Techniques for detecting anomalous network traffic
View Patent ↗Techniques for detecting anomalous network traffic are disclosed. In one particular embodiment, the techniques may be realized as a method for detecting anomalous network traffic comprising the steps of receiving a list including a plurality of processes and, for each process, a list of approved types of network traffic; monitoring network traffic of each process on the list of processes; upon detecting network traffic for a process on the list of processes, determining that the type of network traffic detected is not on the list of approved types for that process; and identifying the process as infected based on determining that the type of network traffic detected is not on the list of approved types for that process.
1. A method for managing authentication information comprising:
receiving a list including a plurality of processes, wherein each of the plurality of processes is run on a client system by executing a file representing that process;
for each process on the list, analyzing the file representing that process to determine what types of network traffic are used by the process by identifying in the file instructions that entail those types of network traffic;
for each process on the list, generating a list of approved types of network traffic based on types of network traffic determined for the process while analyzing the file representing the process;
transmitting the list of processes including, for each process, the list of approved types of network traffic for use in identifying infected processes;
monitoring network traffic of each process on the list of processes;
upon detecting network traffic for a process on the list of processes, determining that the type of network traffic detected is not on the list of approved types for that process; and
identifying the process as infected based on determining that the type of network traffic detected is not on the list of approved types for that process.
2. The method of claim 1 , wherein for each process on the list, analyzing the file comprises identifying any libraries referenced in the file for inclusion by the process that include functions facilitating the generation of network traffic.
3. The method of claim 2 , wherein for at least one process on the list, analyzing the file further comprises identifying one or more functions referenced in the file for function call by the process that facilitate the generation of network traffic.
4. The method of claim 3 , wherein for the at least one process on the list, generating the list of approved types of network traffic comprises identifying those types of network traffic facilitated by the identified functions.
5. At least one non-transitory processor readable storage medium storing a computer program of instructions configured to be readable by at least one processor for instructing the at least one processor to execute a computer process including the steps of:
receiving a list including a plurality of processes, wherein each of the plurality of processes is run on a client system by executing a file representing that process;
for each process on the list, analyzing the file representing that process to determine what types of network traffic are used by the process by identifying in the file instructions that entail those types of network traffic;
for each process on the list, generating a list of approved types of network traffic based on types of network traffic determined for the process while analyzing the file representing the process;
transmitting the list of processes including, for each process, the list of approved types of network traffic for use in identifying infected processes;
monitoring network traffic of each process on the list of processes;
upon detecting network traffic for a process on the list of processes, determining that the type of network traffic detected is not on the list of approved types for that process; and
identifying the process as infected based on determining that the type of network traffic detected is not on the list of approved types for that process.
6. The at least one non-transitory processor readable storage medium of claim 5 , wherein for each process on the list, analyzing the file comprises identifying any libraries referenced in the file for inclusion by the process that include functions facilitating the generation of network traffic.
7. The at least one non-transitory processor readable storage medium of claim 6 , wherein for at least one process on the list, analyzing the file further comprises identifying one or more functions referenced in the file for function call by the process that facilitate the generation of network traffic.
8. The at least one non-transitory processor readable storage medium of claim 7 , wherein for the at least one process on the list, generating the list of approved types of network traffic comprises identifying those types of network traffic facilitated by the identified functions.
9. A system for managing authentication information, the system comprising:
at least one memory for storing computer executable instructions;
at least one hardware processor coupled to the at least one memory, the at least one hardware processor configured to execute the computer executable instructions which are configured to cause the at least one hardware processor to:
receive a list including a plurality of processes, wherein each of the plurality of processes is run on a client system by executing a file representing that process;
for each process on the list, analyze the file representing that process to determine what types of network traffic are used by the process by identifying in the file instructions that entail those types of network traffic;
for each process on the list, generate a list of approved types of network traffic based on types of network traffic determined for the process while analyzing the file representing the process;
transmit the list of processes including, for each process, the list of approved types of network traffic for use in identifying infected processes;
monitor network traffic of each process on the list of processes;
upon detecting network traffic for a process on the list of processes, determine that the type of network traffic detected is not on the list of approved types for that process; and
identify the process as infected based on determining that the type of network traffic detected is not on the list of approved types for that process.
10. The system of claim 9 , wherein for each process on the list, analyzing the file comprises identifying any libraries referenced in the file for inclusion by the process that include functions facilitating the generation of network traffic.
11. The system of claim 10 , wherein for at least one process on the list, analyzing the file further comprises identifying one or more functions referenced in the file for function call by the process that facilitate the generation of network traffic.
12. The system of claim 11 , wherein for the at least one process on the list, generating the list of approved types of network traffic comprises identifying those types of network traffic facilitated by the identified functions.