Heuristic botnet detection

Patent metadata

Field	Value
Publication number	US-9762596-B2
Application number	US-201514826887-A
Country	US
Kind code	B2
Filing date	Aug 14, 2015
Priority date	May 24, 2011
Publication date	Sep 12, 2017
Grant date	Sep 12, 2017

Abstract

In some embodiments, heuristic botnet detection is provided. In some embodiments, heuristic botnet detection includes monitoring network traffic to identify suspicious network traffic; and detecting a bot based on a heuristic analysis of the suspicious network traffic behavior using a processor, in which the suspicious network traffic behavior includes command and control traffic associated with a bot master. In some embodiments, heuristic botnet detection further includes assigning a score to the monitored network traffic, in which the score corresponds to a botnet risk characterization of the monitored network traffic (e.g., based on one or more heuristic botnet detection techniques); increasing the score based on a correlation of additional suspicious behaviors associated with the monitored network traffic (e.g., based on one or more heuristic botnet detection techniques); and determining the suspicious behavior is associated with a botnet based on the score.

First claim

What is claimed is:

1. A system, comprising:
a processor configured to:
monitor network traffic to identify suspicious network traffic, wherein the monitoring of the network traffic includes:
monitor visited domain related behavior to identify a previously unclassified URL as a new malware URL, wherein the monitored visited domain related behavior indicates a potentially malicious domain based on one or more of the following: a domain name length of a visited domain, whether a visited domain is a dynamic DNS domain, whether a visited domain is a fast-flux domain, and whether a visited domain is a recently created domain;
identify a uniform resource locator (URL) in the network traffic using a URL filter;
determine whether the network traffic includes a malware URL, an unclassified URL, or a combination thereof;
in response to a determination that the network traffic includes the malware URL, the unclassified URL, or a combination thereof, assign the network traffic as the suspicious network traffic;

identify the network traffic as the suspicious network traffic using an application identifier, wherein the suspicious network traffic includes one or more of the following: HTTP traffic, IRC traffic, and unclassified application traffic;
in response to a determination that the network traffic is identified as the unclassified application traffic or includes the unclassified URL, forward the network traffic to a security cloud service for further analysis, wherein the further analysis performed by the security cloud service includes behavior correlation, and wherein the security cloud service aggregates botnet reports received from a plurality of network sites to facilitate botnet detection based on behavior correlation; and
detect a bot based on a heuristic analysis of the suspicious network traffic behavior, wherein the suspicious network traffic behavior includes command and control traffic associated with a bot master; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the suspicious network traffic behavior is a malware download.

3. The system recited in claim 1 , wherein the suspicious network traffic behavior is a command and control communication determined using a plurality of heuristics.

4. The system recited in claim 1 , wherein the processor is further configured to:
identify generic command and control traffic patterns, wherein generic command and control traffic patterns are applied to identify a new bot or an unknown category of bots; and
identify specific command and control traffic patterns, wherein specific command and control traffic patterns are applied to identify a previously identified bot or a known category of bots, and wherein the specific command and control traffic patterns are associated with one or more previously identified bot command and control traffic patterns.

5. The system recited in claim 1 , wherein the processor is further configured to:
classify the network traffic as command and control traffic associated with a bot master.

6. The system recited in claim 1 , wherein the processor is further configured to:
correlate the suspicious network traffic behavior with a plurality of other suspicious behaviors.

7. The system recited in claim 1 , wherein the processor is further configured to:
correlate the suspicious network traffic behavior with a plurality of other suspicious behaviors associated with a client or a plurality of clients.

8. The system recited in claim 1 , wherein the processor is further configured to:
assign a score to the network traffic, wherein the score corresponds to a botnet risk characterization of the network traffic.

9. The system recited in claim 1 , wherein the processor is further configured to:
assign a score to the network traffic, wherein the score corresponds to a botnet risk characterization of the network traffic; and
increase the score based on a correlation of additional suspicious behaviors associated with the network traffic.

10. The system recited in claim 1 , wherein the processor is further configured to:
assign a score to the network traffic, wherein the score corresponds to a botnet risk characterization of the network traffic;
increase the score based on a correlation of additional suspicious behaviors associated with the network traffic; and
determine the suspicious network traffic behavior is associated with a botnet based on the score.

11. The system recited in claim 1 , wherein the processor is further configured to:
correlate the suspicious network traffic behavior with a plurality of other suspicious behaviors associated with a client or a plurality of clients;
assign a score to the network traffic, wherein the score corresponds to a botnet risk characterization of the network traffic;
increase the score based on a correlation of additional suspicious behaviors associated with the network traffic; and
determine the suspicious network traffic behavior is associated with a botnet based on the score.

12. The system recited in claim 1 , wherein the processor is further configured to:
monitor behavior indicated in the network traffic to identify malware, wherein the monitored behaviors that indicate potential malware include one or more of the following: visiting a domain with a domain name that is longer than a common domain name length, visiting a dynamic DNS domain, visiting a fast-flux domain, and visiting a recently created domain.

13. The system recited in claim 1 , wherein the processor is further configured to:
monitor behavior indicated in the network traffic to identify malware, wherein the monitored behaviors that indicate potential malware include one or more of the following: connecting to a non-standard HTTP port for HTTP traffic, visiting a non-existent domain, downloading executable files with non-standard executable file extensions, performing a DNS query for an email server, communicating using HTTP header with a shorter than common length, communicating using a post method in HTTP traffic, connecting to a non-standard IRC port for IRC traffic, communicating using an intrusion prevention system evasion technique, and communicating unclassified traffic over an HTTP port.

14. A method, comprising:
monitoring network traffic to identify suspicious network traffic, wherein the monitoring of the network traffic includes:
monitoring visited domain related behavior to identify a previously unclassified URL as a new malware URL, wherein the monitored visited domain related behavior indicates a potentially malicious domain based on one or more of the following: a domain name length of a visited domain, whether a visited domain is a dynamic DNS domain, whether a visited domain is a fast-flux domain, and whether a visited domain is a recently created domain;
identifying a uniform resource locator (URL) in the network traffic using a URL filter;
determining whether the network traffic includes a malware URL, an unclassified URL, or a combination thereof;
in response to a determination that the network traffic includes the malware URL, the unclassified URL, or a combination thereof, assigning the network traffic as the suspicious network traffic;

identifying the network traffic as the suspicious network traffic using an application identifier, wherein the suspicious network traffic includes one or more of the following: HTTP traffic, IRC traffic, and unclassified application traffic;
in response to a determination that the network traffic is identified as the unclassified application traffic or includes the unclassified UR

Assignees

• Palo Alto Networks Inc

Inventors

• Wang Xinran
• Xie Huagang

Classifications

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L2463/144

  Detection or countermeasures against botnets · CPC title