Detecting and mitigating malware by evaluating HTTP errors
US11632393B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Oct 16, 2020 |
| Grant date | Apr 18, 2023 |
| Priority date | — |
| Expiry date | Jun 15, 2041 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L63/1425
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
Malware is detected and mitigated by differentiating HTTP error generation patterns between errors generated by malware, and errors generated by benign users/software. In one embodiment, a malware detector system receives traffic that includes HTTP errors and successful HTTP requests. Error traffic and the successful request traffic are segmented for further analysis. The error traffic is supplied to a clustering component, which groups the errors, e.g., based on their URI pages and parameters. During clustering, various statistical features are extracted (as feature vectors) from one or more perspectives, namely, error provenance, error generation, and error recovery. The feature vectors are supplied to a classifier component, which is trained to distinguish malware-generated errors from benign errors. Once trained, the classifier takes an error cluster and its surrounding successful HTTP requests as inputs, and it produces a verdict on whether a particular cluster is malicious. The classifier output then drives an automated mitigation operation.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.