Heuristic botnet detection

1. A system, comprising:

a processor configured to:

monitor network traffic to identify suspicious network traffic, wherein the monitoring of the network traffic includes:

identify a uniform resource locator (URL) in the network traffic;

determine whether the network traffic includes a malware URL, an unclassified URL, or a combination thereof; and

in the event that the network traffic includes the malware URL, the unclassified URL, or a combination thereof, assign the network traffic as the suspicious network traffic;

detect a bot based on a heuristic analysis of the suspicious network traffic behavior, wherein the suspicious network traffic behavior includes command and control traffic associated with a bot master;

monitor behavior indicated in the network traffic to identify malware, wherein the monitored behaviors that indicate potential malware include connecting to a non-standard HTTP port for HTTP traffic, visiting a non-existent domain, downloading executable files with non-standard executable file extensions, performing a DNS query for an email server, communicating using a post method in HTTP traffic, connecting to a non-standard IRC port for IRC traffic, communicating using an intrusion prevention system evasion technique, communicating unclassified traffic over an HTTP port, visiting a dynamic DNS domain, or any combination thereof; and

monitor visited domain related behavior to identify a malicious domain based on whether a visited domain is a dynamic DNS domain; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the suspicious behavior is a malware download.

3. The system recited in claim 1 , wherein the suspicious behavior is a command and control communication determined using a plurality of heuristics.

4. The system recited in claim 1 , wherein the suspicious network traffic includes HTTP traffic, IRC traffic, and unclassified application traffic.

5. The system recited in claim 1 , wherein the suspicious network traffic includes firewall logs.

6. The system recited in claim 1 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

identify generic command and control traffic patterns; and

identify specific command and control traffic patterns.

7. The system recited in claim 1 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

classify the monitored network traffic as command and control traffic associated with a bot master.

8. The system recited in claim 1 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

correlate the suspicious network traffic behavior with a plurality of other suspicious behaviors.

9. The system recited in claim 1 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

correlate the suspicious network traffic behavior with a plurality of other suspicious behaviors associated with a client or a plurality of clients.

10. The system recited in claim 1 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

assign a score to the monitored network traffic, wherein the score corresponds to a botnet risk characterization of the monitored network traffic.

11. The system recited in claim 1 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

assign a score to the monitored network traffic, wherein the score corresponds to a botnet risk characterization of the monitored network traffic; and

increase the score based on a correlation of additional suspicious behaviors associated with the monitored network traffic.

12. The system recited in claim 1 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

assign a score to the monitored network traffic, wherein the score corresponds to a botnet risk characterization of the monitored network traffic;

increase the score based on a correlation of additional suspicious behaviors associated with the monitored network traffic; and

determine the suspicious behavior is associated with a botnet based on the score.

13. A method, comprising:

monitoring network traffic to identify suspicious network traffic, wherein the monitoring of the network traffic includes:

identifying a uniform resource locator (URL) in the network traffic;

determining whether the network traffic includes a malware URL, an unclassified URL, or a combination thereof; and

in the event that the network traffic includes the malware URL, the unclassified URL, or a combination thereof, assigning the network traffic as the suspicious network traffic;

detecting a bot based on a heuristic analysis of the suspicious network traffic behavior using a processor; wherein the suspicious network traffic behavior includes command and control traffic associated with a bot master;

monitoring behavior indicated in the network traffic to identify malware, wherein the monitored behaviors that indicate potential malware include connecting to a non-standard HTTP port for HTTP traffic, visiting a non-existent domain, downloading executable files with non-standard executable file extensions, performing a DNS query for an email server, communicating using a post method in HTTP traffic, connecting to a non-standard IRC port for IRC traffic, communicating using an intrusion prevention system evasion technique, communicating unclassified traffic over an HTTP port, visiting a dynamic DNS domain, or any combination thereof; and

monitoring visited domain related behavior to identify a malicious domain based on whether a visited domain is a dynamic DNS domain.

14. The method of claim 13 further comprising:

assigning a score to the monitored network traffic, wherein the score corresponds to a botnet risk characterization of the monitored network traffic;

increasing the score based on a correlation of additional suspicious behaviors associated with the monitored network traffic; and

determining the suspicious behavior is associated with a botnet based on the score.

15. A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

monitoring network traffic to identify suspicious network traffic, wherein the monitoring of the network traffic includes:

identifying a uniform resource locator (URL) in the network traffic;

determining whether the network traffic includes a malware URL, an unclassified URL, or a combination thereof; and

in the event that the network traffic includes the malware URL, the unclassified URL, or a combination thereof, assigning the network traffic as the suspicious network traffic;

detecting a bot based on a heuristic analysis of the suspicious network traffic behavior using a processor; wherein the suspicious network traffic behavior includes command and control traffic associated with a bot master;

monitoring behavior indicated in the network traffic to identify malware, wherein the monitored behaviors that indicate potential malware include connecting to a non-standard HTTP port for HTTP traffic, visiting a non-existent domain, downloading executable files with non-standard executable file extensions, performing a DNS query for an email server, communicating using a post method in HTTP traffic, connecting to a non-standard IRC port for IRC traffic, communicating using an intrusion prevention system evasion technique, communicating unclassified traffic over an HTTP port, visiting a dynamic DNS domain, or any combination thereof; and

monitoring visited domain related behavior to identify a malicious domain based on whether a visited domain is a dynamic DNS domain.

16. The computer program product recited in claim 15 , further comprising computer instructions for:

assigning a score to the monitored network traffic, wherein the score corresponds to a botnet risk characterization of the monitored network traffic;

increasing the score based on a correlation of additional suspicious behaviors associated with the monitored network traffic; and

determining the suspicious behavior is associated with a botnet based on the score.