Proxy server-based malware detection

Patent metadata

Field	Value
Publication number	US-10834051-B2
Application number	US-201615389343-A
Country	US
Kind code	B2
Filing date	Dec 22, 2016
Priority date	Apr 8, 2013
Publication date	Nov 10, 2020
Grant date	Nov 10, 2020

Abstract

Disclosed are various embodiments for malware detection by way of proxy servers. In one embodiment, a proxied request for a network resource from a network site is received from a client device by a proxy server application. The proxied request is analyzed to determine whether the proxied request includes protected information transmitted in an unsecured manner. It is then determined whether the network resource comprises malware based at least in part on an execution of the network resource or whether the proxied request includes the protected information transmitted in the unsecured manner. The proxy server application refrains from sending data generated by the network resource to the client device in response to the proxied request when the network resource is determined to comprise the malware.

First claim

Therefore, the following is claimed:

1. A system, comprising:
at least one computing device; and
a proxy server application executable in the at least one computing device, wherein when executed the proxy server application causes the at least one computing device to at least:
receive a proxied request from a client device for a network resource from a network site;
analyze the proxied request to determine whether the proxied request includes protected information transmitted in an unsecured manner;
determine that the client device is affected by malware based at least in part on the proxied request including the protected information transmitted in the unsecured manner; and
refrain from sending data generated by the network resource to the client device in response to determining that the client device is affected by the malware.

2. The system of claim 1 , wherein when executed the proxy server application further causes the at least one computing device to at least:
receive the network resource from the network site;
execute the network resource within an execution environment, the execution environment being configured to mimic a configuration of the client device; and
determine whether the network resource comprises malware further based at least in part on the execution of the network resource.

3. The system of claim 1 , wherein when executed the proxy server application further causes the at least one computing device to at least:
determine a source of the malware based at least in part on the proxied request or telemetry data received from the client device by the proxy server application; and
implement an action in response to determining the source of the malware.

4. The system of claim 3 , wherein the action comprises blocking proxied requests by the client device for network resources of the network site corresponding to the source of the malware.

5. The system of claim 3 , wherein the action comprises logging an indication of the source of the malware or generating an alert including the indication of the source of the malware.

6. The system of claim 3 , wherein the action comprises determining that another client device is affected by the malware based at least in part on another proxied request received from the other client device, the other proxied request being associated with the source of the malware.

7. The system of claim 3 , wherein the action comprises configuring a warning to be returned to another client device in response to proxied requests by the other client device for network resources of the network site corresponding to the source of the malware.

8. The system of claim 3 , wherein the action comprises configuring processing of a proxied network resource received from the source of the malware by the proxy server application to remove the malware before returning the proxied network resource to the client device.

9. The system of claim 3 , wherein the client device is configured to report the telemetry data to the proxy server application in response to receiving a proxied network resource from the proxy server application, and determining that the client device is affected by the malware further comprises:
determining that the client device is affected by the malware in response to detecting at least one of:
an absence of the telemetry data expected to be received from the client device, or
an abnormality in the telemetry data received from the client device.

10. The system of claim 9 , wherein the abnormality is detected from at least one of: memory consumption data, data storage usage data, network connection data, system configuration data, or process state data.

11. The system of claim 1 , wherein the protected information transmitted in the unsecured manner comprises:
a credit card number being sent in clear text via the proxied request,
a password being sent in clear text via the proxied request, or
predefined protected information associated with the client device.

12. The system of claim 1 , wherein determining that the client device is affected by the malware further comprises detecting an absence of another proxied request that is expected to be received from the client device.

13. The system of claim 1 , wherein determining that the client device is affected by the malware further comprise detecting that the proxied request is for canary data, the canary data being hidden from a user interface of the client device.

14. A method, comprising:
receiving, via at least one of one or more computing devices, a proxied request from a client device for a network resource from a network site;
determining, via at least one of the one or more computing devices, whether the network resource is correlated with malware based at least in part on a browsing history associated with at least one other client device;
executing, within an execution environment of the one or more computing devices, the network resource in response to determining that the network resource is correlated with malware; and
determining, via at least one of the one or more computing devices, whether the network resource comprises malware based at least in part on the execution of the network resource.

15. The method of claim 14 , further comprising sending, via at least one of the one or more computing devices, data generated by the network resource to the client device in response to the proxied request when the network resource is determined not to comprise the malware.

16. The method of claim 14 , further comprising sending, via at least one of the one or more computing devices, data encoding a warning to the client device in place of data generated by the network resource to the client device in response to the proxied request when the network resource is determined to comprise the malware.

17. The method of claim 14 , further comprising:
analyzing, via at least one of the one or more computing devices, the proxied request to determine whether the proxied request includes protected information transmitted in an unsecured manner; and
determining, via at least one of the one or more computing devices, whether the network resource comprises malware based at least in part on whether the proxied request includes the protected information transmitted in the unsecured manner.

18. The method of claim 17 , wherein the one or more computing devices include programmable hardware configured to perform the analyzing, the programmable hardware including at least one of: a field programmable gate array (FPGA), a field programmable object array (FPOA), or a memristor array.

19. The method of claim 14 , further comprising:
receiving, via at least one of the one or more computing devices, a user-submitted report identifying the network resource as comprising the malware; and
determining, via at least one of the one or more computing devices, whether the network resource comprises malware based at least in part on the user-submitted report.

20. A non-transitory computer-readable medium embodying a program executable in at least one computing device, wherein when executed the program causes the at least one computing device to at least:
receive a proxied request from a client device for a network resource from a network site;
analyze the proxied request to determine whether the proxied request includes protected information transmitted in an unsecured manner;
determine whether the network resource comprises malware based at least in part on an execution of the network resource or whether the proxied

Assignees

• Amazon Tech Inc

Inventors

• Mcclintock Jon Arron
• Johansson Jesper Mikael
• Roths Andrew Jay

Classifications

• H04L67/56

  Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) · CPC title

• H04L63/0254 Primary

  Stateful filtering · CPC title

• H04L41/06

  Management of faults, events, alarms or notifications · CPC title

• G08B21/18

  Status alarms (G08B21/02 takes precedence) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title