CONFIRMING A MALWARE INFECTION ON A CLIENT DEVICE USING A REMOTE ACCESS CONNECTION TOOL, TO IDENTIFY A MALICIOUS FILE BASED ON FUZZ HASHES

• US 20170177869A1
• Filed: 03/09/2017
• Published: 06/22/2017
• Est. Priority Date: 03/31/2015
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Langton, Jacob Asher, Quinlan, Daniel J., Adams, Kyle
• Granted Patent: US 9,953,164 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A device may receive a trigger to determine whether one or more client devices, of a set of client devices, are infected by a malicious file. The device may generate file identification information associated with the malicious file based on receiving the trigger to determine whether the one or more client devices are infected by the malicious file. The device may obtain remote access to the one or more client devices using a connection tool based on receiving the trigger to determine whether the one or more client devices are infected by the malicious file. The device may obtain information, associated with the one or more client devices, using the remote access. The device may provide information indicating whether the one or more client devices are infected by the malicious file based on the file identification information and the information associated with the one or more client devices.

Claims

1-20. -20. (canceled)

21. A device, comprising:

one or more processors to;

receive a trigger to determine whether one or more client devices, of a set of client devices, are infected by a malicious file;

determine file identification information associated with the malicious file based on receiving the trigger to determine whether the one or more client devices are infected by the malicious file,

the file identification information including a first set of hashes associated with execution results of the malicious file;

obtain information, associated with the one or more client devices and based on receiving the trigger, to determine whether the one or more client devices are infected by the malicious file,

the information including one or more second sets of hashes associated with each of the one or more client devices, respectively;

generate a plurality of similarity scores,

each of the plurality of similarity scores indicating a measure of similarity between the first set of hashes and each of the one or more second sets of hashes;

determine, based on the plurality of similarity scores, that at least one of the one or more client devices is infected by the malicious file; and

provide information indicating that the at least one of the one or more client devices is infected by the malicious file.

22. The device of claim 21, where the one or more processors, when receiving the trigger, are to:

receive the trigger based on monitoring network activity associated with the one or more client devices.

23. The device of claim 21, where the one or more processors, when determining that the at least one of the one or more client devices is infected by the malicious file, are to:

determine that the at least one of the one or more client devices is infected by the malicious file based on at least one similarity score, of the plurality of similarity scores, satisfying a threshold,

the at least one similarity score corresponding to the at least one of the one or more client devices.

24. The device of claim 21, where at least one of the first set of hashes or the second sets of hashes comprises fuzzy hashes generated using a plurality of hashing techniques.

25. The device of claim 21, where the one or more processors are further to:

determine a confidence score for the at least one of the one or more client devices based on the file identification information and the information associated with the one or more client devices,

the confidence score satisfying a threshold; and

where the one or more processors, when providing the information indicating that the at least one of the one or more client devices is infected by the malicious file, are to;

provide information indicating that the at least one of the one or more client devices is infected by the malicious file based on the confidence score satisfying the threshold.

26. The device of claim 21, where the one or more processors, when obtaining information to determine whether the one or more client devices are infected by the malicious file, are to:

obtain information to determine whether the one or more client devices are infected by the malicious file after obtaining remote access using a connection tool.

27. The device of claim 26, where the one or more processors, when determining that the at least one of the one or more client devices is infected by the malicious file, are to:

cause a remediation action to be performed using the connection tool based on determining that the at least one of the one or more client devices is infected by the malicious file.

28. A computer-readable medium storing instructions, the instructions comprising:

one or more instructions that, when executed by one or more processors, cause the one or more processors to;

receive a trigger to determine whether one or more client devices, of a set of client devices, are infected by a malicious file;

determine file identification information associated with the malicious file based on receiving the trigger to determine whether the one or more client devices are infected by the malicious file,

the file identification information including a first set of hashes associated with execution results of the malicious file;

obtain information, associated with the one or more client devices and based on receiving the trigger, to determine whether the one or more client devices are infected by the malicious file,

the information including one or more second sets of hashes associated with each of the one or more client devices, respectively;

generate a plurality of similarity scores,

each of the plurality of similarity scores indicating a measure of similarity between the first set of hashes and each of the one or more second sets of hashes;

determine, based on the plurality of similarity scores, that at least one of the one or more client devices is infected by the malicious file; and

provide information indicating that the at least one of the one or more client devices is infected by the malicious file.

29. The computer-readable medium of claim 28, where the one or more instructions, that cause the one or more processors to receive the trigger, are to:

receive the trigger based on monitoring network activity associated with the one or more client devices.

30. The computer-readable medium of claim 28, where the one or more instructions, that cause the one or more processors to determine that the at least one of the one or more client devices is infected by the malicious file, are to:

determine that the at least one of the one or more client devices is infected by the malicious file based on at least one similarity score, of the plurality of similarity scores, satisfying a threshold,

the at least one similarity score corresponding to the at least one of the one or more client devices.

31. The computer-readable medium of claim 28, where at least one of the first set of hashes or the second sets of hashes comprises fuzzy hashes generated using a plurality of hashing techniques.

32. The computer-readable medium of claim 28, where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:

determine a confidence score for the at least one of the one or more client devices based on the file identification information and the information associated with the one or more client devices,

the confidence score satisfying a threshold; and

where the one or more instructions, that cause the one or more processors to provide the information indicating that the at least one of the one or more client devices is infected by the malicious file, are to;

provide information indicating that the at least one of the one or more client devices is infected by the malicious file based on the confidence score satisfying the threshold.

33. The computer-readable medium of claim 28, where the one or more instructions, that cause the one or more processors to obtain information to determine whether the one or more client devices are infected by the malicious file, are to:

obtain information to determine whether the one or more client devices are infected by the malicious file after obtaining remote access using a connection tool.

34. The computer-readable medium of claim 33, where the one or more instructions, that cause the one or more processors to determine that the at least one of the one or more client devices is infected by the malicious file, are to:

cause a remediation action to be performed using the connection tool based on determining that the at least one of the one or more client devices is infected by the malicious file.

35. A method, comprising:

receiving, by a device, a trigger to determine whether one or more client devices, of a set of client devices, are infected by a malicious file;

determining, by the device, file identification information associated with the malicious file based on receiving the trigger to determine whether the one or more client devices are infected by the malicious file,

the file identification information including a first set of hashes associated with execution results of the malicious file;

obtaining, by the device, information, associated with the one or more client devices and based on receiving the trigger, to determine whether the one or more client devices are infected by the malicious file,

the information including one or more second sets of hashes associated with each of the one or more client devices, respectively;

generating, by the device, a plurality of similarity scores,

each of the plurality of similarity scores indicating a measure of similarity between the first set of hashes and each of the one or more second sets of hashes;

determining, by the device and based on the plurality of similarity scores, that at least one of the one or more client devices is infected by the malicious file; and

providing, by the device, information indicating that the at least one of the one or more client devices is infected by the malicious file.

36. The method of claim 35, where receiving the trigger comprises: