Proxy server-based malware detection

Patent metadata

Field	Value
Publication number	US-9537888-B1
Application number	US-201313858505-A
Country	US
Kind code	B1
Filing date	Apr 8, 2013
Priority date	Apr 8, 2013
Publication date	Jan 3, 2017
Grant date	Jan 3, 2017

Abstract

Disclosed are various embodiments for malware detection by way of proxy servers. In one embodiment, a proxy server application generates a browsing history for client devices based at least in part on proxied network resource requests received from the client devices. The proxy server application determines that at least one of the client devices is affected by malware. The proxy server application determines a source of the malware based at least in part on the browsing history or telemetry data received from the client devices. An action is implemented in response to determining the source of the malware.

First claim

Therefore, the following is claimed:

1. A system, comprising:
at least one computing device; and
a proxy server application executable in the at least one computing device, wherein when executed the proxy server application causes the at least one computing device to at least:
generate a browsing history for a plurality of client devices based at least in part on proxied network resource requests received from the plurality of client devices;
determine that the proxied network resource requests include a periodic pattern of proxied requests for a network site in common from the plurality of client devices;
determine that at least one of the plurality of client devices is affected by malware based at least in part on a proxied request from the at least one of the plurality of client devices corresponding to the periodic pattern of proxied requests;
determine a source of the malware based at least in part on the browsing history or telemetry data received from the plurality of client devices by the proxy server application; and
implement an action in response to determining the source of the malware.

2. The system of claim 1 , wherein the action comprises blocking proxied requests by the plurality of client devices for network resources of the network site corresponding to the source of the malware.

3. The system of claim 1 , wherein the action comprises logging an indication of the source of the malware or generating an alert including the indication of the source of the malware.

4. The system of claim 1 , wherein the action comprises determining that another one of the plurality of client devices is affected by the malware based at least in part on the browsing history and the source of the malware.

5. The system of claim 1 , wherein the action comprises configuring a warning to be returned to the plurality of client devices in response to proxied requests by the plurality of client devices for network resources of the network site corresponding to the source of the malware.

6. The system of claim 1 , wherein the action comprises configuring processing of a proxied network resource received from the source of the malware by the proxy server application to remove the malware before returning the proxied network resource to the plurality of client devices.

7. The system of claim 1 , wherein the plurality of client devices are configured to report the telemetry data to the proxy server application in response to receiving a proxied network resource from the proxy server application, and determining that the at least one of the plurality of client devices is affected by the malware further comprises:
determining that the at least one of the plurality of client devices is affected by the malware in response to detecting at least one of:
an absence of the telemetry data expected to be received from the at least one of the plurality of client devices, or
an abnormality in the telemetry data received from the at least one of the plurality of client devices.

8. The system of claim 7 , wherein the abnormality is detected from at least one of: memory consumption data, data storage usage data, network connection data, system configuration data, or process state data.

9. The system of claim 1 , wherein determining that the at least one of the plurality of client devices is affected by the malware further comprises:
detecting protected information being sent in an unsecured manner from the at least one of the plurality of client devices to the network site via the proxied request.

10. The system of claim 9 , wherein detecting the protected information being sent in the unsecured manner further comprises at least one of:
detecting a credit card number being sent in clear text via the proxied network resource request,
detecting a password being sent in clear text via the proxied network resource request, or
comparing data embodied in the proxied request with predefined protected information associated with the at least one of the plurality of client devices.

11. The system of claim 1 , wherein determining that the at least one of the plurality of client devices is affected by the malware further comprises:
detecting an absence of a proxied network resource request that is expected to be received from the at least one of the plurality of client devices.

12. The system of claim 1 , wherein determining that the at least one of the plurality of client devices is affected by the malware further comprises:
detecting a proxied network resource request from the at least one of the plurality of client devices for canary data, the canary data being hidden from a user interface of the at least one of the plurality of client devices.

13. A method, comprising:
receiving, via at least one of one or more computing devices, a proxied request from a client device for a network resource from a network site;
determining, via at least one of the one or more computing devices, whether the proxied request corresponds to a periodic pattern of proxied requests for a network site in common from a plurality of client devices;
receiving, via at least one of the one or more computing devices, the network resource from the network site;
determining, via at least one of the one or more computing devices, whether the network resource is correlated with malware based at least in part on a browsing history associated with the plurality of client devices;
executing, within an execution environment of at least one of the one or more computing devices, the network resource in response to determining that the network resource is correlated with malware; and
determining, by the computing device, whether the network resource comprises malware based at least in part on the execution of the network resource and whether the proxied request corresponds to the periodic pattern of proxied requests.

14. The method of claim 13 , further comprising sending, via at least one of the one or more computing devices, data generated by the network resource to the client device in response to the proxied request when the network resource is determined not to comprise the malware.

15. The method of claim 13 , further comprising sending, via at least one of the one or more computing devices, data encoding a warning to the client device in place of data generated by the network resource to the client device in response to the proxied request when the network resource is determined to comprise the malware.

16. The method of claim 13 , further comprising:
analyzing, via at least one of the one or more computing devices, the proxied request to determine whether the proxied request includes protected information transmitted in an unsecured manner; and
determining, via at least one of the one or more computing devices, whether the network resource comprises malware based at least in part on whether the proxied request includes the protected information transmitted in the unsecured manner.

17. The method of claim 16 , wherein the computing device includes programmable hardware configured to perform the analyzing, the programmable hardware including at least one of: a field programmable gate array (FPGA), a field programmable object array (FPOA), or a memristor array.

18. The method of claim 13 , further comprising:
receiving, via at least one of the one or more computing devices, a user-submitted report identifying the network resource as comprising the malware; and
determining, via at least one of the one or more computing devices, whether the network resource comprises malware based at least in part on

Assignees

• Amazon Tech Inc

Inventors

• Mcclintock Jon Arron
• Johansson Jesper Mikael
• Roths Andrew Jay

Classifications

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L67/56

  Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) · CPC title

• H04L63/0254 Primary

  Stateful filtering · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/0281

  Proxies · CPC title