System and method for detecting exfiltration content
First Claim
1. A computer-implemented method for detecting exfiltration of data, comprising:
- executing a malicious content suspect within a virtual machine that is configured to simulate a target operating environment, wherein the malicious content suspect comprises content that is potentially malicious;
performing a packet inspection on attempted outbound network traffic by a packet inspector running within the virtual machine, the packet inspection to determine whether a portion of the attempted outbound network traffic matches one or more portions of predetermined network traffic patterns or signatures;
determining whether the attempted outbound network traffic includes at least one environmental property, which is unique or distinctive of the target operating environment including at least the virtual machine, by at least determining the portion of the attempted outbound network traffic matches the one or more portions of predetermined network traffic patterns or signatures, the match indicates that the malicious content suspect is attempting to perform an exfiltration of data; and
transmitting an alert indicating that the malicious content suspect is attempting to perform an exfiltration of data from the virtual machine based on determining that the attempted outbound network traffic includes the at least one environmental property of the target operating environment and precluding migration of the attempted outbound network traffic outside of the virtual machine when the attempted outbound network traffic includes the at least one environmental property that is unique or distinctive to the target operating environment.
7 Assignments
0 Petitions
Accused Products
Abstract
Techniques for detecting exfiltration content are described herein. According to one embodiment, a malicious content suspect is executed and a packet inspection of outbound network traffic is performed by a packet inspector running within the virtual machine. Occurring before the outbound network traffic leaving the virtual machine, the packet inspector determines whether a portion of outbound network traffic matches one or more portions of predetermined network traffic patterns or signatures. If so, a determination is made whether the outbound network traffic includes at least one environmental property of the virtual machine that is unique or almost unique to the virtual machine. If so, migration of the outbound network traffic outside of the virtual machine is precluded and an alert is transmitted. The alert includes the malicious content suspect that is attempting to perform an exfiltration of data.
-
Citations
28 Claims
-
1. A computer-implemented method for detecting exfiltration of data, comprising:
-
executing a malicious content suspect within a virtual machine that is configured to simulate a target operating environment, wherein the malicious content suspect comprises content that is potentially malicious; performing a packet inspection on attempted outbound network traffic by a packet inspector running within the virtual machine, the packet inspection to determine whether a portion of the attempted outbound network traffic matches one or more portions of predetermined network traffic patterns or signatures; determining whether the attempted outbound network traffic includes at least one environmental property, which is unique or distinctive of the target operating environment including at least the virtual machine, by at least determining the portion of the attempted outbound network traffic matches the one or more portions of predetermined network traffic patterns or signatures, the match indicates that the malicious content suspect is attempting to perform an exfiltration of data; and transmitting an alert indicating that the malicious content suspect is attempting to perform an exfiltration of data from the virtual machine based on determining that the attempted outbound network traffic includes the at least one environmental property of the target operating environment and precluding migration of the attempted outbound network traffic outside of the virtual machine when the attempted outbound network traffic includes the at least one environmental property that is unique or distinctive to the target operating environment. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8)
-
-
9. A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor of a system, cause the processor to perform operations for detecting exfiltration, comprising:
-
executing a malicious content suspect within a virtual machine that is configured to simulate a target operating environment, wherein the malicious content suspect comprises content that is potentially malicious; performing a packet inspection within the virtual machine on attempted outbound network traffic by analyzing a portion of the attempted outbound network traffic in comparison to one or more portions of predetermined network traffic patterns or signatures; determining whether the attempted outbound network traffic includes at least one environmental property of the target operating environment represented by the virtual machine that is unique or distinctive of the target operating environment by at least determining that the portion of the attempted outbound network traffic matches the one or more portions of predetermined network traffic patterns or signatures, the at least one environmental property is unique or distinctive of the target operating environment and the match indicates that the malicious content suspect is attempting to perform an exfiltration of data; and transmitting an alert indicating that the malicious content suspect is attempting to perform an exfiltration of data from the virtual machine based on determining that the attempted outbound network traffic includes the at least one environmental property of the target operating environment and precluding migration of the attempted outbound network traffic outside of the virtual machine when the attempted outbound network traffic includes the at least one environmental property that is unique or distinctive to the target operating environment. - View Dependent Claims (10, 11, 12, 13, 14, 15, 16, 17)
-
-
18. A system, comprising:
-
a processor; and a memory coupled to the processor for storing instructions, which when executed from the memory, cause the processor to execute a malicious content suspect within a virtual machine that is configured to simulate a target operating environment, wherein the malicious content suspect comprises content that is potentially malicious, perform a packet inspection, by a packet inspector executed by the processor and running within the virtual machine, on attempted outbound network traffic, the packet inspection to determine whether a portion of the attempted outbound network traffic matches one or more portions of predetermined network traffic patterns or signatures, determine whether the attempted outbound network traffic includes at least one environmental property of the target operating environment that is unique or distinctive of the target operating environment based on determining that the portion of the attempted outbound network traffic matches the one or more portions of predetermined network traffic patterns or signatures, and transmit an alert indicating that the malicious content suspect is attempting to perform an exfiltration of data from the virtual machine upon determining that the attempted outbound network traffic includes the at least one environmental property of the target operating environment and precluding migration of the attempted outbound network traffic outside of the virtual machine when the attempted outbound network traffic includes the at least one environmental property that is unique or distinctive to the target operating environment. - View Dependent Claims (19, 20, 21, 22, 23, 24, 25, 26, 27, 28)
-
Specification