Detection of malicious network connections

Patent metadata

Field	Value
Publication number	US-9344441-B2
Application number	US-201414485731-A
Country	US
Kind code	B2
Filing date	Sep 14, 2014
Priority date	Sep 14, 2014
Publication date	May 17, 2016
Grant date	May 17, 2016

Abstract

In one embodiment a method, system and apparatus is described for detecting a malicious network connection, the method system and apparatus including determining, for each connection over a network, if each connection is a persistent connection, if, as a result of the determining, a first connection is determined to be a persistent connection, collecting connection statistics for the first connection, creating a feature vector for the first connection based on the collected statistics, performing outlier detection for all of the feature vector for all connections over a network which have been determined to be persistent connections, and reporting detected outliers. Related methods, systems and apparatus are also described.

First claim

What is claimed is:

1. A method for detecting a malicious network connection, the method comprising:
determining, for each connection over a network, if each connection is a persistent connection, wherein the persistence, p, of a connection is defined as:

p
⁡

(

c
,
W

)

=

1
n

⁢

∑

i
=
1

n

⁢

c
i

⁢

b
i

where:
c is the connection in question;
W=[b 1 , . . . b n ] is the observation window composed of n measurement windows; and
1c i b i is a function which is equal to 1 if the connection was active at least once during the measurement window b i , otherwise the function 1c i b i is equal to 0;
if, as a result of the determining, a first connection is determined to be a persistent connection, collecting connection statistics for the first connection;
creating a feature vector for the first connection based on the collected statistics, wherein the feature vectors comprise more than one of the following features:
logarithm of the total amount of bytes sent or received within the persistent connection;
autocorrelation of time series generated by sent bytes of packets within the persistent connection; and
ratio of bytes sent and received by the persistent connection;
performing outlier detection for all of the feature vectors for all connections over a network which have been determined to be persistent connections, wherein the outlier detection is based on detecting deviation from an anticipated value of a curve of at least one feature of the feature vectors showing feature values versus probability; and
reporting detected outliers.

2. The method according to claim 1 wherein the persistent connection comprises a connection where the connection occurs repeatedly in time.

3. The method according to claim 1 wherein a persistent connection is characterized as having a value p≧0.2.

4. The method according to claim 1 wherein a persistence threshold is where p in the range of 0.5-0.8.

5. The method according to claim 1 wherein the steps of determining if each connection is a persistent connection and collecting connection information are performed repeatedly.

6. The method according to claim 1 wherein the steps of creating the feature vector, performing outlier detection, and reporting detected outliers are performed repeatedly.

7. The method according to claim 1 , wherein the feature vectors comprise more than one of the following features:
average flow duration;
flows inter-arrival times mean;
flows inter-arrival times variance;
target autonomous system overall surprisal;
target autonomous system per-service surprisal;
unique local ports count;
bytes amount weighted by target autonomous system exclusivity;
user overall daily activity match;
remote service entropy; and
remote service ratio.

8. The method according to claim 1 wherein the calculating statistics for the at least one identified connection of interest is performed using at least one Bloom filter.

9. The method according to claim 8 , wherein, every time a connection is recorded in the Bloom filter, the persistence of the connection is checked right after recording the connection.

10. The method according to claim 8 , wherein when a Bloom filter is to be created, its size is determined based on projected maximal network traffic in a period of time during which the to be created Bloom filter is to be active.

11. The method according to claim 8 , wherein a safeguard is employed that monitors a number of connections which are input to the Bloom filter, if the number of connections input to the Bloom filter reaches a projected size value, then a new Bloom filter is created and new connection occurrences are stored in the newly created Bloom filter, and queries about connections are executed on both the original Bloom filter and the new Bloom filter.

12. The method according to claim 8 and further comprising using at least one Bloom filter in order to conserve memory.

13. The method according to claim 1 wherein the observation window is represented by a bit array.

14. The method according to claim 13 wherein encountered connections are stored as keys and a corresponding observation window for that key is stored as values in a map.

15. A system for detecting a malicious network connection, the method comprising:
a first hardware processor which determines, for each connection over a network, if each connection is a persistent connection, wherein the persistence, p, of a connection is defined as:

p
⁡

(

c
,
W

)

=

1
n

⁢

∑

i
=
1

n

⁢

c
i

⁢

b
i

where:
c is the connection in question;
W=[b 1 , . . . b n ] is the observation window composed of n measurement windows; and
1c i b i is a function which is equal to 1 if the connection was active at least once during the measurement window b i , otherwise the function 1c i b i is equal to 0;
a statistics collector which collects connection statistics for the first connection if the processor determined that a first connection is a persistent connection;
a second hardware processor operative to create a feature vector for the first connection based on the collected statistics, wherein the feature vectors comprise more than one of the following features:
logarithm of the total amount of bytes sent or received within the persistent connection;
autocorrelation of time series generated by sent bytes of packets within the persistent connection; and
ratio of bytes sent and received by the persistent connection;
an outlier detection processor which performs outlier detection for all of the feature vectors for all connections over a network which have been determined to be persistent connections, wherein the outlier detection is based on detecting deviation from a

Assignees

• Cisco Tech Inc

Inventors

• Kohout Jan
• Jusko Jan
• Pevny Tomas
• Rehak Martin

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title