Provisional bot activity recognition

Patent metadata

Field	Value
Publication number	US-9729565-B2
Application number	US-201414488973-A
Country	US
Kind code	B2
Filing date	Sep 17, 2014
Priority date	Sep 17, 2014
Publication date	Aug 8, 2017
Grant date	Aug 8, 2017

Abstract

In one implementation, a network device is configured to monitor communications associated with an endpoint and identify domain name service messages in the communications. Subsequently, the network device receives a hypertext transfer protocol (HTTP) request and determines whether a destination internet protocol (IP) address of the HTTP request is present in or absent from the domain name service messages. When the IP address is absent from the domain name service messages, the HTTP request is modified to trigger increased security.

First claim

We claim:

1. A method comprising:
monitoring, at an edge router device, communications associated with an endpoint device;
identifying domain name service messages in the communications of the endpoint device;
receiving, at the edge router device, a hypertext transfer protocol (HTTP) request including an internet protocol (IP) address from the endpoint device;
determining whether the IP address is present in or absent from the domain name service messages;
inserting an inline header in the HTTP request in response to the IP address being absent from the domain name service messages,
wherein the inline header is outside of the control portion of the HTTP request modifiable by a network address translation device;
adding, at the edge router device, metadata to the HTTP request indicative of a first security level when the IP address is absent from the domain name service messages and a second security level when the IP address is present in the domain name service messages; and
forwarding the modified HTTP request to a security as a service server that is cloud based, wherein, responsive to the metadata indicating the first security level, the security as a service server performs a first inspection operation on traffic associated with the HTTP request and, responsive to the metadata indicating the second security level, the security as a service server performs a second inspection operation on traffic associated with the HTTP request, wherein the first inspection operation is different from the second inspection operation.

2. The method of claim 1 , wherein the first security level includes a higher scrutiny than the second security level.

3. The method of claim 1 , further comprising:
calculating a scrutiny score in response to the IP address being absent from the domain name service messages and at least one additional factor.

4. The method of claim 3 , wherein the at least one additional factor includes geographic location, content type, or destination of the communications.

5. The method of claim 1 , further comprising:
querying a whitelist table based on the IP address, wherein modifying the HTTP request comprises:
modifying the HTTP request to include data indicative of a first security level in response to the IP address being absent from the domain name service messages and absent from the whitelist table.

6. The method of claim 5 , further comprising:
modifying the HTTP request to include a second security level in response to the IP address being absent from the domain name service messages and present in the whitelist table.

7. The method of claim 1 , wherein the IP address is associated with a command server for a botnet.

8. An apparatus comprising:
a communication interface configured to receive, from an endpoint device, a hypertext transfer protocol (HTTP) request including an internet protocol (IP) address; and
a controller configured to monitor traffic including the HTTP request and determine whether the IP address is present in or absent from a table of domain name service messages associated with the endpoint device and insert an inline header in the HTTP request based on whether the IP address is present or absent from the table of domain name service messages,
wherein the inline header includes data indicative of a high security level in response to the IP address being absent from the domain name service messages and the inline header includes data indicative of a low security level in response to the IP address being included in the domain name service messages,
wherein the communication interface is configured to forward the traffic to a security as a service server that is cloud based and in a remote network different than a network of the endpoint device, wherein, responsive to the metadata indicating the high security level, the security as a service server performs a first inspection operation on traffic associated with the HTTP request and, responsive to the metadata indicating the low security level, the security as a service server performs a second inspection operation on traffic associated with the HTTP request.

9. The apparatus of claim 8 , wherein the controller is configured to calculate a score in response to the IP address being absent from the domain name service messages and at least one additional factor.

10. The apparatus of claim 9 , wherein the at least one additional factor includes geographic location, content type, or destination of the communications.

11. The apparatus of claim 8 , wherein the controller is configured to query a whitelist table based on the IP address.

12. The apparatus of claim 8 , wherein the inline header is outside of the control portion of the HTTP request modifiable by a network address translation device.

13. A non-transitory computer readable medium including instructions that when executed on a computer are operable to:
monitor, at an edge router device, domain name messages sent from an endpoint device;
store addresses from the domain name messages in a table;
receive a hypertext transfer protocol (HTTP) request including an internet protocol (IP) address;
determine whether the IP address is present in or absent from the addresses in the table;
insert first metadata in the HTTP request in response to the IP address being absent from the table and second metadata in the HTTP request in response to the IP address being present in the table; and
forward the HTTP request to a security server at a remote network different than a network of the edge router device, according to the metadata in the HTTP request, wherein the security server examines the HTTP request based on the metadata inserted in the HTTP request to perform a first inspection in response to the first metadata when the IP address is absent from the table and perform a second inspection in response to the second metadata when the IP address is present in the table.

14. The non-transitory computer readable medium of claim 13 , wherein the IP address is associated with a command server for a botnet.

15. The non-transitory computer readable medium of claim 13 , wherein the security server blocks the HTTP request based on the metadata inserted in the HTTP request.

Assignees

• Cisco Tech Inc

Inventors

• Reddy Tirumaleswar
• Patil Prashanth
• Wing Daniel

Classifications

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L61/2514

  between local and global IP addresses · CPC title

• H04L2463/144

  Detection or countermeasures against botnets · CPC title