Malware detection system and method
View Patent ↗Methods and systems are presented for detection of malware such as worms in which a network switch entices the malware into sending scan packets by allocating one or more ports as bait addresses, sending outgoing bait packets, and identifying compromised hosts that send unexpected incoming packets to a bait address.
1. A method of detecting malware infected computing devices in a network, the method comprising:
allocating at least one network address in a network element coupled to a communications network as a bait address;
sending at least one outgoing bait packet from the bait address to the network according to a policy table stored in the network element;
receiving an incoming packet from the network at the bait address;
selectively identifying a source of the incoming packet as infected with malware if the incoming packet is unexpected or from an unauthorized source;
wherein the bait address is a layer 2 MAC address shared by a first port of the network element configured for transmitting bait packets and a second port of the network element configured for receiving incoming packets from the network.
2. The method of claim 1 , wherein the network element is a layer 2 switch or a layer 3 switch coupled to the communications network.
3. The method of claim 1 , wherein outgoing bait packets are sent from the bait address to the network according to a bait packet types list and a bait packet schedule stored in the network element.
4. The method of claim 1 , the at least one outgoing bait packet is sent as a broadcast from the bait address to the network.
5. The method of claim 1 , wherein at least one outgoing bait packet is sent as a unicast from the bait address to the network.
6. The method of claim 1 , wherein allocating at least one network address comprises allocating all ports of the network element as bait addresses.
7. A system for detecting are infected computing devices in a network, the system comprising:
a network element operatively coupled to a communications network, the network element having at least one network address allocated as a bait address, and comprising a malware detection component operative to send at least one outgoing bait packet from the bait address to the network according to a policy table stored in the network element, to receive an incoming packet from the network at the bait address, and to selectively identify a source of the incoming packet as infected with malware if the incoming packet is unexpected or from an unauthorized source;
wherein the bait address is a layer 2 MAC address shared by a first port of the network element configured for transmitting bait packets and a second port of the network element configured for receiving incoming packets from the network.
8. The system of claim 7 , wherein the network element is a layer 2 switch or a layer 3 switch coupled to the communications network.
9. The system of claim 7 , wherein the policy table comprises a bait packet types list and a bait packet schedule, and wherein the malware detection component is operative to send outgoing bait packets from the bait address to the network according to the bait packet types list and the bait packet schedule.
10. The system of claim 7 , wherein the malware detection component is operative to send the outgoing bait packet as a broadcast from the bait address to the network.
11. The system of claim 7 , wherein the malware detection component is operative to send the outgoing bait packet as a unicast from the bait address to the network.
12. The system of claim 7 , wherein all ports of the network element are allocated as bait addresses.
13. The system of claim 7 , wherein the at least one outgoing bait packet sent from the bait address to the network does not indicate any specific service, and instead merely announces the existence of the bait address.
14. The system of claim 13 , wherein the at least one outgoing bait packet sent from the bait address to the network is a bootp broadcast.
15. The system of claim 7 , wherein the malware detection component is operative to determine whether the incoming packet is unexpected based on the type of outgoing bait packet sent from the bait address to the network.
16. The method of claim 1 , wherein the malware detection component is implemented on a subnet of the communications network.
17. The system of claim 7 , wherein the malware detection component is implemented on a subnet of the communications network.
18. The method of claim 2 , wherein the layer 2 switch or the layer 3 switch has one or more processors running one or more malware detection components.
19. The system of claim 8 , wherein the layer 2 switch or the layer 3 switch has one or more processors running one or more malware detection components.
20. A method of detecting malware infected computing devices in a network, the method comprising:
allocating at least one network address in a network element coupled to a communications network as a bait address;
sending at least one outgoing bait packet from the bait address to the network;
receiving an incoming packet from the network at the bait address; and
selectively identifying a source of the incoming packet as infected with malware if the incoming packet is of an unexpected type and from an unauthorized source;
wherein the bait address is a layer 2 MAC address shared by a first port of the network element configured for transmitting bait packets and a second port of the network element configured for receiving incoming packets from the network.