Patent Document ID: 8065722
Application ID: 11085633
Patent Status: 1

Claim One:
1. A signature generator to create signatures identifying malicious network traffic, the signature generator comprising: a network connection adapted for receiving data of malicious network traffic and substantially free of data of benign network traffic from a network wherein the network connection is to network darkspace, the network packets comprised of data packets associated with different communication units; a disambiguator receiving the malicious network traffic to convert obfuscated data of the malicious network traffic to a normalized form; a semantic encoder collecting the multiple data packets of the communication units into structured packets sets, a structure of the structured packet sets indicating normalized protocol function of the data packets of the communication units; a weighter assigning different weights to different portions of the structure of the structured packet sets; a cluster analyzer for grouping the data of malicious traffic received from the network connection into similar clusters the cluster analyzer determining distances among data according to values of the data of the weighted structured packets sets and grouping the data packets of different communications units into clusters based on this distance being below a threshold value; and a signature extractor operating on a given cluster to extract a previously unidentified signature, the signature representative of common features of the malicious data of the cluster, the signature extracted from the given cluster based on an assumption that the data is malicious and based on common features of the data within the given cluster.