Collecting algorithmically generated domains

Patent metadata

Field	Value
Publication number	US-11036859-B2
Application number	US-202016814909-A
Country	US
Kind code	B2
Filing date	Mar 10, 2020
Priority date	Dec 18, 2014
Publication date	Jun 15, 2021
Grant date	Jun 15, 2021

Abstract

Generating a set of attempted external contacts associated with a malware sample is disclosed. A malware sample is executed in an accelerated computing environment. In the accelerated computing environment, a guest time is advanced more quickly than a time by which a host time is advanced. A set of one or more attempted external contacts generated by the executing malware sample is recorded. The set of attempted external contacts includes at least one generated domain name. A remedial action is taken with respect to the generated domain name.

First claim

What is claimed is:

1. A system, comprising:
a processor configured to:
execute, in an accelerated computing environment, a malware sample authored by a malicious entity, wherein a guest time associated with the accelerated computing environment is advanced more quickly than a time by which a host time associated with the system is advanced;
record a set of one or more attempts made by the executing malware sample to contact one or more external resources, wherein the set of attempted external contacts includes at least one algorithmically generated domain name generated by the executing malware; and
take a remedial action with respect to the generated domain name, wherein taking the remedial action includes preventing a potentially compromised system from contacting the algorithmically generated domain name, at least in part, by causing the generated domain name to be registered by a party other than 1) the malicious entity or 2) an entity associated with the malicious entity, and thereby preventing malicious access with the compromised system; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 wherein the processor is further configured to provide the generated domain name to a DNS module.

3. The system of claim 1 wherein the accelerated computing environment comprises a virtual machine instance.

4. The system of claim 3 wherein the accelerated computing environment is selectively accelerated by a hypervisor configured to accelerate the guest time using a time interrupt customization.

5. The system of claim 3 wherein the accelerated computing environment is selectively accelerated by a hypervisor configured to accelerate the guest time using a time polling customization.

6. The system of claim 1 wherein the accelerated computing environment comprises a non-virtualized platform and wherein an operating system associated with the accelerated computing environment is configured to accelerate the guest time using at least one of a time interrupt customization and a time polling customization.

7. The system of claim 1 wherein advancing the guest time includes advancing a set of virtualized time sources.

8. The system of claim 7 wherein advancing the set of virtualized time sources includes determining, for each virtualized time source, a respective transformation applicable to a given type of virtualized time source.

9. The system of claim 1 wherein a HALT instruction, when received by the system from the malware sample, is returned from at a first time that is shorter than a second time expected by the malware sample.

10. The system of claim 9 wherein at least one time source associated with the accelerated computing environment is advanced in response to the HALT instruction.

11. The system of claim 10 wherein a virtualized time source is advanced by a difference between the first time and second time.

12. The system of claim 9 wherein, when a HALT instruction is received, a sleep time is reduced.

13. The system of claim 12 wherein the sleep time is set to zero.

14. The system of claim 1 further comprising a network time protocol module configured to respond to the accelerated computing environment, when contacted by the accelerated computing environment, with the guest time.

15. The system of claim 1 wherein the output comprises a blacklist.

16. The system of claim 1 wherein the guest time is initialized to a future time that is selected by an administrator as a starting time from which algorithmically generated domains are to be generated.

17. The system of claim 1 wherein recording the set of one or more domain names includes logging DNS requests made by the malware sample executing in the accelerated computing environment.

18. The system of claim 1 further comprising an entropy testing module configured to determine that the malware sample exhibits algorithmic domain generation properties when executed, and in response, cause the execution of the sample in the accelerated computing environment.

19. A method, comprising:
executing, in an accelerated computing environment, a malware sample authored by a malicious entity, wherein a guest time associated with the accelerated computing environment is advanced more quickly than a time by which a host time associated with the system is advanced;
recording a set of one or more attempts made by the executing malware sample to contact one or more external resources, wherein the set of attempted external contacts includes at least one algorithmically generated domain name generated by the executing malware; and
taking a remedial action with respect to the generated domain name, wherein taking the remedial action includes preventing a potentially compromised system from contacting the algorithmically generated domain name, at least in part, by causing the generated domain name to be registered by a party other than 1) the malicious entity or 2) an entity associated with the malicious entity, and thereby preventing malicious access with the compromised system.

20. The method of claim 19 further comprising providing the generated domain name to a DNS module.

21. The method of claim 19 wherein the accelerated computing environment comprises a virtual machine instance.

22. The method of claim 21 wherein the accelerated computing environment is selectively accelerated by a hypervisor configured to accelerate the guest time using a time interrupt customization.

23. The method of claim 21 wherein the accelerated computing environment is selectively accelerated by a hypervisor configured to accelerate the guest time using a time polling customization.

24. The method of claim 19 wherein the accelerated computing environment comprises a non-virtualized platform and wherein an operating system associated with the accelerated computing environment is configured to accelerate the guest time using at least one of a time interrupt customization and a time polling customization.

25. The method of claim 19 wherein advancing the guest time includes advancing a set of virtualized time sources.

26. The method of claim 25 wherein advancing the set of virtualized time sources includes determining, for each virtualized time source, a respective transformation applicable to a given type of virtualized time source.

27. The method of claim 19 wherein a HALT instruction, when received by the system from the malware sample, is returned from at a first time that is shorter than a second time expected by the malware sample.

28. The method of claim 27 wherein at least one time source associated with the accelerated computing environment is advanced in response to the HALT instruction.

29. The method of claim 28 wherein a virtualized time source is advanced by a difference between the first time and second time.

30. The method of claim 27 wherein, when a HALT instruction is received, a sleep time is reduced.

31. The method of claim 30 wherein the sleep time is set to zero.

32. The method of claim 19 further comprising responding with the guest time, by a network time protocol module, when contacted by the accelerated computing environment.

33. The method of claim 19 wherein the output comprises a blacklist.

34. The method of cl

Assignees

• Palo Alto Networks Inc

Inventors

• Salsamendi Ryan C
• Seger Robert A

Classifications

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/562

  Static detection · CPC title

• G06F2221/033

  Test or assess software · CPC title