Detecting malicious command and control cloud traffic

Patent metadata

Field	Value
Publication number	US-12592959-B2
Application number	US-202318340076-A
Country	US
Kind code	B2
Filing date	Jun 23, 2023
Priority date	Jul 12, 2022
Publication date	Mar 31, 2026
Grant date	Mar 31, 2026

Abstract

The technology disclosed relates to a method, system, and non-transitory computer-readable media that detects malicious communication between a command and control (C2) cloud resource on a cloud application and malware on an infected host, using a network security system. The network security system reroutes the cloud traffic to the network security system. The incoming requests of the cloud traffic are directed to a cloud application in the plurality of cloud applications, and wherein the cloud application has a plurality of resources. The network security system analyzes the incoming requests, determines that the incoming requests are targeted at one or more malicious resources in the plurality of resources. Also, the network security system prevents transmission of the incoming requests to the malicious resources, by making the malicious resources unavailable for receiving future incoming requests, while keeping other resources in the plurality of resources available for receiving the future incoming requests.

First claim

We claim:

1 . A computer-implemented method of detecting malicious communication between a command and control (C2) cloud resource on a cloud application and malware on an infected host, including:
a network security system intermediating cloud traffic between a plurality of clients and a plurality of cloud applications over a secure tunnel established between the plurality of clients and the network security system, wherein the secure tunnel reroutes the cloud traffic to the network security system; the network security system receiving one or more incoming requests from a client in the plurality of clients, wherein the incoming requests are directed to a cloud application in the plurality of cloud applications, and wherein the cloud application has a plurality of resources; the network security system, based on analyzing the incoming requests, determining that the incoming requests are targeted at one or more malicious resources in the plurality of resources; and the network security system, based on the determination:
preventing transmission of the incoming requests to the malicious resources,
making the malicious resources unavailable for receiving future incoming requests, and
keeping other resources in the plurality of resources available for receiving the future incoming requests.

2 . The computer-implemented method of claim 1 , wherein the analyzing the incoming requests includes the network security system detecting a beaconing behavior of the incoming requests.

3 . The computer-implemented method of claim 2 , wherein the beaconing behavior is detected based on the incoming requests making frequent checks to a same unified resource locator (URL).

4 . The computer-implemented method of claim 2 , wherein the beaconing behavior is detected based on the incoming requests being issued by previously unexecuted processes on the client.

5 . The computer-implemented method of claim 2 , wherein the beaconing behavior is detected based on the incoming requests attempting to transmit contents that have substantially similar data sizes, wherein the substantially similar data sizes have sizes with a difference of less than 1 KB.

6 . The computer-implemented method of claim 2 , wherein the beaconing behavior is detected based on the incoming requests being iteratively issued using a same Hypertext Transfer Protocol (HTTP) method and receiving failed responses.

7 . The computer-implemented method of claim 1 , wherein the analyzing the incoming requests includes the network security system detecting that the incoming requests are en route to an anomalous entity on the cloud application.

8 . The computer-implemented method of claim 1 , wherein the analyzing the incoming requests includes the network security system detecting that the incoming requests originate from an anomalous agent running on the client.

9 . The computer-implemented method of claim 1 , wherein the analyzing the incoming requests includes the network security system detecting that the incoming requests use an anomalous username to access the cloud application.

10 . The computer-implemented method of claim 1 , wherein the analyzing the incoming requests includes the network security system detecting that the incoming requests use an anomalous authentication method to access the cloud application.

11 . The computer-implemented method of claim 1 , wherein the analyzing the incoming requests includes the network security system detecting a cat's-paw behavior of the client.

12 . The computer-implemented method of claim 1 , wherein the analyzing the incoming requests includes the network security system detecting an anomalous hostname access patterns of the incoming requests.

13 . The computer-implemented method of claim 1 , wherein the analyzing the incoming requests includes the network security system detecting a malicious task sequence execution being attempted by the incoming requests.

14 . A non-transitory, computer-readable storage medium having stored thereon instructions to detect malicious communication between a command and control (C2) cloud resource on a cloud application and malware on an infected host that, upon execution by one or more processors, cause the one or more processors to:
intermediate cloud traffic between a plurality of clients and a plurality of cloud applications over a secure tunnel established between the plurality of clients and a network security system, wherein the secure tunnel reroutes the cloud traffic to the network security system; receive one or more incoming requests from a client in the plurality of clients, wherein the incoming requests are directed to a cloud application in the plurality of cloud applications, and wherein the cloud application has a plurality of resources; based on analyzing the one or more incoming requests, determine that the incoming requests are targeted at one or more malicious resources in the plurality of resources; and based on the determination:
prevent transmission of the incoming requests to the malicious resources,
make the malicious resources unavailable for receiving future incoming requests, and
keep other resources in the plurality of resources available for receiving the future incoming requests.

15 . The non-transitory, computer-readable storage medium of claim 14 , wherein the analyzing the incoming requests includes detecting a beaconing behavior of the incoming requests.

16 . The non-transitory, computer-readable storage medium of claim 15 , wherein the beaconing behavior is detected based on the incoming requests making frequent checks to a same unified resource locator (URL).

17 . The non-transitory, computer-readable storage medium of claim 15 , wherein the beaconing behavior is detected based on the incoming requests being issued by previously unexecuted processes on the client.

18 . The non-transitory, computer-readable storage medium of claim 14 , wherein the analyzing the incoming requests includes:
detecting that the incoming requests use an anomalous username to access the cloud application, or detecting that the incoming requests use an anomalous authentication method to access the cloud application, or detecting that the incoming requests are en route to an anomalous entity on the cloud application, or detecting that the incoming requests originate from an anomalous agent running on the client or the incoming requests use an anomalous username to access the cloud application or a cat's-paw behavior of the client, or detecting anomalous hostname access patterns of the incoming requests, or detecting a malicious task sequence execution being attempted by the incoming requests, or a combination thereof.

19 . A network security system, comprising:
one or more processors; and a memory having stored thereon instructions to detect malicious communication between a command and control (C2) cloud resource on a cloud application and malware on an infected host that, upon execution by the one or more processors, cause the one or more processors to:
intermediate cloud traffic between a plurality of clients and a plurality of cloud applications over a secure tunnel established between the plurality of clients and the network security system, wherein the secure tunnel reroutes the cloud traffic to the network security system;
receive one or more incoming requests from a client in the plurality of clients, wherein the incoming requests are directed to a cloud application in the plurality of cloud applications, and wherein the cloud application

Assignees

• Netskope Inc

Inventors

• Mulugeta Dagmawi
• Canzanese Jr Raymond Joseph
• Estep Colin
• Yang Siying
• Hwong Jenko
• Eiras Gustavo Palazolo
• Wang Yongxing

Classifications

• H04L63/30

  for supporting lawful interception, monitoring or retaining of communications or communication related information (circuit switched telephony call monitoring H04M3/2281) · CPC title

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title

• H04L63/029 Primary

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title