Methods and systems for improving beaconing detection algorithms

Patent metadata

Field	Value
Publication number	US-10284584-B2
Application number	US-201615166468-A
Country	US
Kind code	B2
Filing date	May 27, 2016
Priority date	Nov 6, 2014
Publication date	May 7, 2019
Grant date	May 7, 2019

Abstract

A method (and structure) includes receiving, as input data into a computer-implemented processing procedure, at least one listing of at least one of time series data and potential candidate periods of potential beaconing activity. The input data is processed, using a processor on a computer, to evaluate the input data as if the input data represents data points of an input analog signal subject to principles of communication theory and having determinable statistical characteristics.

First claim

What is claimed is:

1. A method of deploying computer resources, said method comprising provisioning a memory device in a server accessible via a network with a set of computer-readable instructions for a computer to execute a method of detecting beaconing behavior, wherein the method of detecting beaconing behavior comprises:
receiving network records for a site being evaluated for beaconing behavior;
preprocessing the network records to identify candidate source and destination pairs for detecting beaconing behavior, each candidate source and destination pair being associated with a specific time interval in a plurality of time intervals forming a time range, the plurality of time intervals and time range having been predefined;
executing a three-stage evaluation processing to reduce false positives by reducing noise and checking adequacy of a sampling rate, and to detect potential multiple interleaved periods, the three-stage evaluation processing comprising:
evaluating a listing of time series derived from the preprocessing of the network records for statistical characteristics and eliminating times that fall outside a pre-set statistical measurement as failing a noise evaluation in which candidate intervals are presumed as resultant from an underlying normal distribution;
evaluating a listing of candidate periods and eliminating the listing as comprising a bad sampling at a specific sampling granularity under a Nyquist sampling requirement if more than a pre-set number of points of the candidate periods listing are non-zero during an activity bucket counting at the specific sampling granularity; and
evaluating time series data for potential multiple interleaved periods, using a Gaussian Mixture Model (GMM) analysis and as selected by minimizing a Bayesian Information Criterion (BIC); and

determining candidate frequencies from the candidate source and destination pairs as likely candidate frequencies and/or periodicities of beaconing activities based on the evaluating.

2. The method of deploying computer resources of claim 1 , wherein the server one of:
executes the method of detecting beaconing behavior based on network data received from a local area network of computers for which the server serves as a network portal;
receives a request from a computer via the network to execute the method of detecting beaconing behavior, receives data from the requesting computer to be processed by the method of detecting beaconing behavior, and returns to the requesting computer a result of executing the method of detecting beaconing behavior on the received data; and
receives a request from a computer via the network to execute the method of detecting beaconing behavior and transmits the set of computer-readable instructions to the requesting computer to itself execute the method of detecting beaconing behavior by the requesting computer.

3. The method of deploying computer resources of claim 1 , wherein the server provides a service of executing the method of detecting beaconing behavior as a cloud service.

Assignees

• IBM

Inventors

• Hu Xin
• Jang Jiyong
• Schales Douglas
• Stoecklin Marc
• Wang Ting

Classifications

• H04L63/101

  Access control lists [ACL] · CPC title

• G06F21/00

  Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title