Malware analysis platform for threat intelligence made actionable

• US 10,200,389 B2
• Filed: 02/29/2016
• Issued: 02/05/2019
• Est. Priority Date: 02/29/2016
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: Rostamabadi, Farshad, Rostami-Hesarsorkh, Shadi, Vasudevan, Sudarshan
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Murphy, J. Brant
• Application Number:
  US15/056,974
• Publication Number:
  US 20170251002A1
• Time in Patent Office: 1,072 Days
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Techniques for a malware analysis platform for threat intelligence made actionable are disclosed. In some embodiments, a system, process, and/or computer program product for a malware analysis platform for threat intelligence made actionable includes receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis; processing the log files to determine artifacts associated with malware; and performing an action based on an artifact.

Claims

1. A computer-implemented method, comprising:

receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis;

processing the log files to determine artifacts associated with malware, wherein a raw log file generated for each of the plurality of samples comprises one or more lines based on results of the automated malware analysis for each of the plurality of samples, and wherein processing the log files to determine artifacts associated with malware further comprises;

processing the raw log files for each of the plurality of samples to generate processed log files, wherein each of the processed log files provides a human readable format of the automated malware analysis; and

identifying distinct lines in each of the processed log files for performing line counts to provide a statistical view of the results of the automated malware analysis; and

determining line counts for each of the log files to provide a statistical view of malware analysis results data that includes how many times each distinct line is associated with malware samples and with benign samples.

2. The method of claim 1, further comprising:

perform an action based on an artifact, wherein the artifact is a high-risk artifact, and wherein the high-risk artifact is determined to be associated with malware based on the automated malware analysis.

3. The method of claim 1, wherein performing automated malware analysis includes performing a dynamic analysis.

4. The method of claim 1, wherein performing automated malware analysis includes performing a static analysis.

5. The method of claim 1, wherein a log file for a sample comprises one or more lines and one or more sub-lines based on the automated malware analysis results for the sample.

6. The method of claim 1, further comprising:

determining whether any of the distinct lines are suspicious.

7. A system, comprising:

a processor configured to;

receive a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis;

process the log files to determine artifacts associated with malware, wherein a raw log file generated for each of the plurality of samples comprises one or more lines based on results of the automated malware analysis for each of the plurality of samples, and wherein process the log files to determine artifacts associated with malware further comprises;

process the raw log files for each of the plurality of samples to generate processed log files, wherein each of the processed log files provides a human readable format of the automated malware analysis; and

identify distinct lines in each of the processed log files for performing line counts to provide a statistical view of the results of the automated malware analysis; and

determine line counts for each of the log files to provide a statistical view of malware analysis results data that includes how many times each distinct line is associated with malware samples and with benign samples; and

a memory coupled to the processor and configured to provide the processor with instructions.

8. The system recited in claim 7, wherein the processor is further configured to:

perform an action based on an artifact wherein the artifact is a high-risk artifact, and wherein the high-risk artifact is determined to be associated with malware based on the automated malware analysis.

9. The system recited in claim 7, wherein performing automated malware analysis includes performing a dynamic analysis.

10. The system recited in claim 7, wherein performing automated malware analysis includes performing a static analysis.

11. The system recited in claim 7, wherein a log file for a sample comprises one or more lines and one or more sub-lines based on the automated malware analysis results for the sample.

12. The system recited in claim 7, wherein the processor is further configured to:

update the line counts for each of the distinct lines based on line counting performed for previously processed log files.

13. The system recited in claim 7, wherein the processor is further configured to:

determine whether any of the distinct lines are suspicious.

14. A computer program product, the computer program product being embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:

receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis;

processing the log files to determine artifacts associated with malware, wherein a raw log file generated for each of the plurality of samples comprises one or more lines based on results of the automated malware analysis for each of the plurality of samples, and wherein processing the log files to determine artifacts associated with malware further comprises;

processing the raw log files for each of the plurality of samples to generate processed log files, wherein each of the processed log files provides a human readable format of the automated malware analysis; and

identifying distinct lines in each of the processed log files for performing line counts to provide a statistical view of the results of the automated malware analysis; and

determining line counts for each of the log files to provide a statistical view of malware analysis results data that includes how many times each distinct line is associated with malware samples and with benign samples.

15. The computer program product recited in claim 14, further comprising computer instructions for:

perform an action based on an artifact, wherein the artifact is a high-risk artifact.

16. The computer program product recited in claim 14, further comprising computer instructions for:

perform an action based on an artifact wherein the artifact is a high-risk artifact, and wherein the high-risk artifact is determined to be associated with malware based on the automated malware analysis.

17. The computer program product recited in claim 14, wherein performing automated malware analysis includes performing a dynamic analysis.

18. The computer program product recited in claim 14, wherein performing automated malware analysis includes performing a static analysis.

19. The computer program product recited in claim 14, wherein a log file for a sample comprises one or more lines and one or more sub-lines based on the automated malware analysis results for the sample.

20. The computer program product recited in claim 14, further comprising computer instructions for:

determining whether any of the distinct lines are suspicious.