a feature set (features including behaviors and, in some embodiments, characteristics) monitored by the endpoint device agent 250, and (ii) a feature set (features including behaviors and, in some embodiments, characteristics) associated with an object classified by the malware detection system as malware, and in some embodiments, the associated score or threat level determined by the MDS. The correlation engine 430 may correlate the feature sets received from the endpoint device 200 and the MDS 300 to determine whether the endpoint 200 observed the same or similar features to those monitored in the MDS 300 on which its classification decision was based, and may also correlate those feature sets with features exhibited by known malware and/or malware families. In so doing, the correlation engine 430 may apply correlation rules to determine whether the feature sets separately (or those common features of the feature sets) indicate or verify the object as malware. The correlation rules may define, among other things, patterns (such as sequences) of known malicious behaviors, and, in some embodiments, also patterns of known benign behaviors. For example, in looking at patterns, a behavior may be detected that appears benign, but when examined with other behaviors, may be indicative of malicious activity.

The scorer 440 generates a risk level or numerical score used in a decision of maliciousness by the classification engine 450. The score may be a probability value (expressed in any of various ways such as, for example, a numerical value or percent) or other indicator (quantitative or qualitative) of security risk or threat level. The determination of the risk level of the object processed by the MDS 300 and observed by the endpoint device 200 may be based on monitored events used by the correlation engine 430, inter alia, (i) the location from where the object originated (e.g., a known website compared to an unknown website), (ii) the processed object spawned a new process, and/or (iii) actions taken by received objects during processing (e.g., executable code contained in objects attempts to execute a callback). An object with an associated score (value) above a first threshold may indicate a suspicious object, i.e., an object with a certain probability of being malicious, and above a second, higher threshold may indicate that object should be classified as malware, i.e., an object with a high probability of being malicious. In some embodiments, the scorer 440 may increase or decrease a score provided by the MDS 300 or may generate its own score based on all the available features of the feature sets. For example, if the results of the correlation of monitored behaviors from the endpoint device 200 and the MPS 300 and, in some embodiments, features associated with known malware, reveal a level of similarity above a first predetermined threshold (e.g., 60% or 70%), the scorer 440 may so indicate in its score. The security logic engine 400 may classify the object as malware in response to the score generated by the scorer 440.

Accordingly, the classification engine 450 may be configured to use the correlation information provided by correlation engine 430 and the score provided by a scorer 440 to render a decision as to whether the object is malicious. Illustratively, the classification engine 450 may be configured to classify the correlation information, including monitored behaviors and characteristics, of the object relative to those of known malware and benign content. If a first probability of attack (score) is received by the security logic engine 400 from a malware detection system 300 and differs by a threshold amount or falls beyond a comparison “range” from the probability of attack (score) as determined by the classification engine 450, the security logic engine 400 may generate a second classification (the classification generated by the classification engine 450), and provide the second classification to the malware detection system 300 and report the second classification in an alert. The threshold or comparison range may be fixed, and/or based on a percent of the initial classification by the malware detection system 300.

In an embodiment, the security logic engine 400 may include a labeler 460 configured to add names of malware or malware families to indicators (signatures) of malware. The labeler 460 may define a new malware family or add the identified malware to the malware family bearing the greatest similarity to the identified malware. The similarity may be based on a correlation, conducted by the correlation engine 430 or the labeler 460, of the identified malware behaviors with a database (not shown) of malware family entries and associated behaviors. Alternatively, the association of a malware family may be implemented in a separate module. The malware detection system 300 may update the indicator scanner 330 using the enhanced indicators generated by the labeler 460. These indicators may be used internally by the indicator scanner 470 of the security logic engine 400 or distributed externally as part of indicator reports to the malware detection system (s) 300 or endpoint device(s) 200.

The indicator scanner 470 receives, authenticates, and stores malware indicators, and scans results received from the malware detection system 300 and results received from an endpoint device 200 to determine, when they match, that the object under analysis is malicious. The indicator scanner 470 may also generate enhanced indicators based on the additional information received from the endpoint device 200.

The risk analyzer 480 determines the risk of harm to private network 120 from a verified malicious object based on the results provided by the classification engine 450 and labeler 460 and the indicator scanner 470. The risk analyzer 480 may base the risk of harm on information retrieved from a database regarding named malware or malware families. More specifically, the risk analyzer 480 may receive information about the object from the classification engine 450 and/or the labeler 460, which may also provide the observed behaviors from an endpoint device 200 and a malware detection system 300 as well as a malware family names identified malware names. The risk analyzer 480 may also retrieve information from the network or be provided with information about network device properties (e.g. network location, connected users, operating system version, etc.) for use in its risk assessment. The risk analyzer 480 may also receive a classification of the malware from the classification engine 450 or the signature matcher 470. The risk analyzer 480 determines a risk to the private network 120 using experiential knowledge to correlate the information about the malicious object with the information about the network device properties. The correlation results in a risk profile for each endpoint device, which may be provided to a network administrator.

The risk analyzer 480 may identify endpoint device(s) 200 that may be affected by the cyber-attack involving the verified malicious object. The risk analyzer 480 may utilize the identified features and metadata of a verified malicious object to determine if the system configuration (where a system configuration may be characterized by its hardware and software profiles) of each endpoint device in the private network 120 is vulnerable to the attack. To determine the risk posed by the verified malicious object to each endpoint device 200, the risk analyzer 480 may correlate each feature and its metadata of the object (e.g., software profile running during processing of the object during which malicious behavior was observed) with system configuration attributes of the endpoints on the network. If an endpoint device system configuration correlates with the features and metadata of the verified malware, the risk analyzer 480 identifies the endpoint device as at risk to attack.

In some embodiments, the risk analyzer 480 may communicate to a malware detection system 300 that further analysis of the verified malicious object is necessary if the risk analyzer 480 cannot determine if the verified malicious object will behave maliciously when processed by endpoint device system configurations on the private network.

The risk analyzer 480 may issue alerts to particular network devices (e.g., endpoint devices, network storage servers being accessed by an endpoint device 200 with a verified malicious object present) to restrict access from network devices found to be correlated with a high risk and/or may issue alerts to a network or security administrator via the reporting engine 490.

The reporting engine 490 is adapted to receive information from the signature matcher 470 and the risk analyzer 480 to generate alerts that identify to a user of an endpoint device, network administrator or an expert network analyst the likelihood of verified network cyber-attack. Other additional information regarding the verified malware may optionally be included in the alerts. For example, additional reported information may partially comprise typical behaviors associated with the malware, particular classifications of endpoint devices or users that may be targeted, and/or the priority for mitigation of the malware's effects. Additionally, a user of an endpoint device that was to receive the objects and/or a network administer may be alerted to the results of the processing via alert generated by a reporting engine 490. The reporting engine 490 may also provide connected malware detection systems and endpoint devices 200, with updated information regarding malicious attacks and their correlation with particular behaviors identified by the security logic engine 400. Where the security logic engine is a component of the MDS 300, the reporting engine 490 may be eliminated or combined with reporting engine 390.

FIG. 5 is an example computerized method 500 for operating the malware threat detection verification system. The term “computerized” generally represents that operations are conducted by hardware in combination with executable software and/or firmware. The procedure 500 starts at step 505 and proceeds to step 510 where a malware detection system 300 receives network traffic directed to a destination device in the private network. The destination device may be an endpoint device 200, (e.g., a desktop computer, a network attached storage server, etc.). At step 515 the malware detection system 300 processes the received network traffic using at least the static analysis logic 320 and/or dynamic analysis logic 340 to determine if the object contains characteristics or behaviors indicative of malware. The dynamic analysis logic 340 may utilize a software profile from the software profile store 355. The software profile selected from the software profile store 355 may be chosen to mimic the original destination endpoint device or a default analysis software profile set by a security administrator. At step 520 the malware detection system 300 determines if the network traffic content (object) is malicious, based on the monitored characteristics and/or behaviors. If the processed content is determined to be benign by the malware detection system 300, the method may end at step 550. In some embodiments, if the malware detection system 300 identifies the processed network content as suspicious, it may provide its analysis results to the security logic engine 400 for further analysis and correlation with endpoint device results. If the processed content is determined to be malicious, and thus indicative of an attack, by the malware detection system 300 at step 520, the malware detection system 300 may provide its determination and associated information (e.g. a signature generated by the indicator generator 385, characteristics and/or monitored behaviors identified by the static analysis logic 320 and dynamic analysis logic 340 respectively, etc.) to the security logic engine 400.

At step 525 the security logic engine receives the determination of possible attack from the malware detection system 300, which may also include information collected by the malware detection system about the processed network content. At step 530 the security logic engine receives indicators (e.g., features) from possible attack on an endpoint device 200 as identified at the endpoint device by the associated agent 250. The endpoint device agent 250 may provide the security logic engine 400 with event information about the processing of the object by the endpoint device. The information provided to the security logic engine 400 by the endpoint device 200 may include an initial determination of maliciousness by the endpoint device classifier 260 and/or behaviors monitored by the agent 250. At step 535 the security logic engine 400 may compare the received information from the endpoint device 200 with known indicators using the indicator scanner 470. Alternatively, the security logic engine 400 may employ the correlation engine 430, scorer 440, and classification engine 450 to determine if the endpoint device monitored behaviors are malicious. If the endpoint device monitored behaviors are determined to be malicious, the risk analyzer 480 verifies the network content determined to be malicious by the malware detection system 300 is malicious.

The verification step 540 requires the security logic engine 400 to combine the features (identified characteristics and monitored behaviors of the suspicious object) detected by the malware detection system 300 with the monitored behaviors of the suspicious object on the endpoint device(s) 200. Combining the features detected by the malware detection system 300 and endpoint device(s) 200 may result in a verification of a first determination of maliciousness by the malware detection system 300. The monitored behaviors from the endpoint device(s) 200 may provide further details of a suspicious object's execution resulting from, for example, longer runtimes (than on the MDS 300), user interaction, and accessibility of particular resources. The combination of the malware detection system features and endpoint device behaviors may be performed by the correlation engine 430 to increase or decrease the correlation with maliciousness.

If the first determination of maliciousness is verified by monitoring behaviors on an endpoint device 200 with a similar software profile as that used by the malware detection system, the determination may be limited to associated software profiles. The security logic engine 400 may conduct further analysis using monitored behaviors from additional endpoint devices with different software profiles to determine if the object behaves maliciously on different software profiles.

If the malware is not verified as malicious in step 540 the procedure, then ends at step 550. If the malware is verified, the risk analyzer 480 determines the threat to the network resources (endpoint devices 200, servers, etc.) and at step 545 reports the results via the reporting engine 490. Once reported (e.g. by storing the result in the security logic engine 400, issuing an alert to a third party, issuing alerts to users or network managers, and/or issuing alerts to devices, etc.), the procedure ends at step 550.

FIG. 6 represents another exemplary flowchart of a computerized method 600 for operating a malware threat detection verification system. The exemplary method 600 starts at step 605 and proceeds to step 610 where a malware detection system 300 analyzes a received object. In step 615 the malware detection system determines if the analyzed object is malicious. As described herein, the object is received in network traffic by the malware detection system and determined to be malicious based on an analysis by the system. If the malware detection system determines the object is not malicious (e.g. benign), the method ends at step 660.

If the malware detection system determines the received object is malicious (and, in some embodiments, suspicious), it may communicate with the security logic engine 400 and/or (depending on the embodiment) with an endpoint device 200 to verify the determination of maliciousness. If malware is detected in step 615, the malware detection system 300 communicates the result to a security logic engine 400 in step 620. In step 625 the malware detection system 300 may optionally determine if particular monitoring techniques that are within its capability to influence or request may be implemented at an endpoint device 200. The determination of additional monitoring techniques to be implemented by the endpoint device may be based on features identified by the malware detection system 300 in step 610 to determine if the object is malicious.

In step 627 of the exemplary method 600, the endpoint device 200 applies the “influence” techniques, e.g., the particular monitoring techniques requested by the MDS 300. Two of these are illustrated the following two steps: In step 630 the endpoint device 200 may optionally receive an indicator representing the malicious object from the malware detection system 300. The indicator can be a hash of the object found to be malicious by the malware detection system 300, which can be used to scan objects being processed by the endpoint device 200 to determined maliciousness. Also, the indicator can be descriptive of the features found to be malicious by the malware detection system 300 and can be used to identify an object processed in the endpoint that may be the same or similar to the object analyzed and found malicious by the malware detection system 300. In step 635, the endpoint device may optionally configure the behavioral monitors to detect the behaviors of the same (or similar) object on the endpoint device 200 or the behaviors specifically identified by the latter type of “feature” indicator. Responsive to the indicators, the endpoint device 200 may enable or disable monitors or configure or customize their operation.

The behaviors monitored by the endpoint device 200 in step 635 may be communicated to a security logic engine 400 in step 640. The monitored behaviors may be communicated periodically, or aperiodically, for example, when the malicious behavior is verified or alternatively when the endpoint device 200 has completed processing the malicious object. In step 645, the security logic engine 400 may combine the results of the analysis performed by the malware detection system 300 in step 610 with the monitored behaviors from endpoint device 200. The combination of the features in step 645 may be used to generate further correlations of those features with features of known malware.

If the further correlations with known malicious features exceed a threshold, as described herein, the security logic engine 400 in step 650 may corroborate the first determination of maliciousness from step 610. If the determination cannot be corroborated, the security logic engine 400 may await further monitored behaviors to be received from the endpoint device 200. In step 655 the security event analyzing logic 400 may report the verification of maliciousness to a security administrator for remediation and/or mitigation.

In one embodiment, an exemplary alert (e.g., an object, text message, display screen image, etc.), issued by step 655, is communicated to security administrators. For example, the alert may indicate the urgency in handling one or more predicted attacks based on the maliciousness of the verified malicious object. Furthermore, the alert may comprise instructions so as to prevent one or more predicted malware attacks.

The foregoing description has been directed to specific embodiments. It will be apparent, however, that other variations and modifications may be made to the described embodiments, with the attainment of some or all of their advantages. For instance, it is expressly contemplated that the components and/or elements described herein can be implemented as software encoded on a tangible (non-transitory) computer-readable medium (e.g., disks, electronic memory, and/or CDs) having program instructions executing on a computer, hardware, firmware, or a combination thereof. Moreover, the embodiments or aspects thereof can be implemented in hardware, firmware, software, or a combination thereof. In the foregoing description, for example, in certain situations, terms such as “engine,” “component” and “logic” are representative of hardware, firmware and/or software that is configured to perform one or more functions. As hardware, engine (or component/logic) may include circuitry having data processing or storage functionality. Examples of such circuitry may include, but is not limited or restricted to a microprocessor, one or more processor cores, a programmable gate array, a microcontroller, an application specific integrated circuit, semiconductor memory, or combinatorial logic. Accordingly this description is to be taken only by way of example and not to otherwise limit the scope of the embodiments herein. Therefore, it is the object of the appended claims to cover all such variations and modifications as come within the true spirit and scope of the invention.

Claims

1. A cyber security system to determine and verify a presence of a cyber-attack, comprising: a system including at least one processor to communicate over the network directly or indirectly with one or more endpoint devices, intercept in-bound network traffic at or near a periphery of the network, analyze a first object included in the network traffic to identify one or more first features associated with the first object, the one or more first features including behaviors exhibited during processing of the first object in a virtual machine, and generate a first determination of maliciousness in response to the identified one or more first features associated with the first object;at least one endpoint device targeted to receive the network traffic, the at least one endpoint device including at least one processor to identify one or more second features associated with one or more objects including a second object corresponding to the first object, wherein the one or more second features include behaviors identified during processing of the one or more objects; anda security logic engine to receive the one or more first features identified by the system and the one or more second features identified by the at least one endpoint device, verify the first determination of maliciousness of at least the first object based on a combination of the one or more first features and the one or more second features to classify the first object as malware, and generate an alert to report the classification as malware,wherein the alert includes information that identifies (i) a first software profile associated with the virtual machine in which the one or more first features are exhibited and (ii) a second software profile associated with the at least one endpoint device in which the one or more second features are exhibited during processing of a second object.
2. The cyber security system of claim 1, wherein the system comprises a network security appliance.
3. The cyber security system of claim 1, wherein the system comprises the security logic engine.
4. A security logic engine to determine and verify a presence of a cyber-attack, comprising: a network interface configured to (i) receive information from a system including a first set of features associated with a first object included in the network traffic including behaviors exhibited during processing of the first object in a virtual machine and (ii) receive information from at least one endpoint device including a second set of features associated with one or more objects including a second object corresponding to the first object, wherein the one or more second features include behaviors identified during processing of the one or more objects including the second object;correlation logic to determine maliciousness of at least the first object based on a combination of the first set of features provided from the system and the second set of features to classify the first object as malware; anda reporting engine to generate an alert to report the classification as malware, wherein the alert includes information that identifies (i) a first software profile associated with the virtual machine in which the one or more first features include one or more behaviors exhibited during processing of the first object within the virtual machine and (ii) a second software profile associated with the at least one endpoint device in which the one or more second features are exhibited during processing of the second object.
5. The security logic engine of claim 4, wherein the at least one endpoint device includes a group of endpoint devices; the network interface receiving information from each of the group of endpoint devices regarding a respective software profile running during processing of the one or more objects; the reporting engine including the information regarding the respective software profiles and risk profile of the malware as part of the alert.
6. A computerized method to determine and verify a presence of a cyber-attack, comprising: receiving one or more first features based on an analysis of a first object that is intercepted by a system from in-bound network traffic at or near a periphery of a network, the one or more first features including behaviors exhibited during processing of the first object in a virtual machine and a first determination of maliciousness of the first object being generated based on the one or more first features;receiving one or more second features associated with a second object corresponding to the first object, wherein the one or more second features include behaviors related to processing of the second object within an endpoint device of one or more endpoint devices;generating a second determination of maliciousness based on a combination of the one or more first features and the one or more second features;classifying at least the first object as malware based on the first determination of maliciousness and the second determination of maliciousness; andgenerating an alert to report the classification of the first object as malware, wherein the alert includes information that identifies (i) a first software profile associated with the virtual machine in which the one or more first features exhibited the behaviors during processing of the first object and (ii) a second software profile associated with each compromised endpoint device corresponding to a set of the one or more endpoint devices in which the one or more second features were exhibited during processing of the second object.
7. The computerized method of claim 6, wherein the second object is a copy of the first object received and processed by the system that produces the one or more first features.
8. The computerized method of claim 7, wherein: generating the first determination of maliciousness includes generating a first indicator associated with the first object; andgenerating the second determination of maliciousness includes generating a second indicator associated with the second object, andclassifying the first object as malware includes correlating the first indicator with the second indicator.
9. The computerized method of claim 7, wherein the receiving of the one or more first features, the receiving of the one or more second features, the generating of the second determination of maliciousness and the classifying at least the first object as malware are conducted by a security logic engine.
10. The computerized method of claim 9, further comprising classifying the first object as belonging to one or more known malware or malware families in response to correlating the combination of the one or more first features and the one or more second features with features associated with the one or more known malware or malware families.
11. The computerized method of claim 6, wherein the one or more first features including behaviors exhibited during processing of the first object in a virtual machine.
12. The computerized method of claim 6, further comprising: associating a name of a known malware or malware family with the first object classified as malware;accessing a database to identify software having vulnerabilities to the known malware or malware family; andaccessing a store providing software profiles of a plurality of other endpoint devices connected for communication on the network to identify each of the other endpoint devices that may run the identified software and thus may constitute a compromised endpoint device.
13. The computerized method of claim 6, further comprising the system communicating with at least the endpoint device of the one or more endpoint devices to provide information associated with a third object corresponding to the first object classified as malware, the system being remotely located from the one or more endpoint devices.
14. The computerized method of claim 13, further comprising identifying, for communication with the system, at least one of the one or more endpoint devices based on a destination address included in the network traffic containing the third object corresponding to the first object classified as malware.
15. The computerized method of claim 6, wherein each agent deployed within each of the one or more endpoint devices monitors behaviors related to the processing of a version of the first object.
16. The computerized method of claim 15, further comprising monitoring the behaviors by each agent operating on an associated endpoint of the one or more endpoint devices;modifying the monitoring of the agents in response to the first determination.
17. The computerized method of claim 6, further comprising configuring an endpoint monitoring logic to monitor for features based on the first determination.
18. The computerized method of claim 7, further comprising: monitoring a pattern of behaviors at the one or more endpoint devices in response to processing the second object;preventing lateral propagation of a third object corresponding to the first object that might infect other endpoint devices on the network.
19. The computerized method of claim 18, wherein the preventing of the lateral propagation comprises instructing at least one of the one or more endpoint devices to terminate processing of the second object.
20. The computerized method of claim 18, wherein the preventing of the lateral propagation comprises closing at least one network port at each of the one or more compromised endpoint devices.
21. The computerized method of claim 6, prior to receiving the one or more first features based on the analysis of the first object that is intercepted by the system, further comprising: determining a software profile based on the first object;provisioning the virtual machine with the software profile; andconducting the analysis of the first object within the virtual machine.
22. The computerized method of claim 21, wherein prior to receiving the one or more second features associated with the second object, the method further comprising: processing the first object in virtual machine dynamic analysis logic with a software profile configured to simulate a software configuration of at least one of the one or more endpoint devices.
23. The computerized method of claim 6, wherein each of the one or more first features constitutes a statically identified characteristic or a behavior of the first object.
24. The computerized method of claim 6, wherein the second object corresponding to the first object as the second object is based on the first object.
25. The computerized method of claim 6, wherein the second object corresponding to the first object by including information associated with the first object.
26. The computerized method of claim 13, wherein the third object corresponding to the first object corresponds to the second object.
27. The cyber security system of claim 1, wherein the second object corresponding to the first object as the second object is based on the first object.
28. The cyber security system of claim 1, wherein the second object corresponding to the first object by including information associated with the first object.
29. The cyber security system of claim 1, wherein the security logic engine is further configured to (i) associate a name of a known malware or malware family with the first object classified as malware, (ii) access a database to identify software having vulnerabilities to the known malware or malware family, and (iii) access a store providing software profiles of a plurality of other endpoint devices connected for communication on the network to identify each of the other endpoint devices that may run the identified software and may constitute a compromised endpoint device.
30. The cyber security system of claim 1, wherein the security logic engine is further configured to communicate with the at least one endpoint device to provide information associated with the second object corresponding to the first object classified as malware.
31. The cyber security system of claim 1, wherein the security logic engine is further configured to identify one or more endpoint devices, including the at least one endpoint device, based on a destination address included in the network traffic containing a third object corresponding to the first object classified as malware.
32. The cyber security system of claim 1, wherein the at least one endpoint device includes an agent that is configured to monitor behaviors related to the processing of the second object corresponding to the first object.
33. The cyber security system of claim 1, wherein the agent includes an endpoint monitoring logic configured to monitor for features based on the first determination generated by the system.
34. The cyber security system of claim 1, wherein the security logic engine being configured to (i) monitor a pattern of behaviors at one or more endpoint devices including the at least one endpoint device in response to processing the second object and (ii) prevent lateral propagation of a third object corresponding to the first object or the second object that might infect endpoint devices other than the at least one endpoint device.
35. The cyber security system of claim 34, wherein the security logic engine is configured to prevent lateral propagation comprises instructing the at least one endpoint device to terminate processing of the second object or to close at least one network port.
36. The security logic engine of claim 4, wherein the second object corresponding to the first object as the second object is based on the first object.
37. The security logic engine of claim 4, wherein the correlation logic is configured to determine maliciousness of the first object and verify the cyber-attack by correlating the first set of features and the second set of features with features associated with known malware.
38. The security logic engine of claim 4, further comprising: a classifying engine configured classify the first object as malicious or benign.
39. The security logic engine of claim 4, further comprising an indicator generator configured to generate at least an indicator associated with the first object classified as malware, the indicator including a signature or a hash of the first object.
40. The security logic engine of claim 39 further comprising: a labeler to add a representative name of a malware or a malware family to an indicator of the malware or the malware family.

RELATED APPLICATION

The present application claims priority from commonly owned Provisional Patent Application No. 62/316,390, entitled MALWARE DETECTION VERIFICATION AND ENHANCEMENT USING DETECTION SYSTEMS LOCATED AT THE NETWORK PERIPHERY AND ENDPOINT DEVICES, by Ashar Aziz et al., filed on Mar. 31, 2016, the contents of which are incorporated herein by reference.

US Referenced Citations (851)

Number	Name	Date	Kind
4292580	Ott et al.	Sep 1981	A
5175732	Hendel et al.	Dec 1992	A
5319776	Hile et al.	Jun 1994	A
5440723	Arnold et al.	Aug 1995	A
5490249	Miller	Feb 1996	A
5657473	Killean et al.	Aug 1997	A
5802277	Cowlard	Sep 1998	A
5842002	Schnurer et al.	Nov 1998	A
5960170	Chen et al.	Sep 1999	A
5978917	Chi	Nov 1999	A
5983348	Ji	Nov 1999	A
6088803	Tso et al.	Jul 2000	A
6092194	Touboul	Jul 2000	A
6094677	Capek et al.	Jul 2000	A
6108799	Boulay et al.	Aug 2000	A
6154844	Touboul et al.	Nov 2000	A
6269330	Cidon et al.	Jul 2001	B1
6272641	Ji	Aug 2001	B1
6279113	Vaidya	Aug 2001	B1
6298445	Shostack et al.	Oct 2001	B1
6321338	Porras et al.	Nov 2001	B1
6357008	Nachenberg	Mar 2002	B1
6424627	Sorhaug et al.	Jul 2002	B1
6442696	Wray et al.	Aug 2002	B1
6484315	Ziese	Nov 2002	B1
6487666	Shanklin et al.	Nov 2002	B1
6493756	O'Brien et al.	Dec 2002	B1
6550012	Villa et al.	Apr 2003	B1
6775657	Baker	Aug 2004	B1
6831893	Ben Nun et al.	Dec 2004	B1
6832367	Choi et al.	Dec 2004	B1
6895550	Kanchirayappa et al.	May 2005	B2
6898632	Gordy et al.	May 2005	B2
6907396	Muttik et al.	Jun 2005	B1
6941348	Petry et al.	Sep 2005	B2
6971097	Wallman	Nov 2005	B1
6978015	Erickson et al.	Dec 2005	B1
6981279	Arnold et al.	Dec 2005	B1
7007107	Ivehenko et al.	Feb 2006	B1
7028179	Anderson et al.	Apr 2006	B2
7043757	Hoefelmeyer et al.	May 2006	B2
7058822	Edery et al.	Jun 2006	B2
7069316	Gryaznov	Jun 2006	B1
7080407	Zhao et al.	Jul 2006	B1
7080408	Pak et al.	Jul 2006	B1
7093002	Wolff et al.	Aug 2006	B2
7093239	van der Made	Aug 2006	B1
7096498	Judge	Aug 2006	B2
7100201	Izatt	Aug 2006	B2
7107617	Hursey et al.	Sep 2006	B2
7159149	Spiegel et al.	Jan 2007	B2
7188367	Edwards et al.	Mar 2007	B1
7213260	Judge	May 2007	B2
7231667	Jordan	Jun 2007	B2
7240364	Branscomb et al.	Jul 2007	B1
7240368	Roesch et al.	Jul 2007	B1
7243371	Kasper et al.	Jul 2007	B1
7249175	Donaldson	Jul 2007	B1
7287278	Liang	Oct 2007	B2
7308716	Danford et al.	Dec 2007	B2
7328453	Merkle, Jr. et al.	Feb 2008	B2
7346486	Ivancic et al.	Mar 2008	B2
7356736	Natvig	Apr 2008	B2
7386888	Liang et al.	Jun 2008	B2
7392542	Bucher	Jun 2008	B2
7418729	Szor	Aug 2008	B2
7428300	Drew et al.	Sep 2008	B1
7441272	Durham et al.	Oct 2008	B2
7448084	Apap et al.	Nov 2008	B1
7458098	Judge et al.	Nov 2008	B2
7464404	Carpenter et al.	Dec 2008	B2
7464407	Nakae et al.	Dec 2008	B2
7467408	O'Toole, Jr.	Dec 2008	B1
7478428	Thomlinson	Jan 2009	B1
7480773	Reed	Jan 2009	B1
7487543	Arnold et al.	Feb 2009	B2
7496960	Chen et al.	Feb 2009	B1
7496961	Zimmer et al.	Feb 2009	B2
7519990	Xie	Apr 2009	B1
7523493	Liang et al.	Apr 2009	B2
7530104	Thrower et al.	May 2009	B1
7540025	Tzadikario	May 2009	B2
7546638	Anderson et al.	Jun 2009	B2
7565550	Liang et al.	Jul 2009	B2
7568233	Szor et al.	Jul 2009	B1
7584455	Ball	Sep 2009	B2
7600007	Lewis	Oct 2009	B1
7603715	Costa et al.	Oct 2009	B2
7607171	Marsden et al.	Oct 2009	B1
7639714	Stolfo et al.	Dec 2009	B2
7644441	Schmid et al.	Jan 2010	B2
7657419	van der Made	Feb 2010	B2
7676841	Sobchuk et al.	Mar 2010	B2
7698548	Shelest et al.	Apr 2010	B2
7707633	Danford et al.	Apr 2010	B2
7712136	Sprosts et al.	May 2010	B2
7730011	Deninger et al.	Jun 2010	B1
7739740	Nachenberg et al.	Jun 2010	B1
7779463	Stolfo et al.	Aug 2010	B2
7784097	Stolfo et al.	Aug 2010	B1
7832008	Kraemer	Nov 2010	B1
7836500	Nason et al.	Nov 2010	B2
7836502	Zhao et al.	Nov 2010	B1
7849506	Dansey et al.	Dec 2010	B1
7854007	Sprosts et al.	Dec 2010	B2
7869073	Oshima	Jan 2011	B2
7877803	Enstone et al.	Jan 2011	B2
7904959	Sidiroglou et al.	Mar 2011	B2
7908660	Bahl	Mar 2011	B2
7930738	Petersen	Apr 2011	B1
7937387	Frazier et al.	May 2011	B2
7937761	Bennett	May 2011	B1
7949849	Lowe et al.	May 2011	B2
7996556	Raghavan et al.	Aug 2011	B2
7996836	McCorkendale et al.	Aug 2011	B1
7996904	Chiueh et al.	Aug 2011	B1
7996905	Arnold et al.	Aug 2011	B2
8006305	Aziz	Aug 2011	B2
8010667	Zhang et al.	Aug 2011	B2
8020206	Hubbard et al.	Sep 2011	B2
8028338	Schneider et al.	Sep 2011	B1
8042178	Fisher	Oct 2011	B1
8042184	Batenin	Oct 2011	B1
8045094	Teragawa	Oct 2011	B2
8045458	Alperovitch et al.	Oct 2011	B2
8056136	Zaitsev	Nov 2011	B1
8069484	McMillan et al.	Nov 2011	B2
8087086	Lai et al.	Dec 2011	B1
8171553	Aziz et al.	May 2012	B2
8176049	Deninger et al.	May 2012	B2
8176480	Spertus	May 2012	B1
8201246	Wu et al.	Jun 2012	B1
8204984	Aziz et al.	Jun 2012	B1
8214905	Doukhvalov et al.	Jul 2012	B1
8220055	Kennedy	Jul 2012	B1
8225288	Miller et al.	Jul 2012	B2
8225373	Kraemer	Jul 2012	B2
8233882	Rogel	Jul 2012	B2
8234640	Fitzgerald et al.	Jul 2012	B1
8234709	Viljoen et al.	Jul 2012	B2
8239944	Nachenberg et al.	Aug 2012	B1
8260914	Ranjan	Sep 2012	B1
8266091	Gubin et al.	Sep 2012	B1
8286251	Eker et al.	Oct 2012	B2
8291499	Aziz et al.	Oct 2012	B2
8307435	Mann et al.	Nov 2012	B1
8307443	Wang et al.	Nov 2012	B2
8312545	Tuvell et al.	Nov 2012	B2
8321936	Green et al.	Nov 2012	B1
8321941	Tuvell et al.	Nov 2012	B2
8332571	Edwards, Sr.	Dec 2012	B1
8365286	Poston	Jan 2013	B2
8365297	Parshin et al.	Jan 2013	B1
8370938	Daswani et al.	Feb 2013	B1
8370939	Zaitsev et al.	Feb 2013	B2
8375444	Aziz et al.	Feb 2013	B2
8381299	Stolfo et al.	Feb 2013	B2
8402529	Green et al.	Mar 2013	B1
8464340	Ahn et al.	Jun 2013	B2
8479174	Chiriac	Jul 2013	B2
8479276	Vaystikh et al.	Jul 2013	B1
8479291	Bodke	Jul 2013	B1
8510827	Leake et al.	Aug 2013	B1
8510828	Guo et al.	Aug 2013	B1
8510842	Amit et al.	Aug 2013	B2
8516478	Edwards et al.	Aug 2013	B1
8516590	Ranadive et al.	Aug 2013	B1
8516593	Aziz	Aug 2013	B2
8522348	Chen et al.	Aug 2013	B2
8528086	Aziz	Sep 2013	B1
8533824	Hutton et al.	Sep 2013	B2
8539582	Aziz et al.	Sep 2013	B1
8549638	Aziz	Oct 2013	B2
8555388	Wang et al.	Oct 2013	B1
8555391	Demir et al.	Oct 2013	B1
8561177	Aziz et al.	Oct 2013	B1
8566476	Shiffer et al.	Oct 2013	B2
8566946	Aziz et al.	Oct 2013	B1
8584094	Dadhia et al.	Nov 2013	B2
8584234	Sobel et al.	Nov 2013	B1
8584239	Aziz et al.	Nov 2013	B2
8595834	Xie et al.	Nov 2013	B2
8627476	Satish et al.	Jan 2014	B1
8635696	Aziz	Jan 2014	B1
8682054	Xue et al.	Mar 2014	B2
8682812	Ranjan	Mar 2014	B1
8689333	Aziz	Apr 2014	B2
8695096	Zhang	Apr 2014	B1
8713631	Pavlyushchik	Apr 2014	B1
8713681	Silberman et al.	Apr 2014	B2
8726392	McCorkendale et al.	May 2014	B1
8739280	Chess et al.	May 2014	B2
8776229	Aziz	Jul 2014	B1
8782790	Smith et al.	Jul 2014	B1
8782792	Bodke	Jul 2014	B1
8789172	Stolfo et al.	Jul 2014	B2
8789178	Kejriwal et al.	Jul 2014	B2
8793278	Frazier et al.	Jul 2014	B2
8793787	Ismael et al.	Jul 2014	B2
8805947	Kuzkin et al.	Aug 2014	B1
8806647	Daswani et al.	Aug 2014	B1
8813222	Codreanu et al.	Aug 2014	B1
8832829	Manni et al.	Sep 2014	B2
8850570	Ramzan	Sep 2014	B1
8850571	Staniford et al.	Sep 2014	B2
8850584	Alme et al.	Sep 2014	B2
8854474	Blumstein-Koren et al.	Oct 2014	B2
8881234	Narasimhan et al.	Nov 2014	B2
8881271	Butler, II	Nov 2014	B2
8881282	Aziz et al.	Nov 2014	B1
8898788	Aziz et al.	Nov 2014	B1
8935779	Manni et al.	Jan 2015	B2
8949257	Shiffer et al.	Feb 2015	B2
8984638	Aziz et al.	Mar 2015	B1
8990939	Staniford et al.	Mar 2015	B2
8990944	Singh et al.	Mar 2015	B1
8997219	Staniford et al.	Mar 2015	B2
9009822	Ismael et al.	Apr 2015	B1
9009823	Ismael et al.	Apr 2015	B1
9027135	Aziz	May 2015	B1
9071638	Aziz et al.	Jun 2015	B1
9092616	Kumar et al.	Jul 2015	B2
9094443	Martini et al.	Jul 2015	B1
9104867	Thioux et al.	Aug 2015	B1
9106630	Frazier et al.	Aug 2015	B2
9106694	Aziz et al.	Aug 2015	B2
9118715	Staniford et al.	Aug 2015	B2
9148441	Tamersoy et al.	Sep 2015	B1
9159035	Ismael et al.	Oct 2015	B1
9166997	Guo et al.	Oct 2015	B1
9171154	Pereira	Oct 2015	B2
9171160	Vincent et al.	Oct 2015	B2
9176843	Ismael et al.	Nov 2015	B1
9189627	Islam	Nov 2015	B1
9195829	Goradia et al.	Nov 2015	B1
9197664	Aziz et al.	Nov 2015	B1
9202050	Nachenberg	Dec 2015	B1
9203862	Kashyap	Dec 2015	B1
9223972	Vincent	Dec 2015	B1
9225740	Ismael et al.	Dec 2015	B1
9241010	Bennett et al.	Jan 2016	B1
9251343	Vincent et al.	Feb 2016	B1
9262635	Paithane et al.	Feb 2016	B2
9268936	Butler	Feb 2016	B2
9275229	LeMasters	Mar 2016	B2
9280663	Pak et al.	Mar 2016	B2
9282109	Aziz et al.	Mar 2016	B1
9282116	Rovniaguin	Mar 2016	B1
9292686	Ismael et al.	Mar 2016	B2
9294501	Mesdaq et al.	Mar 2016	B2
9300686	Pidathala et al.	Mar 2016	B2
9306960	Aziz	Apr 2016	B1
9306974	Aziz et al.	Apr 2016	B1
9311479	Manni et al.	Apr 2016	B1
9332029	Tikhonov	May 2016	B1
9355247	Thioux et al.	May 2016	B1
9356944	Aziz	May 2016	B1
9363280	Rivlin et al.	Jun 2016	B1
9367681	Ismael et al.	Jun 2016	B1
9398028	Karandikar et al.	Jul 2016	B1
9401142	Rothwell et al.	Jul 2016	B1
9413781	Cunningham et al.	Aug 2016	B2
9426071	Caldejon et al.	Aug 2016	B1
9430646	Mushtaq et al.	Aug 2016	B1
9432389	Khalid et al.	Aug 2016	B1
9438613	Paithane et al.	Sep 2016	B1
9438622	Staniford et al.	Sep 2016	B1
9438623	Thioux et al.	Sep 2016	B1
9459901	Jung et al.	Oct 2016	B2
9467460	Otvagin et al.	Oct 2016	B1
9483644	Paithane et al.	Nov 2016	B1
9495180	Ismael	Nov 2016	B2
9497213	Thompson et al.	Nov 2016	B2
9507935	Ismael et al.	Nov 2016	B2
9516057	Aziz	Dec 2016	B2
9519782	Aziz et al.	Dec 2016	B2
9536091	Paithane et al.	Jan 2017	B2
9537972	Edwards et al.	Jan 2017	B1
9560059	Islam	Jan 2017	B1
9565202	Kindlund et al.	Feb 2017	B1
9578064	Lango et al.	Feb 2017	B2
9591015	Amin et al.	Mar 2017	B1
9591020	Aziz	Mar 2017	B1
9594904	Jain et al.	Mar 2017	B1
9594905	Ismael et al.	Mar 2017	B1
9594912	Thioux et al.	Mar 2017	B1
9609007	Rivlin et al.	Mar 2017	B1
9626509	Khalid et al.	Apr 2017	B1
9628498	Aziz et al.	Apr 2017	B1
9628507	Haq et al.	Apr 2017	B2
9633134	Ross	Apr 2017	B2
9635039	Islam et al.	Apr 2017	B1
9635041	Warman et al.	Apr 2017	B1
9641544	Treat et al.	May 2017	B1
9641546	Manni et al.	May 2017	B1
9654485	Neumann	May 2017	B1
9661009	Karandikar et al.	May 2017	B1
9661018	Aziz	May 2017	B1
9674298	Edwards et al.	Jun 2017	B1
9680862	Ismael et al.	Jun 2017	B2
9690606	Ha et al.	Jun 2017	B1
9690933	Singh et al.	Jun 2017	B1
9690935	Shiffer et al.	Jun 2017	B2
9690936	Malik et al.	Jun 2017	B1
9734138	Rothwell et al.	Aug 2017	B2
9736179	Ismael	Aug 2017	B2
9740857	Ismael et al.	Aug 2017	B2
9747446	Pidathala et al.	Aug 2017	B1
9749294	Marquardt et al.	Aug 2017	B1
9756074	Aziz et al.	Sep 2017	B2
9773112	Rathor et al.	Sep 2017	B1
9781144	Otvagin et al.	Oct 2017	B1
9787700	Amin et al.	Oct 2017	B1
9787706	Otvagin et al.	Oct 2017	B1
9792196	Ismael et al.	Oct 2017	B1
9824209	Ismael et al.	Nov 2017	B1
9824211	Wilson	Nov 2017	B2
9824216	Khalid et al.	Nov 2017	B1
9825976	Gomez et al.	Nov 2017	B1
9825989	Mehra et al.	Nov 2017	B1
9838405	Guo et al.	Dec 2017	B1
9838408	Karandikar et al.	Dec 2017	B1
9838411	Aziz	Dec 2017	B1
9838416	Aziz	Dec 2017	B1
9838417	Khalid et al.	Dec 2017	B1
9846776	Paithane et al.	Dec 2017	B1
9876701	Caldejon et al.	Jan 2018	B1
9888016	Amin et al.	Feb 2018	B1
9888019	Pidathala et al.	Feb 2018	B1
9910988	Vincent et al.	Mar 2018	B1
9912644	Cunningham	Mar 2018	B2
9912681	Ismael et al.	Mar 2018	B1
9912684	Aziz et al.	Mar 2018	B1
9912691	Mesdaq et al.	Mar 2018	B2
9912698	Thioux et al.	Mar 2018	B1
9916440	Paithane et al.	Mar 2018	B1
9921978	Chan et al.	Mar 2018	B1
9934376	Ismael	Apr 2018	B1
9934381	Kindlund et al.	Apr 2018	B1
9946568	Ismael et al.	Apr 2018	B1
9954890	Staniford et al.	Apr 2018	B1
9973531	Thioux	May 2018	B1
10002252	Ismael et al.	Jun 2018	B2
10019338	Goradia et al.	Jul 2018	B1
10019573	Silberman et al.	Jul 2018	B2
10025691	Ismael et al.	Jul 2018	B1
10025927	Khalid et al.	Jul 2018	B1
10027689	Rathor et al.	Jul 2018	B1
10027690	Aziz et al.	Jul 2018	B2
10027696	Rivlin et al.	Jul 2018	B1
10033747	Paithane et al.	Jul 2018	B1
10033748	Cunningham et al.	Jul 2018	B1
10033753	Islam et al.	Jul 2018	B1
10033759	Kabra et al.	Jul 2018	B1
10050998	Singh	Aug 2018	B1
10068091	Aziz et al.	Sep 2018	B1
10075455	Zafar et al.	Sep 2018	B2
10083302	Paithane et al.	Sep 2018	B1
10084813	Eyada	Sep 2018	B2
10089461	Ha et al.	Oct 2018	B1
10097573	Aziz	Oct 2018	B1
10104102	Neumann	Oct 2018	B1
10108446	Steinberg et al.	Oct 2018	B1
10121000	Rivlin et al.	Nov 2018	B1
10122746	Manni et al.	Nov 2018	B1
10133863	Bu et al.	Nov 2018	B2
10133866	Kumar et al.	Nov 2018	B1
10146810	Shiffer et al.	Dec 2018	B2
10148693	Singh et al.	Dec 2018	B2
10165000	Aziz et al.	Dec 2018	B1
10169585	Pilipenko et al.	Jan 2019	B1
10176321	Abbasi et al.	Jan 2019	B2
10178119	Brandwine et al.	Jan 2019	B1
10181029	Ismael et al.	Jan 2019	B1
10191861	Steinberg et al.	Jan 2019	B1
10192052	Singh et al.	Jan 2019	B1
10198574	Thioux et al.	Feb 2019	B1
10200384	Mushtaq et al.	Feb 2019	B1
10200866	Cratsenburg et al.	Feb 2019	B1
10210329	Malik et al.	Feb 2019	B1
10216927	Steinberg	Feb 2019	B1
10218740	Mesdaq et al.	Feb 2019	B1
10242185	Goradia	Mar 2019	B1
10333962	Brandwine et al.	Jun 2019	B1
10454950	Aziz	Oct 2019	B1
10642753	Steinberg	May 2020	B1
20010005889	Albrecht	Jun 2001	A1
20010047326	Broadbent et al.	Nov 2001	A1
20020018903	Kokubo et al.	Feb 2002	A1
20020038430	Edwards et al.	Mar 2002	A1
20020091819	Melchione et al.	Jul 2002	A1
20020095607	Lin-Hendel	Jul 2002	A1
20020116627	Tarbotton et al.	Aug 2002	A1
20020144156	Copeland	Oct 2002	A1
20020162015	Tang	Oct 2002	A1
20020166063	Lachman et al.	Nov 2002	A1
20020169952	DiSanto et al.	Nov 2002	A1
20020184528	Shevenell et al.	Dec 2002	A1
20020188887	Largman et al.	Dec 2002	A1
20020194489	Almogy et al.	Dec 2002	A1
20020194490	Halperin et al.	Dec 2002	A1
20030021728	Sharpe et al.	Jan 2003	A1
20030074578	Ford et al.	Apr 2003	A1
20030084318	Schertz	May 2003	A1
20030101381	Mateev et al.	May 2003	A1
20030115483	Liang	Jun 2003	A1
20030188190	Aaron et al.	Oct 2003	A1
20030191957	Hypponen et al.	Oct 2003	A1
20030200460	Morota et al.	Oct 2003	A1
20030212902	van der Made	Nov 2003	A1
20030229801	Kouznetsov et al.	Dec 2003	A1
20030237000	Denton et al.	Dec 2003	A1
20040003323	Bennett et al.	Jan 2004	A1
20040006473	Mills et al.	Jan 2004	A1
20040015712	Szor	Jan 2004	A1
20040019832	Arnold et al.	Jan 2004	A1
20040024767	Chen	Feb 2004	A1
20040047356	Bauer	Mar 2004	A1
20040083408	Spiegel et al.	Apr 2004	A1
20040088581	Brawn et al.	May 2004	A1
20040093513	Cantrell et al.	May 2004	A1
20040111531	Staniford et al.	Jun 2004	A1
20040117478	Triulzi et al.	Jun 2004	A1
20040117624	Brandt et al.	Jun 2004	A1
20040128355	Chao et al.	Jul 2004	A1
20040133672	Bhattacharya et al.	Jul 2004	A1
20040165588	Pandya	Aug 2004	A1
20040236963	Danford et al.	Nov 2004	A1
20040243349	Greifeneder et al.	Dec 2004	A1
20040249911	Alkhatib et al.	Dec 2004	A1
20040255161	Cavanaugh	Dec 2004	A1
20040268147	Wiederin et al.	Dec 2004	A1
20050005159	Oliphant	Jan 2005	A1
20050021740	Bar et al.	Jan 2005	A1
20050033960	Vialen et al.	Feb 2005	A1
20050033989	Poletto et al.	Feb 2005	A1
20050050148	Mohammadioun et al.	Mar 2005	A1
20050060562	Bhattacharya et al.	Mar 2005	A1
20050086523	Zimmer et al.	Apr 2005	A1
20050091513	Mitomo et al.	Apr 2005	A1
20050091533	Omote et al.	Apr 2005	A1
20050091652	Ross et al.	Apr 2005	A1
20050108562	Khazan et al.	May 2005	A1
20050114663	Cornell et al.	May 2005	A1
20050125195	Brendel	Jun 2005	A1
20050149726	Joshi et al.	Jul 2005	A1
20050157662	Bingham et al.	Jul 2005	A1
20050183143	Anderholm et al.	Aug 2005	A1
20050201297	Peikari	Sep 2005	A1
20050210533	Copeland et al.	Sep 2005	A1
20050238005	Chen et al.	Oct 2005	A1
20050240781	Gassoway	Oct 2005	A1
20050262562	Gassoway	Nov 2005	A1
20050265331	Stolfo	Dec 2005	A1
20050283839	Cowbum	Dec 2005	A1
20060010495	Cohen et al.	Jan 2006	A1
20060015416	Hoffman et al.	Jan 2006	A1
20060015715	Anderson	Jan 2006	A1
20060015747	Van de Ven	Jan 2006	A1
20060021029	Brickell et al.	Jan 2006	A1
20060021054	Costa et al.	Jan 2006	A1
20060031476	Mathes et al.	Feb 2006	A1
20060047665	Neil	Mar 2006	A1
20060070130	Costea et al.	Mar 2006	A1
20060075496	Carpenter et al.	Apr 2006	A1
20060095968	Portolani et al.	May 2006	A1
20060101264	Costea et al.	May 2006	A1
20060101282	Costea et al.	May 2006	A1
20060101516	Sudaharan et al.	May 2006	A1
20060101517	Banzhof et al.	May 2006	A1
20060117385	Mester et al.	Jun 2006	A1
20060123477	Raghavan et al.	Jun 2006	A1
20060137012	Aaron	Jun 2006	A1
20060143709	Brooks et al.	Jun 2006	A1
20060150249	Gassen et al.	Jul 2006	A1
20060156380	Gladstone et al.	Jul 2006	A1
20060161983	Cothrell et al.	Jul 2006	A1
20060161987	Levy-Yurista	Jul 2006	A1
20060161989	Reshef et al.	Jul 2006	A1
20060164199	Gilde et al.	Jul 2006	A1
20060173992	Weber et al.	Aug 2006	A1
20060179147	Tran et al.	Aug 2006	A1
20060184632	Marino et al.	Aug 2006	A1
20060191010	Benjamin	Aug 2006	A1
20060221956	Narayan et al.	Oct 2006	A1
20060236393	Kramer et al.	Oct 2006	A1
20060242709	Seinfeld et al.	Oct 2006	A1
20060248519	Jaeger et al.	Nov 2006	A1
20060248582	Panjwani et al.	Nov 2006	A1
20060251104	Koga	Nov 2006	A1
20060288417	Bookbinder et al.	Dec 2006	A1
20070006288	Mayfield et al.	Jan 2007	A1
20070006313	Porras et al.	Jan 2007	A1
20070008098	Wong	Jan 2007	A1
20070011174	Takaragi et al.	Jan 2007	A1
20070016951	Piccard et al.	Jan 2007	A1
20070019286	Kikuchi	Jan 2007	A1
20070033645	Jones	Feb 2007	A1
20070038677	Reasor et al.	Feb 2007	A1
20070038943	FitzGerald et al.	Feb 2007	A1
20070064689	Shin et al.	Mar 2007	A1
20070074169	Chess et al.	Mar 2007	A1
20070089165	Wei et al.	Apr 2007	A1
20070094730	Bhikkaji et al.	Apr 2007	A1
20070101435	Konanka et al.	May 2007	A1
20070121596	Kurapati et al.	May 2007	A1
20070128855	Cho et al.	Jun 2007	A1
20070130319	Tse et al.	Jun 2007	A1
20070142030	Sinha et al.	Jun 2007	A1
20070143827	Nicodemus et al.	Jun 2007	A1
20070156895	Vuong	Jul 2007	A1
20070157180	Tillmann et al.	Jul 2007	A1
20070157306	Elrod et al.	Jul 2007	A1
20070168988	Eisner et al.	Jul 2007	A1
20070171824	Ruello et al.	Jul 2007	A1
20070174915	Gribble et al.	Jul 2007	A1
20070192500	Lum	Aug 2007	A1
20070192858	Lum	Aug 2007	A1
20070198275	Malden et al.	Aug 2007	A1
20070208822	Wang et al.	Sep 2007	A1
20070209074	Coffman	Sep 2007	A1
20070220607	Sprosts et al.	Sep 2007	A1
20070240218	Tuvell et al.	Oct 2007	A1
20070240219	Tuvell et al.	Oct 2007	A1
20070240220	Tuvell et al.	Oct 2007	A1
20070240222	Tuvell et al.	Oct 2007	A1
20070250930	Aziz et al.	Oct 2007	A1
20070256127	Kraemer et al.	Nov 2007	A1
20070256132	Oliphant	Nov 2007	A2
20070271446	Nakamura	Nov 2007	A1
20080005782	Aziz	Jan 2008	A1
20080018122	Zierler et al.	Jan 2008	A1
20080028463	Dagon et al.	Jan 2008	A1
20080040710	Chiriac	Feb 2008	A1
20080046781	Childs et al.	Feb 2008	A1
20080066179	Liu	Mar 2008	A1
20080072326	Danford et al.	Mar 2008	A1
20080077793	Tan et al.	Mar 2008	A1
20080080518	Hoeflin et al.	Apr 2008	A1
20080086720	Lekel	Apr 2008	A1
20080098476	Syversen	Apr 2008	A1
20080120722	Sima et al.	May 2008	A1
20080134178	Fitzgerald et al.	Jun 2008	A1
20080134334	Kim et al.	Jun 2008	A1
20080141376	Clausen et al.	Jun 2008	A1
20080184367	McMillan et al.	Jul 2008	A1
20080184373	Traut et al.	Jul 2008	A1
20080189787	Arnold et al.	Aug 2008	A1
20080201778	Guo et al.	Aug 2008	A1
20080209557	Herley et al.	Aug 2008	A1
20080215742	Goldszmidt et al.	Sep 2008	A1
20080222729	Chen et al.	Sep 2008	A1
20080244742	Neystadt et al.	Oct 2008	A1
20080263665	Ma et al.	Oct 2008	A1
20080295172	Bohacek	Nov 2008	A1
20080301810	Lehane et al.	Dec 2008	A1
20080307524	Singh et al.	Dec 2008	A1
20080313738	Enderby	Dec 2008	A1
20080320594	Jiang	Dec 2008	A1
20090003317	Kasralikar et al.	Jan 2009	A1
20090007100	Field et al.	Jan 2009	A1
20090013408	Schipka	Jan 2009	A1
20090031423	Liu et al.	Jan 2009	A1
20090036111	Danford et al.	Feb 2009	A1
20090037835	Goldman	Feb 2009	A1
20090044024	Oberheide et al.	Feb 2009	A1
20090044274	Budko et al.	Feb 2009	A1
20090064332	Porras et al.	Mar 2009	A1
20090077666	Chen et al.	Mar 2009	A1
20090083369	Marmor	Mar 2009	A1
20090083855	Apap et al.	Mar 2009	A1
20090089879	Wang et al.	Apr 2009	A1
20090094697	Provos et al.	Apr 2009	A1
20090113425	Ports et al.	Apr 2009	A1
20090125976	Wassermann et al.	May 2009	A1
20090126015	Monastyrsky et al.	May 2009	A1
20090126016	Sobko et al.	May 2009	A1
20090133125	Choi et al.	May 2009	A1
20090144823	Lamastra et al.	Jun 2009	A1
20090158430	Borders	Jun 2009	A1
20090172815	Gu et al.	Jul 2009	A1
20090187992	Poston	Jul 2009	A1
20090193293	Stolfo et al.	Jul 2009	A1
20090198651	Shiffer et al.	Aug 2009	A1
20090198670	Shiffer et al.	Aug 2009	A1
20090198689	Frazier et al.	Aug 2009	A1
20090199274	Frazier et al.	Aug 2009	A1
20090199296	Xie et al.	Aug 2009	A1
20090228233	Anderson et al.	Sep 2009	A1
20090241187	Troyansky	Sep 2009	A1
20090241190	Todd et al.	Sep 2009	A1
20090265692	Godefroid et al.	Oct 2009	A1
20090271867	Zhang	Oct 2009	A1
20090282478	Jiang	Nov 2009	A1
20090300415	Zhang et al.	Dec 2009	A1
20090300761	Park et al.	Dec 2009	A1
20090328185	Berg et al.	Dec 2009	A1
20090328221	Blumfield et al.	Dec 2009	A1
20100005146	Drako et al.	Jan 2010	A1
20100011205	McKenna	Jan 2010	A1
20100017546	Poo et al.	Jan 2010	A1
20100030996	Butler, II	Feb 2010	A1
20100031353	Thomas et al.	Feb 2010	A1
20100037314	Perdisci et al.	Feb 2010	A1
20100043073	Kuwamura	Feb 2010	A1
20100054278	Stolfo et al.	Mar 2010	A1
20100058474	Hicks	Mar 2010	A1
20100064044	Nonoyama	Mar 2010	A1
20100077481	Polyakov et al.	Mar 2010	A1
20100083376	Pereira et al.	Apr 2010	A1
20100094459	Cho et al.	Apr 2010	A1
20100115621	Staniford et al.	May 2010	A1
20100132038	Zaitsev	May 2010	A1
20100154056	Smith et al.	Jun 2010	A1
20100180344	Malyshev et al.	Jul 2010	A1
20100192223	Ismael et al.	Jul 2010	A1
20100220863	Dupaquis et al.	Sep 2010	A1
20100235831	Dittmer	Sep 2010	A1
20100251104	Massand	Sep 2010	A1
20100281102	Chinta et al.	Nov 2010	A1
20100281541	Stolfo et al.	Nov 2010	A1
20100281542	Stolfo et al.	Nov 2010	A1
20100287260	Peterson et al.	Nov 2010	A1
20100299754	Amit et al.	Nov 2010	A1
20100306173	Frank	Dec 2010	A1
20110004737	Greenebaum	Jan 2011	A1
20110025504	Lyon et al.	Feb 2011	A1
20110041179	St hlberg	Feb 2011	A1
20110047594	Mahaffey et al.	Feb 2011	A1
20110047597	Mahaffey et al.	Feb 2011	A1
20110047620	Mahaffey et al.	Feb 2011	A1
20110055907	Narasimhan et al.	Mar 2011	A1
20110055925	Jakobsson	Mar 2011	A1
20110078794	Manni et al.	Mar 2011	A1
20110093951	Aziz	Apr 2011	A1
20110099620	Stavrou et al.	Apr 2011	A1
20110099633	Aziz	Apr 2011	A1
20110099635	Silberman et al.	Apr 2011	A1
20110113231	Kaminsky	May 2011	A1
20110145918	Jung et al.	Jun 2011	A1
20110145920	Mahaffey et al.	Jun 2011	A1
20110145934	Abramovici et al.	Jun 2011	A1
20110167493	Song et al.	Jul 2011	A1
20110167494	Bowen et al.	Jul 2011	A1
20110173213	Frazier et al.	Jul 2011	A1
20110173460	Ito et al.	Jul 2011	A1
20110219449	St. Neitzel et al.	Sep 2011	A1
20110219450	McDougal et al.	Sep 2011	A1
20110225624	Sawhney et al.	Sep 2011	A1
20110225655	Niemela et al.	Sep 2011	A1
20110247072	Staniford et al.	Oct 2011	A1
20110265182	Peinado et al.	Oct 2011	A1
20110289582	Kejriwal et al.	Nov 2011	A1
20110302587	Nishikawa et al.	Dec 2011	A1
20110307954	Melnik et al.	Dec 2011	A1
20110307955	Kaplan et al.	Dec 2011	A1
20110307956	Yermakov et al.	Dec 2011	A1
20110314546	Aziz et al.	Dec 2011	A1
20120023593	Puder et al.	Jan 2012	A1
20120036576	Iyer	Feb 2012	A1
20120054869	Yen et al.	Mar 2012	A1
20120066698	Yanoo	Mar 2012	A1
20120079596	Thomas	Mar 2012	A1
20120084859	Radinsky et al.	Apr 2012	A1
20120096553	Srivastava et al.	Apr 2012	A1
20120110667	Zubrilin et al.	May 2012	A1
20120117652	Manni et al.	May 2012	A1
20120121154	Xue et al.	May 2012	A1
20120124426	Maybee et al.	May 2012	A1
20120174186	Aziz et al.	Jul 2012	A1
20120174196	Bhogavilli et al.	Jul 2012	A1
20120174218	McCoy et al.	Jul 2012	A1
20120198279	Schroeder	Aug 2012	A1
20120210423	Friedrichs et al.	Aug 2012	A1
20120222121	Staniford et al.	Aug 2012	A1
20120254995	Sallam	Oct 2012	A1
20120255001	Sallam	Oct 2012	A1
20120255003	Sallam	Oct 2012	A1
20120255004	Sallam	Oct 2012	A1
20120255012	Sallam	Oct 2012	A1
20120255013	Sallam	Oct 2012	A1
20120255015	Sahita et al.	Oct 2012	A1
20120255017	Sallam	Oct 2012	A1
20120260342	Dube et al.	Oct 2012	A1
20120266244	Green et al.	Oct 2012	A1
20120278886	Luna	Nov 2012	A1
20120297489	Dequevy	Nov 2012	A1
20120304244	Xie et al.	Nov 2012	A1
20120330801	McDougal et al.	Dec 2012	A1
20120331553	Aziz et al.	Dec 2012	A1
20130014259	Gribble et al.	Jan 2013	A1
20130036472	Aziz	Feb 2013	A1
20130042294	Colvin et al.	Feb 2013	A1
20130047257	Aziz	Feb 2013	A1
20130074185	McDougal et al.	Mar 2013	A1
20130086247	Burckart et al.	Apr 2013	A1
20130086684	Mohler	Apr 2013	A1
20130097699	Balupari et al.	Apr 2013	A1
20130097706	Titonis et al.	Apr 2013	A1
20130111587	Goel et al.	May 2013	A1
20130117852	Stute	May 2013	A1
20130117855	Kim et al.	May 2013	A1
20130139264	Brinkley et al.	May 2013	A1
20130145463	Ghosh et al.	Jun 2013	A1
20130160125	Likhachev et al.	Jun 2013	A1
20130160127	Jeong et al.	Jun 2013	A1
20130160130	Mendelev et al.	Jun 2013	A1
20130160131	Madou et al.	Jun 2013	A1
20130167236	Sick	Jun 2013	A1
20130174214	Duncan	Jul 2013	A1
20130185789	Hagiwara et al.	Jul 2013	A1
20130185795	Winn et al.	Jul 2013	A1
20130185798	Saunders et al.	Jul 2013	A1
20130191915	Antonakakis et al.	Jul 2013	A1
20130196649	Paddon et al.	Aug 2013	A1
20130227691	Aziz et al.	Aug 2013	A1
20130246370	Bartram et al.	Sep 2013	A1
20130247186	LeMasters	Sep 2013	A1
20130263260	Mahaffey et al.	Oct 2013	A1
20130291109	Staniford et al.	Oct 2013	A1
20130298192	Kumar et al.	Nov 2013	A1
20130298243	Kumar et al.	Nov 2013	A1
20130305369	Karta et al.	Nov 2013	A1
20130318038	Shiffer et al.	Nov 2013	A1
20130318073	Shiffer et al.	Nov 2013	A1
20130325791	Shiffer et al.	Dec 2013	A1
20130325792	Shiffer et al.	Dec 2013	A1
20130325871	Shiffer et al.	Dec 2013	A1
20130325872	Shiffer et al.	Dec 2013	A1
20140007238	Magee et al.	Jan 2014	A1
20140013434	Ranum et al.	Jan 2014	A1
20140032875	Butler	Jan 2014	A1
20140053260	Gupta et al.	Feb 2014	A1
20140053261	Gupta et al.	Feb 2014	A1
20140130158	Wang et al.	May 2014	A1
20140130161	Golovanov	May 2014	A1
20140137180	Lukacs et al.	May 2014	A1
20140157405	Joll et al.	Jun 2014	A1
20140169762	Ryu	Jun 2014	A1
20140179360	Jackson et al.	Jun 2014	A1
20140181131	Ross	Jun 2014	A1
20140189687	Jung et al.	Jul 2014	A1
20140189866	Shiffer et al.	Jul 2014	A1
20140189882	Jung et al.	Jul 2014	A1
20140215608	Rajagopalan et al.	Jul 2014	A1
20140237600	Silberman et al.	Aug 2014	A1
20140245374	Deerman et al.	Aug 2014	A1
20140280245	Wilson	Sep 2014	A1
20140283037	Sikorski et al.	Sep 2014	A1
20140283063	Thompson et al.	Sep 2014	A1
20140283066	Teddy et al.	Sep 2014	A1
20140289323	Kutaragi et al.	Sep 2014	A1
20140328204	Klotsche et al.	Nov 2014	A1
20140337836	Ismael	Nov 2014	A1
20140337862	Valencia et al.	Nov 2014	A1
20140344926	Cunningham et al.	Nov 2014	A1
20140351935	Shao et al.	Nov 2014	A1
20140373155	Whitehouse et al.	Dec 2014	A1
20140380473	Bu et al.	Dec 2014	A1
20140380474	Paithane et al.	Dec 2014	A1
20150007312	Pidathala et al.	Jan 2015	A1
20150007325	Eliseev et al.	Jan 2015	A1
20150047046	Pavlyushchik	Feb 2015	A1
20150067862	Yu et al.	Mar 2015	A1
20150067866	Ibatullin et al.	Mar 2015	A1
20150074806	Roundy et al.	Mar 2015	A1
20150096022	Vincent et al.	Apr 2015	A1
20150096023	Mesdaq et al.	Apr 2015	A1
20150096024	Haq et al.	Apr 2015	A1
20150096025	Ismael	Apr 2015	A1
20150101047	Sridhara et al.	Apr 2015	A1
20150101048	Sridhara et al.	Apr 2015	A1
20150106942	Borghetti et al.	Apr 2015	A1
20150121524	Fawaz et al.	Apr 2015	A1
20150150130	Fiala et al.	May 2015	A1
20150161386	Gupta et al.	Jun 2015	A1
20150163121	Mahaffey et al.	Jun 2015	A1
20150180886	Staniford et al.	Jun 2015	A1
20150186645	Aziz et al.	Jul 2015	A1
20150199513	Ismael et al.	Jul 2015	A1
20150199531	Ismael et al.	Jul 2015	A1
20150199532	Ismael et al.	Jul 2015	A1
20150205962	Swidowski et al.	Jul 2015	A1
20150220734	Nalluri et al.	Aug 2015	A1
20150220735	Paithane et al.	Aug 2015	A1
20150244730	Vu	Aug 2015	A1
20150288659	Lukacs et al.	Oct 2015	A1
20150327518	Han et al.	Nov 2015	A1
20150365427	Ben-Shalom et al.	Dec 2015	A1
20150372980	Eyada	Dec 2015	A1
20160004869	Ismael et al.	Jan 2016	A1
20160006756	Ismael et al.	Jan 2016	A1
20160019388	Singla et al.	Jan 2016	A1
20160034361	Block et al.	Feb 2016	A1
20160044000	Cunningham	Feb 2016	A1
20160065601	Gong et al.	Mar 2016	A1
20160078225	Ray et al.	Mar 2016	A1
20160078229	Gong et al.	Mar 2016	A1
20160078347	Salajegheh et al.	Mar 2016	A1
20160080345	Safruti et al.	Mar 2016	A1
20160080413	Smith et al.	Mar 2016	A1
20160080417	Thomas et al.	Mar 2016	A1
20160080418	Ray et al.	Mar 2016	A1
20160080420	Ray et al.	Mar 2016	A1
20160092682	Adams et al.	Mar 2016	A1
20160099963	Mahaffey et al.	Apr 2016	A1
20160112451	Jevans	Apr 2016	A1
20160127367	Jevans	May 2016	A1
20160127393	Aziz et al.	May 2016	A1
20160127406	Smith et al.	May 2016	A1
20160142432	Manadhata et al.	May 2016	A1
20160164960	Marinelli et al.	Jun 2016	A1
20160173509	Ray et al.	Jun 2016	A1
20160173510	Harris et al.	Jun 2016	A1
20160191465	Thomas et al.	Jun 2016	A1
20160191547	Zafar et al.	Jun 2016	A1
20160191550	Ismael et al.	Jun 2016	A1
20160205138	Krishnaprasad	Jul 2016	A1
20160232353	Gupta et al.	Aug 2016	A1
20160253498	Valencia et al.	Sep 2016	A1
20160261612	Mesdaq et al.	Sep 2016	A1
20160285897	Gantman et al.	Sep 2016	A1
20160285914	Singh et al.	Sep 2016	A1
20160301703	Aziz	Oct 2016	A1
20160301704	Hassanzadeh et al.	Oct 2016	A1
20160301709	Hassanzadeh et al.	Oct 2016	A1
20160314298	Martini et al.	Oct 2016	A1
20160323295	Joram	Nov 2016	A1
20160335110	Paithane et al.	Nov 2016	A1
20160359890	Deen et al.	Dec 2016	A1
20160379136	Chen et al.	Dec 2016	A1
20160381057	Das et al.	Dec 2016	A1
20170017537	Razin et al.	Jan 2017	A1
20170026949	Ouyang et al.	Jan 2017	A1
20170046510	Chen et al.	Feb 2017	A1
20170083703	Abbasi et al.	Mar 2017	A1
20170083705	Lee et al.	Mar 2017	A1
20170093899	Horesh et al.	Mar 2017	A1
20170118241	Call et al.	Apr 2017	A1
20170149804	Kolbitsch et al.	May 2017	A1
20170195347	Hay et al.	Jul 2017	A1
20170223046	Singh	Aug 2017	A1
20170243000	Shraim et al.	Aug 2017	A1
20170249560	Cudak et al.	Aug 2017	A1
20170272453	Murray et al.	Sep 2017	A1
20170316206	Zou et al.	Nov 2017	A1
20180013770	Ismael	Jan 2018	A1
20180048660	Paithane et al.	Feb 2018	A1
20180121316	Ismael et al.	May 2018	A1
20180176247	Smith et al.	Jun 2018	A1
20180288077	Siddiqui et al.	Oct 2018	A1

Foreign Referenced Citations (11)

Number	Date	Country
2439806	Jan 2008	GB
2490431	Oct 2012	GB
0206928	Jan 2002	WO
0223805	Mar 2002	WO
2007117636	Oct 2007	WO
2008041950	Apr 2008	WO
2011084431	Jul 2011	WO
2011112348	Sep 2011	WO
2012075336	Jun 2012	WO
2012145066	Oct 2012	WO
2013067505	May 2013	WO

Non-Patent Literature Citations (64)

Entry
U.S. Appl. No. 15/258,656, filed Sep. 7, 2016 Final Office Action dated Oct. 26, 2018.
U.S. Appl. No. 15/258,656, filed Sep. 7, 2016 Non-Final Office Action dated Apr. 6, 2018.
“Mining Specification of Malicious Behavior”—Jha et al, UCSB, Sep. 2007 https://www.cs.ucsb.edu/.about.chris/research/doc/esec07.sub.--mining.pdf-.
“Network Security: NetDetector—Network Intrusion Forensic System (NIFS) Whitepaper”, (“NetDetector Whitepaper”), (2003).
“When Virtual is Better Than Real”, IEEEXplore Digital Library, available at, http://ieeexplore.ieee.org/xpl/articleDetails.isp?reload=true&arnumbe- r=990073, (Dec. 7, 2013).
Abdullah, et al., Visualizing Network Data for Intrusion Detection, 2005 IEEE Workshop on Information Assurance and Security, pp. 100-108.
Adetoye, Adedayo , et al., “Network Intrusion Detection & Response System”, (“Adetoye”), (Sep. 2003).
Apostolopoulos, George; hassapis, Constantinos; “V-eM: A cluster of Virtual Machines for Robust, Detailed, and High-Performance Network Emulation”, 14th IEEE International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, Sep. 11-14, 2006, pp. 117-126.
Aura, Tuomas, “Scanning electronic documents for personally identifiable information”, Proceedings of the 5th ACM workshop on Privacy in electronic society. ACM, 2006.
Baecher, “The Nepenthes Platform: An Efficient Approach to collect Malware”, Springer-verlag Berlin Heidelberg, (2006), pp. 165-184.
Bayer, et al., “Dynamic Analysis of Malicious Code”, J Comput Virol, Springer-Verlag, France., (2006), pp. 67-77.
Boubalos, Chris , “extracting syslog data out of raw pcap dumps, seclists.org, Honeypots mailing list archives”, available at http://seclists.org/honeypots/2003/q2/319 (“Boubalos”), (Jun. 5, 2003).
Chaudet, C. , et al., “Optimal Positioning of Active and Passive Monitoring Devices”, International Conference on Emerging Networking Experiments and Technologies, Proceedings of the 2005 ACM Conference on Emerging Network Experiment and Technology, CoNEXT '05, Toulousse, France, (Oct. 2005), pp. 71-82.
Chen, P. M. and Noble, B. D., “When Virtual is Better Than Real, Department of Electrical Engineering and Computer Science”, University of Michigan (“Chen”) (2001).
Cisco “Intrusion Prevention for the Cisco ASA 5500-x Series” Data Sheet (2012).
Cohen, M.I. , “PyFlag—An advanced network forensic framework”, Digital investigation 5, Elsevier, (2008), pp. S112-S120.
Costa, M. , et al., “Vigilante: End-to-End Containment of Internet Worms”, SOSP '05, Association for Computing Machinery, Inc., Brighton U.K., (Oct. 23-26, 2005).
Didier Stevens, “Malicious PDF Documents Explained”, Security & Privacy, IEEE, IEEE Service Center, Los Alamitos, CA, US, vol. 9, No. 1, Jan. 1, 2011, pp. 80-82, XP011329453, ISSN: 1540-7993, DOI: 10.1109/MSP.2011.14.
Distler, “Malware Analysis: An Introduction”, SANS Institute InfoSec Reading Room, SANS Institute, (2007).
Dunlap, George W. , et al., “ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay”, Proceeding of the 5th Symposium on Operating Systems Design and Implementation, USENIX Association, (“Dunlap”), (Dec. 9, 2002).
FireEye Malware Analysis & Exchange Network, Malware Protection System, FireEye Inc., 2010.
FireEye Malware Analysis, Modern Malware Forensics, FireEye Inc., 2010.
FireEye v.6.0 Security Target, pp. 1-35, Version 1.1, FireEye Inc., May 2011.
Goel, et al., Reconstructing System State for Intrusion Analysis, Apr. 2008 SIGOPS Operating Systems Review, vol. 42 Issue 3, pp. 21-28.
Gregg Keizer: “Microsoft's HoneyMonkeys Show Patching Windows Works”, Aug. 8, 2005, XP055143386, Retrieved from the Internet: URL:http://www.informationweek.com/microsofts-honeymonkeys-show-patching-windows-works/d/d-d/1035069? [retrieved on Jun. 1, 2016].
Heng Yin et al, Panorama: Capturing System-Wide Information Flow for Malware Detection and Analysis, Research Showcase © CMU, Carnegie Mellon University, 2007.
Hiroshi Shinotsuka, Malware Authors Using New Techniques to Evade Automated Threat Analysis Systems, Oct. 26, 2012, http://www.symantec.com/connect/blogs/, pp. 1-4.
Idika et al., A-Survey-of-Malware-Detection-Techniques, Feb. 2, 2007, Department of Computer Science, Purdue University.
Isohara, Takamasa, Keisuke Takemori, and Ayumu Kubota. “Kernel-based behavior analysis for android malware detection.” Computational intelligence and Security (CIS), 2011 Seventh International Conference on. IEEE, 2011.
Kaeo, Merike , “Designing Network Security”, (“Kaeo”), (Nov. 2003).
Kevin A Roundy et al: “Hybrid Analysis and Control of Malware”, Sep. 15, 2010, Recent Advances in Intrusion Detection, Springer Berlin Heidelberg, Berlin, Heidelberg, pp. 317-338, XP019150454 ISBN:978-3-642-15511-6.
Khaled Salah et al: “Using Cloud Computing to Implement a Security Overlay Network”, Security & Privacy, IEEE, IEEE Service Center, Los Alamitos, CA, US, vol. 11, No. 1, Jan. 1, 2013 (Jan. 1, 2013).
Kim, H. , et al., “Autograph: Toward Automated, Distributed Worm Signature Detection”, Proceedings of the 13th Usenix Security Symposium (Security 2004), San Diego, (Aug. 2004), pp. 271-286.
King, Samuel T., et al., “Operating System Support for Virtual Machines”, (“King”), (2003).
Kreibich, C. , et al., “Honeycomb-Creating Intrusion Detection Signatures Using Honeypots”, 2nd Workshop on Hot Topics in Networks (HotNets-11), Boston, USA, (2003).
Kristoff, J. , “Botnets, Detection and Mitigation: DNS-Based Techniques”, NU Security Day, (2005), 23 pages.
Lastline Labs, The Threat of Evasive Malware, Feb. 25, 2013, Lastline Labs, pp. 1-8.
Li et al., A VMM-Based System Call Interposition Framework for Program Monitoring, Dec. 2010, IEEE 16th International Conference on Parallel and Distributed Systems, pp. 706-711.
Lindorfer, Martina, Clemens Kolbitsch, and Paolo Milani Comparetti. “Detecting environment-sensitive malware.” Recent Advances in Intrusion Detection. Springer Berlin Heidelberg, 2011.
Marchette, David J., “Computer Intrusion Detection and Network Monitoring: A Statistical Viewpoint”, (“Marchette”), (2001).
Moore, D. , et al., “Internet Quarantine: Requirements for Containing Self-Propagating Code”, INFOCOM, vol. 3, (Mar. 30-Apr. 3, 2003), pp. 1901-1910.
Morales, Jose A., et al., ““Analyzing and exploiting network behaviors of malware.””, Security and Privacy in Communication Networks. Springer Berlin Heidelberg, 2010. 20-34.
Mori, Detecting Unknown Computer Viruses, 2004, Springer-Verlag Berlin Heidelberg.
Natvig, Kurt , “SANDBOXII: Internet”, Virus Bulletin Conference, (“Natvig”), (Sep. 2002).
NetBIOS Working Group. Protocol Standard for a NetBIOS Service on a TCP/UDP transport: Concepts and Methods. STD 19, RFC 1001, Mar. 1987.
Newsome, J. , et al., “Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software”, In Proceedings of the 12th Annual Network and Distributed System Security, Symposium (NDSS '05), (Feb. 2005).
Nojiri, D. , et al., “Cooperation Response Strategies for Large Scale Attack Mitigation”, DARPA Information Survivability Conference and Exposition, vol. 1, (Apr. 22-24, 2003), pp. 293-302.
Oberheide et al., CloudAV.sub.—N-Version Antivirus in the Network Cloud, 17th USENIX Security Symposium USENIX Security '08 Jul. 28-Aug. 1, 2008 San Jose, CA.
Reiner Sailer, Enriquillo Valdez, Trent Jaeger, Roonald Perez, Leendert van Doom, John Linwood Griffin, Stefan Berger., sHype: Secure Hypervisor Appraoch to Trusted Virtualized Systems (Feb. 2, 2005) (“Sailer”).
Silicon Defense, “Worm Containment in the Internal Network”, (Mar. 2003), pp. 1-25.
Singh, S. , et al., “Automated Worm Fingerprinting”, Proceedings of the ACM/USENIX Symposium on Operating System Design and Implementation, San Francisco, California, (Dec. 2004).
Thomas H. Ptacek, and Timothy N. Newsham , “Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection”, Secure Networks, (“Ptacek”), (Jan. 1998).
U.S. Appl. No. 15/258,656, filed Sep. 7, 2016 Non-Final Office Action dated May 30, 2019.
Venezia, Paul , “NetDetector Captures Intrusions”, InfoWorld Issue 27, (“Venezia”), (Jul. 14, 2003).
Vladimir Getov: “Security as a Service in Smart Clouds—Opportunities and Concerns”, Computer Software and Applications Conference (COMPSAC), 2012 IEEE 36th Annual, IEEE, Jul. 16, 2012 (Jul. 16, 2012).
Wahid et al., Characterising the Evolution in Scanning Activity of Suspicious Hosts, Oct. 2009, Third International Conference on Network and System Security, pp. 344-350.
Whyte, et al., “DNS-Based Detection of Scanning Works in an Enterprise Network”, Proceedings of the 12th Annual Network and Distributed System Security Symposium, (Feb. 2005), 15 pages.
Williamson, Matthew M., “Throttling Viruses: Restricting Propagation to Defeat Malicious Mobile Code”, ACSAC Conference, Las Vegas, NV, USA, (Dec. 2002), pp. 1-9.
Yuhei Kawakoya et al: “Memory behavior-based automatic malware unpacking in stealth debugging environment”, Malicious and Unwanted Software (Malware), 2010 5th International Conference on, IEEE, Piscataway, NJ, USA, Oct. 19, 2010, pp. 39-46, XP031833827, ISBN:978-1-4244-8-9353-1.
Zhang et al., The Effects of Threading, Infection Time, and Multiple-Attacker Collaboration on Malware Propagation, Sep. 2009, IEEE 28th International Symposium on Reliable Distributed Systems, pp. 73-82.
U.S. Appl. No. 15/258,656, filed Sep. 7, 2016 Advisory Action dated Jan. 31, 2019.
U.S. Appl. No. 15/258,656, filed Sep. 7, 2016 Final Office Action dated Sep. 18, 2019.
U.S. Appl. No. 15/258,656, filed Sep. 7, 2016 Non-Final Office Action dated Jan. 31, 2020.
U.S. Appl. No. 15/258,656, filed Sep. 7, 2016 Notice of Allowance dated May 27, 2020.

Provisional Applications (1)

	Number	Date	Country
	62316390	Mar 2016	US

Verification and enhancement using detection systems located at the network periphery and endpoint devices

Information

Patent Number

Date Filed

Date Issued

Inventors

Original Assignees

Examiners

Agents

CPC

Field of Search

CPC

International Classifications

Term Extension