Rapidly propagating threat detection
View Patent ↗A method, system, apparatus, and computer-readable medium to detect rapidly propagating threats in a network. A rapidly propagating threat is detected by capturing a series of packets as the packets are communicated to nodes of the organizational network. The rapidly propagating threat can be detected without relying upon a known signature for the threat. Behavior of nodes when sending and receiving packets is examined for patterns typical of worm propagation.
1. A method comprising:
in a first computer:
capturing a first packet sent from a first source to a first destination; extracting a set of header data from a first header of the first packet; capturing a second packet sent from the first destination to a second destination;
if the set of header data is present in a second header of the second packet, processing the second packet as an indicator of a suspected rapidly propagating threat;
capturing a third packet sent from the second destination to a third destination; searching the set of suspected threat packets for a linked packet to the third packet,
wherein the linked packet has the second destination as a destination address;
if the linked packet is found, comparing corresponding payload data for the linked packet to third payload data of the third packet, and
if the corresponding payload data for the linked packet matches the third payload data,
processing the third packet as part of a rapidly propagating threat.
2. The method of claim 1 , wherein
the processing the second packet as an indicator of a suspected rapidly propagating threat comprises:
saving the second packet in a set of suspected threat packets.
3. The method of claim 1 wherein
the third payload data is calculated as a hash value using a third payload of the third packet.
4. The method of claim 1 wherein
the third payload data is a raw payload of the third packet.
5. The method of claim 1 wherein
processing the third packet as an indicator of a rapidly propagating threat comprises adding a source of the third packet to a set of infected sites.
6. The method of claim 1 wherein
processing the third packet as an indicator of a rapidly propagating threat comprises adding a payload of the third packet to a set of known threats.
7. The method of claim 1 wherein
processing the third packet as an indicator of a rapidly propagating threat comprises adding a hash value of a payload of the third packet to a set of known threats.
8. The method of claim 1 wherein
processing the third packet as an indicator of a rapidly propagating threat comprises determining a threat type for the third packet.
9. The method of claim 1 wherein
the second packet is one of a number of subsequent packets captured after the first packet was captured, and
the third packet is one of a number of subsequent packets captured after the second packet was captured.
10. The method of claim 1 wherein
the set of header data comprises a protocol and a destination port.
11. The method of claim 1 wherein
the set of header data comprises a protocol, a destination port, and a size of the packet.
12. The method of claim 1 wherein
the set of header data comprises a protocol, a destination port, and a size range of the packet.
13. The method of claim 1 wherein
no signature is available to identify the suspected rapidly propagating threat.
14. The method of claim 1 wherein each corresponding payload is associated with a plurality of counts, wherein each count of the plurality of counts is a number of times that each element of a
plurality of elements appears in the corresponding payload.
15. The method of claim 14 wherein
each element of the plurality of elements is a bit pattern.
16. The method of claim 14 wherein
each element of the plurality of elements is a character.
17. The method of claim 14 wherein
each element of the plurality of elements is a set of bytes.
18. The method of claim 14 wherein each element of the plurality of elements is a symbol.
19. A computer-readable storage medium comprising:
first capturing instructions to capture a first packet sent from a first source to a first destination;
extracting instructions to extract a set of header data from a first header of the first packet;
second capturing instructions to capture a second packet sent from the first destination to a second destination;
processing instructions to process the second packet as an indicator of a suspected rapidly propagating threat if the set of header data is present in a second header of the second packet;
third capturing instructions to capture a third packet sent from the second destination to a third destination;
searching instructions to search the set of suspected threat packets for a linked packet to the third packet, wherein
the linked packet has the second destination as a destination address;
comparing instructions to compare corresponding payload data for the linked packet to third payload data of the third packet if the linked packet is found; and
second processing instructions to process the third packet as part of a rapidly propagating threat if the corresponding payload data for the linked packet matches the third payload data.
20. The computer-readable storage medium of claim 19 , further comprising:
saving instructions to save the second packet in a set of suspected threat packets.
21. The computer-readable storage medium of claim 19 , further comprising:
adding instructions to add a source of the third packet to a set of infected sites.
22. The computer-readable storage medium of claim 19 further comprising:
adding instructions to add a payload of the third packet to a set of known threats.
23. The computer-readable storage medium of claim 19 further comprising:
adding instructions to add a hash value of a payload of the third packet to a set of known threats.
24. The computer-readable storage medium of claim 19 further comprising:
determining instructions to determine a threat type for the third packet.
25. A computer system comprising:
a processor for executing instructions, and
the computer-readable storage medium of claim 19 , wherein
the computer-readable medium is coupled to the processor.
26. An apparatus comprising:
computer-readable storage medium including:
a first capturing module to capture a first packet sent from a first source to a first destination;
an extracting module to extract a set of header data from a first header of the first packet;
a second capturing module to capture a second packet sent from the first destination to a second destination;
a processing module to process the second packet as an indicator of a suspected rapidly propagating threat if the set of header data is present in a second header of the second packet
a third capturing module to capture a third packet sent from the second destination to a third destination;
a searching module to search the set of suspected threat packets for a linked packet to the third packet, wherein
the linked packet has the second destination as a destination address;
a comparing module to compare corresponding payload data for the linked packet to third payload data of the third packet if the linked packet is found; and
a second processing module to process the third packet as part of a rapidly propagating threat if the corresponding payload data for the linked packet matches the third payload data.
27. The apparatus of claim 26 , further comprising:
a saving module to save the second packet in a set of suspected threat packets.
28. The apparatus of claim 26 , further comprising:
an adding module to add a source of the third packet to a set of infected sites.
29. The apparatus of claim 26 , further comprising:
an adding module to add a payload of the third packet to a set of known threats.
30. The apparatus of claim 26 , further comprising:
an adding module to add a hash value of a payload of the third packet to a set of known threats.
31. The apparatus of claim 26 , further comprising:
a determining module to determine a threat type for the third packet.
32. A system comprising:
unit for capturing, by a processor, a first packet sent from a first source to a first destination;
unit for extracting a set of header data from a first header of the first packet;
unit for capturing a second packet sent from the first destination to a second destination; and
unit for processing the second packet as an indicator of a suspected rapidly propagating threat if the set of header data is present in a second header of the second packet
unit for capturing a third packet sent from the second destination to a third destination;
unit for searching the set of suspected threat packets for a linked packet to the third packet, wherein
the linked packet has the second destination as a destination address;
unit for comparing corresponding payload data for the linked packet to third payload data of the third packet if the linked packet is found; and
unit for processing the third packet as part of a rapidly propagating threat if the corresponding payload data for the linked packet matches the third payload data.
33. The system of claim 32 , further comprising:
means unit for saving the second packet in a set of suspected threat packets.