System and method of detecting whether a source of a packet flow transmits packets which bypass an operating system stack

Patent metadata

Field	Value
Publication number	US-11902121-B2
Application number	US-202217822656-A
Country	US
Kind code	B2
Filing date	Aug 26, 2022
Priority date	Jun 5, 2015
Publication date	Feb 13, 2024
Grant date	Feb 13, 2024

Abstract

A method includes capturing first data associated with a first packet flow originating from a first host using a first capture agent deployed at the first host to yield first flow data, capturing second data associated with a second packet flow originating from the first host from a second capture agent deployed on a second host to yield second flow data and comparing the first flow data and the second flow data to yield a difference. When the difference is above a threshold value, the method includes determining that the second packet flow was transmitted by a component that bypassed an operating stack of the first host or a packet capture agent at the device to yield a determination, detecting that hidden network traffic exists, and predicting a malware issue with the first host based on the determination.

First claim

What is claimed is:

1. A method comprising:
first capturing first data associated with a first packet flow originating from a computing device, the first capturing occurring at first layer of a network;
second capturing second data associated with a second packet flow originating from the computing device, the second capturing occurring at a second layer of the network different from the first layer;
in response to a difference between the first and second data exceeding a threshold value;
determining a portion of the second data includes hidden network traffic transmitted by bypassing an operating stack of the computing device or a packet capture agent of the computing device; and
performing a corrective action to reduce future flow of hidden traffic from the computer device.

2. The method of claim 1 , the corrective action comprising one or more of: isolating a virtual machine, isolating a container, limiting packets to and from a first host, requiring all packets to and from the first host to flow through the operating stack of the first host, isolating the first host, shutting down the first host, or notifying an administrator.

3. The method of claim 2 , wherein the corrective action includes requiring all packets to and from the computing device to flow through an operating stack of the computing device.

4. The method of claim 2 , wherein the corrective action includes isolating a virtual machine and/or a container.

5. The method of claim 2 , wherein the corrective action includes the computing device.

6. The method of claim 2 , wherein the corrective action includes shutting down the computing device.

7. The method of claim 1 , further comprising predicting a presence of a malicious entity in the computing device based on the hidden network traffic.

8. A non-transitory computer-readable storage medium storing instructions which, when executed by a processor, cause the processor to perform operations comprising:
first capturing first data associated with a first packet flow originating from a computing device, the first capturing occurring at first layer of a network;
second capturing second data associated with a second packet flow originating from the computing device, the second capturing occurring at a second layer of the network different from the first layer;
in response to a difference between the first and second data exceeding a threshold value;
determining a portion of the second data includes hidden network traffic transmitted by bypassing an operating stack of the computing device or a packet capture agent of the computing device; and
performing a corrective action to reduce future flow of hidden traffic from the computer device.

9. The non-transitory computer-readable storage medium of claim 8 , the corrective action comprising one or more of: isolating a virtual machine, isolating a container, limiting packets to and from a first host, requiring all packets to and from the first host to flow through the operating stack of the first host, isolating the first host, shutting down the first host, or notifying an administrator.

10. The non-transitory computer-readable storage medium of claim 9 , wherein the corrective action includes requiring all packets to and from the computing device to flow through an operating stack of the computing device.

11. The non-transitory computer-readable storage medium of claim 9 , wherein the corrective action includes isolating a virtual machine and/or a container.

12. The non-transitory computer-readable storage medium of claim 9 , wherein the corrective action includes isolating the computing device.

13. The non-transitory computer-readable storage medium of claim 9 , wherein the corrective action includes shutting down the computing device.

14. The non-transitory computer-readable storage medium of claim 8 , further comprising predicting a presence of a malicious entity in the computing device based on the hidden network traffic.

15. A system comprising:
a non-transitory computer-readable memory storing instructions;
a processor programmed to cooperate with the instructions in memory to perform operations comprising:
first capturing first data associated with a first packet flow originating from a computing device, the first capturing occurring at first layer of a network;
second capturing second data associated with a second packet flow originating from the computing device, the second capturing occurring at a second layer of the network different from the first layer;
in response to a difference between the first and second data exceeding a threshold value;
determining a portion of the second data includes hidden network traffic transmitted by bypassing an operating stack of the computing device or a packet capture agent of the computing device; and
performing a corrective action to reduce future flow of hidden traffic from the computer device.

16. The system of claim 15 , the corrective action comprising one or more of: isolating a virtual machine, isolating a container, limiting packets to and from a first host, requiring all packets to and from the first host to flow through the operating stack of the first host, isolating the first host, shutting down the first host, or notifying an administrator.

17. The system of claim 16 , wherein the corrective action includes requiring all packets to and from the computing device to flow through an operating stack of the computing device.

18. The system of claim 16 , wherein the corrective action includes isolating a virtual machine and/or a container.

19. The system of claim 16 , wherein the corrective action includes isolating and/or shutting down the computing device.

20. The system of claim 15 , further comprising predicting a presence of a malicious entity in the computing device based on the hidden network traffic.

Assignees

• Cisco Tech Inc

Inventors

• Deen Khawar
• Yadav Navindra
• Gupta Anubhav
• Gandham Shashidhar
• Prasad Rohit Chandra
• Singh Abhishek Ranjan
• Chang Shih-Chun

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• H04L43/08

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L41/0893

  Assignment of logical groups to network elements · CPC title

• H04L67/01

  Protocols · CPC title