Automatically detecting authorized remote administration sessions in a network monitoring system

Patent metadata

Field	Value
Publication number	US-12348386-B2
Application number	US-202418583370-A
Country	US
Kind code	B2
Filing date	Feb 21, 2024
Priority date	Dec 20, 2017
Publication date	Jul 1, 2025
Grant date	Jul 1, 2025

Abstract

In one embodiment, a service receives administration traffic data in a network associated with a remote administration session in which a control device remotely administers a client device. The service analyzes the administration traffic data to determine whether any portion of the administration traffic data is resulting from an administration session involving a trusted administrator. The service flags a first portion of the administration traffic data as authorized when the first portion of the administration traffic data is determined to result from an administration session involving a trusted administrator, and a second portion of the administration traffic data is non-flagged. The service assesses the second portion of the administration traffic data using a machine learning-based traffic classifier to determine whether the second portion of the administration traffic data is malicious.

First claim

What is claimed is:

1. A method comprising:
receiving, at a service, administration traffic data in a network associated with a remote administration session in which a control device remotely administers a client device;
analyzing, by the service, the administration traffic data to determine whether any portion of the administration traffic data results from an authorized application;
flagging, by the service, a first portion of the administration traffic data as authorized when the first portion of the administration traffic data is determined to result from the administration session involving the authorized application, wherein a second portion of the administration traffic data is non-flagged;
assessing, by the service, the administration traffic data to determine whether any portion of the administration traffic data is malicious; and
performing, by the service and based on assessing the administration traffic data, a mitigation action in response to determining that a portion of the administration traffic data is malicious, wherein performance of the mitigation action is suppressed when the portion of the administration traffic data determined to be malicious is the first portion of the administration traffic data that is flagged as authorized.

2. The method as in claim 1 , wherein analyzing the administration traffic data comprises:
determining, by the service, that the control device was operated by a trusted administrator during the remote administration session.

3. The method as in claim 1 , wherein at least a portion of the administration traffic data comprises data generated by a monitoring process executed by the control device.

4. The method as in claim 3 , wherein at least a portion of the administration traffic data comprises data generated by a network traffic monitor between the control device and the client device in the network, and wherein analyzing the administration traffic data comprises:
matching, by the service, a network address captured by the monitoring process executed by the control device to a network address captured by the network traffic monitor.

5. The method as in claim 3 , wherein analyzing the administration traffic data comprises:
identifying, by the service and from the data generated by the monitoring process executed by the control device, a particular process that was executed by the control device to initiate the remote administration session with the client device; and
determining, by the service, whether the particular process is authorized.

6. The method as in claim 1 , wherein determining that the portion of the administration traffic data is malicious is indicative of malfeasance by a trusted administrator in the network.

7. The method as in claim 1 , wherein the remote administration session comprises at least one of: a remote desktop administration session, a Secure Shell (SSH) session, or Secure Copy (SCP) session.

8. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the one or more network interfaces and executing one or more operations; and
a memory storing a process that is executable by the processor, the process when executed causing the apparatus to:
receive administration traffic data in a network associated with a remote administration session in which a control device remotely administers a client device;
analyze the administration traffic data to determine whether any portion of the administration traffic data results from an authorized application;
flag a first portion of the administration traffic data as authorized when the first portion of the administration traffic data is determined to result from the administration session involving the authorized application, wherein a second portion of the administration traffic data is non-flagged;
assess the administration traffic data to determine whether any portion of the administration traffic data is malicious; and
perform, based on assessing the administration traffic data, a mitigation action in response to determining that a portion of the administration traffic data is malicious, wherein performance of the mitigation action is suppressed when the portion of the administration traffic data determined to be malicious is the first portion of the administration traffic data that is flagged as authorized.

9. The apparatus as in claim 8 , wherein the apparatus analyzes the administration traffic data by:
determining that the control device was operated by a trusted administrator during the remote administration session.

10. The apparatus as in claim 8 , wherein at least a portion of the administration traffic data comprises data generated by a monitoring process executed by the control device.

11. The apparatus as in claim 10 , wherein at least a portion of the administration traffic data comprises data generated by a network traffic monitor between the control device and the client device in the network, and wherein the apparatus analyzes the administration traffic data by:
matching a network address captured by the monitoring process executed by the control device to a network address captured by the network traffic monitor.

12. The apparatus as in claim 10 , wherein the apparatus analyzes the administration traffic data by:
identifying, from the data generated by the monitoring process executed by the control device, a particular process that was executed by the control device to initiate the remote administration session with the client device; and
determining whether the particular process is authorized.

13. The apparatus as in claim 8 , wherein determining that the portion of the administration traffic data is malicious is indicative of malfeasance by a trusted administrator in the network.

14. The apparatus as in claim 8 , wherein the remote administration session comprises at least one of: a remote desktop administration session, a Secure Shell (SSH) session, or Secure Copy (SCP) session.

15. A tangible, non-transitory, computer-readable medium that program instructions that cause a device to execute a process comprising:
receiving administration traffic data in a network associated with a remote administration session in which a control device remotely administers a client device;
analyzing the administration traffic data to determine whether any portion of the administration traffic data results from an authorized application;
flagging a first portion of the administration traffic data as authorized when the first portion of the administration traffic data is determined to result from the administration session involving the authorized application, wherein a second portion of the administration traffic data is non-flagged;
assessing the administration traffic data to determine whether any portion of the administration traffic data is malicious; and
performing, based on assessing the administration traffic data, a mitigation action in response to determining that a portion of the administration traffic data is malicious, wherein performance of the mitigation action is suppressed when the portion of the administration traffic data determined to be malicious is the first portion of the administration traffic data that is flagged as authorized.

16. The tangible, non-transitory, computer-readable medium as in claim 15 , wherein analyzing the administration traffic data comprises:
determining that the control device was operated by an authorized administrator during the remote administration session.

17. The tangible, non-transitory, computer-readable medium as in claim

Assignees

• Cisco Tech Inc

Inventors

• Mcgrew David
• Rehak Martin
• Anderson Blake Harrell
• Amin Sunil

Classifications

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title

• H04W12/12

  Detection or prevention of fraud · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title