System and method for detecting a malicious command and control channel
View Patent ↗A method is provided in one example embodiment that includes detecting repetitive connections from a source node to a destination node, calculating a score for the source node based on the connections, and taking a policy action if the score exceeds a threshold score. In more particular embodiments, the repetitive connections use a hypertext transfer protocol and may include connections to a small number of unique domains, connections to small number of unique resources associated with the destination node, and/or a large number of connections to a resource in a domain. Moreover, heuristics may be used to score the source node and identify behavior indicative of a threat, such as a bot or other malware.
1. A method, comprising:
detecting repetitive connections within a predetermined time period from a source node to a destination node;
determining the source node is idle and the repetitive connections indicate suspect activity, wherein the determining includes:
determining the repetitive connections include more than a threshold value X of resource identifiers requested by the source node, wherein the threshold value X is selected to indicate a minimum number of connections sufficient for determining whether the source node is idle;
determining the repetitive connections include less than a threshold value Y of unique domain names; and
determining the repetitive connections include less than a threshold value Z of unique resource identifiers associated with at least one of the unique domain names,
wherein the threshold values X, Y and Z are numerical values selected to be indicative of a pattern consistent with connections not generated by a human user;
calculating a score for the idle source node based on behavior of the repetitive connections during the predetermined time period; and
taking a policy action if the score exceeds a threshold value.
2. The method of claim 1 , wherein the repetitive connections use a hypertext transfer protocol.
3. The method of claim 1 , wherein calculating the score comprises using heuristics to identify behavior indicative of a threat.
4. The method of claim 1 , wherein calculating the score comprises using heuristics to identify behavior indicative of a bot command and control channel.
5. The method of claim 1 , wherein calculating the score comprises increasing the score if the destination node is associated with a domain registered within a year.
6. The method of claim 1 , wherein calculating the score comprises increasing the score if at least one of the repetitive connections does not have a referrer field and does not have a root resource identifier.
7. The method of claim 1 , wherein calculating the score comprises increasing the score if at least one of the repetitive connections does not identify a known user agent.
8. The method of claim 1 , wherein calculating the score comprises increasing the score if at least one of the repetitive connections identifies the destination node by a public network address.
9. The method of claim 1 , wherein calculating the score comprises increasing the score if the repetitive connections have less than an average number of request header lines, wherein the average number is a parameter indicative of a malware connection to the destination node.
10. The method of claim 1 , wherein calculating the score comprises increasing the score if the repetitive connections have less than an average response size, wherein the average response size is a parameter indicative of responses from a command and control server.
11. The method of claim 1 , wherein calculating the score comprises requesting a reputation value associated with the destination node and increasing the score if the reputation value indicates the destination node is associated with a threat.
12. The method of claim 1 , wherein calculating the score comprises increasing the score if the destination node has a network address in a zone associated with a threat.
13. At least one non-transitory computer readable medium having instructions stored therein and when executed, the instructions cause one or more processors to:
detect repetitive connections within a predetermined time period from a source node to a destination node;
determine the source node is idle and the repetitive connections indicate suspect activity, wherein the determination is made by:
determining the repetitive connections include more than a threshold value X of resource identifiers requested by the source node, wherein the threshold value X is selected to indicate a minimum number of connections sufficient for determining whether the source node is idle;
determining the repetitive connections include less than a threshold value Y of unique network addresses; and
determining the repetitive connections include less than a threshold value Z of unique resource identifiers associated with at least one of the unique network addresses,
wherein the threshold values X, Y, and Z are numerical values selected to be indicative of a pattern consistent with connections not generated by a human user;
calculate a score for the idle source node based on behavior of the repetitive connections during the predetermined time period; and
take a policy action if the score exceeds a threshold value.
14. The at least one non-transitory computer readable medium of claim 13 , wherein the repetitive connections use a hypertext transfer protocol.
15. The at least one non-transitory computer readable medium of claim 13 , wherein calculating the score comprises using heuristics to identify behavior indicative of the threat.
16. The method at least one non-transitory computer readable medium of claim 13 , wherein:
the threat is a bot connecting to a command and control server using a hypertext transfer protocol;
X is greater than or equal to 10, Y is less than or equal to 5, and Z is less than or equal to 5;
the time period is at least eight hours;
calculating the score comprises using heuristics to identify behavior indicative of the threat; and
the policy action is sending an alert to an administrator.
17. The at least one non-transitory computer readable medium of claim 13 , wherein calculating the score comprises increasing the score if at least one of the repetitive connections does not have a referrer field and does not have a root resource identifier.
18. The at least one non-transitory computer readable medium of claim 13 , wherein calculating the score comprises increasing the score if at least one of the repetitive connections does not identify a known user agent.
19. The at least one non-transitory computer readable medium of claim 13 , wherein calculating the score comprises increasing the score if at least one of the repetitive connections identifies the destination node by a public network address.
20. The at least one non-transitory computer readable medium of claim 13 , wherein calculating the score comprises increasing the score if the repetitive connections have less than an average number of request header lines, wherein the average number is a parameter indicative of a malware connection to the destination node.
21. The at least one non-transitory computer readable medium of claim 13 , wherein calculating the score comprises increasing the score if the repetitive connections have less than an average response size, wherein the average response size is a parameter indicative of responses from a command and control server.
22. The at least one non-transitory computer readable medium of claim 13 , wherein calculating the score comprises requesting a reputation value associated with the destination node and increasing the score if the reputation value indicates the destination node is associated with a threat.
23. The at least one non-transitory computer readable medium of claim 13 , wherein calculating the score comprises increasing the score if the destination node has a network address in a zone associated with a threat.