Detection of malicious web activity in enterprise computer networks
View Patent ↗A processing device in one embodiment comprises a processor coupled to a memory and is configured to obtain internal log data of a computer network of an enterprise, to extract values of a plurality of designated internal features from the log data, to obtain additional data from one or more external data sources, and to extract values of a plurality of designated external features from the additional data. The extracted values are applied to a regression model based on the internal and external features to generate malicious activity risk scores for respective ones of a plurality of domains, illustratively external domains having fully-qualified domain names (FQDNs). A subset of the domains are identified based on their respective malicious activity risk scores, and one or more proactive security measures are taken against the identified subset of domains. The processing device may be implemented in the computer network or an associated network security system.
1. A method comprising steps of:
obtaining internal log data of a computer network of an enterprise;
extracting values of a plurality of designated internal features from the log data;
obtaining additional data from one or more external data sources;
extracting values of a plurality of designated external features from the additional data;
applying the extracted values to a regression model based on the internal and external features to generate malicious activity risk scores for respective ones of a plurality of domains;
identifying a subset of the domains based on their respective malicious activity risk scores; and
taking one or more proactive security measures against the identified subset of domains;
wherein the malicious activity risk scores indicate likelihoods that the respective domains are associated with malware;
wherein the designated internal features comprise one or more communication related features, one or more domain structure related features, one or more uniform resource locator (URL) related features, and one or more user agent (UA) related features;
wherein the designated external features comprise one or more registration related features, one or more autonomous system related features, and one or more country related features; and
wherein the steps are performed by at least one processing device comprising a processor coupled to a memory.
2. The method of claim 1 wherein the plurality of domains comprise respective ones of a plurality of external fully-qualified domain name (FQDN) domains contacted by host devices of the enterprise.
3. The method of claim 1 wherein the internal log data comprises HTTP log data stored in security logs of the enterprise and wherein the one or more external data sources comprise at least one of a WHOIS data source, a hosting type data source, and an IP geolocation data source.
4. The method of claim 1 wherein the one or more communication related features comprise one or more of a total number of hosts, a total number of connections, an average, maximum or minimum number of connections per host, a total number of bytes sent, a total number of bytes received, an average, maximum or minimum ratio of total number of bytes sent and total number of bytes received on a per host basis, a total number of POST and GET connections, and an average, maximum or minimum ratio of POST and GET connections on a per host basis.
5. The method of claim 1 wherein the one or more domain structure related features comprise one or more of a domain name length, a number of domain levels, a number of sub-domains, and a top-level domain.
6. The method of claim 1 wherein the one or more URL related features comprise one or more of a total number of distinct URLs, an average, maximum or minimum path length per URL, an average, maximum or minimum path depth per URL, a total number of parameters, an average, maximum or minimum number of parameters per URL, an average, maximum or minimum number of values per parameter, a fraction of URLs with file name or extension, a total number of file names and extensions, a fraction of URLs with query strings, a fraction of URLs with fragments, a total number of fragments, and a fraction of domain URLs.
7. The method of claim 1 wherein the one or more UA related features comprise one or more of a total number of UAs, a ratio of distinct UAs over hosts, an average, maximum or minimum number of UAs per host, a fraction of connections without a UA, a fraction of unpopular UAs, an inverse average UA popularity, a dominant browser type, an average number of browsers per host, a dominant operating system (OS) type, and an average number of OSs per host.
8. The method of claim 1 wherein the designated internal features further comprise one or more result code related features including at least one of a fraction of connections having particular predetermined result codes, a number of connections having particular predetermined result codes, and a ratio of failing connections and successful connections.
9. The method of claim 1 wherein the designated internal features further comprise one or more referrer related features including at least one of a fraction of connections without a referrer, a number of distinct referrer domains, a ratio of distinct referrer domains and hosts, an average, maximum or minimum number of referrer domains per host, and a different referrer domain than itself indicator.
10. The method of claim 1 wherein the designated internal features further comprise one or more content type features including at least one of a number of distinct content types, and a fraction of content types in each of a plurality of categories.
11. The method of claim 1 wherein the one or more registration related features comprise one or more of a registration age, a registration validity, an update age, an update validity and a registration email category.
12. The method of claim 1 wherein the one or more autonomous system related features comprise one or more of autonomous system numbers (ASNs) of resolved domain IP addresses, and a number of distinct ASNs.
13. The method of claim 1 wherein the one or more country related features comprise one or more of countries of resolved domain IP addresses, and number of distinct countries.
14. The method of claim 1 wherein the designated external features further comprise one or more hosting type features including one or more of a free-hosting indicator, a dynamic domain name service (DNS) indicator, and a shortener indicator.
15. The method of claim 1 wherein the regression method is trained on a training set that comprises a plurality of unclassified domains and a plurality of domains previously classified as malicious domains but that excludes a global whitelist of popular domains.
16. The method of claim 1 wherein the regression model comprises one of a random forest model, a logistic regression model and a decision trees regression model.
17. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes said at least one processing device:
to obtain internal log data of a computer network of an enterprise;
to extract values of a plurality of designated internal features from the log data;
to obtain additional data from one or more external data sources;
to extract values of a plurality of designated external features from the additional data;
to apply the extracted values to a regression model based on the internal and external features to generate malicious activity risk scores for respective ones of a plurality of domains;
to identify a subset of the domains based on their respective malicious activity risk scores; and
to take one or more proactive security measures against the identified subset of domains;
wherein the malicious activity risk scores indicate likelihoods that the respective domains are associated with malware;
wherein the designated internal features comprise one or more communication related features, one or more domain structure related features, one or more uniform resource locator (URL) related features, and one or more user agent (UA) related features; and
wherein the designated external features comprise one or more registration related features, one or more autonomous system related features, and one or more country related features.
18. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
said at least one processing device being configured:
to obtain internal log data of a computer network of an enterprise;
to extract values of a plurality of designated internal features from the log data;
to obtain additional data from one or more external data sources;
to extract values of a plurality of designated external features from the additional data;
to apply the extracted values to a regression model based on the internal and external features to generate malicious activity risk scores for respective ones of a plurality of domains;
to identify a subset of the domains based on their respective malicious activity risk scores; and
to take one or more proactive security measures against the identified subset of domains;
wherein the malicious activity risk scores indicate likelihoods that the respective domains are associated with malware;
wherein the designated internal features comprise one or more communication related features, one or more domain structure related features, one or more uniform resource locator (URL) related features, and one or more user agent (UA) related features; and
wherein the designated external features comprise one or more registration related features, one or more autonomous system related features, and one or more country related features.
19. The apparatus of claim 18 wherein the designated internal features further comprise one or more referrer related features including at least one of a fraction of connections without a referrer, a number of distinct referrer domains, a ratio of distinct referrer domains and hosts, an average, maximum or minimum number of referrer domains per host, and a different referrer domain than itself indicator.
20. The apparatus of claim 18 wherein the apparatus is implemented in a network security system.