Systems and methods for computer worm defense
View Patent ↗A computer worm defense system comprises multiple containment systems tied together by a management system. Each containment system is deployed on a separate communication network and contains a worm sensor and a blocking system. In various embodiments, the computer worm may be transported from a production network, where the computer worm is not readily identifiable, to an alternate network in the worm sensor where the computer worm may be readily identifiable. Computer worm identifiers generated by a worm sensor of one containment system can be provided not only to the blocking system of the same containment system, but can also be distributed by the management system to blocking systems of other containment systems.
1. A system comprising:
one or more traffic analysis devices that are configured to perform an analysis of network traffic propagating over a communication network, the analysis includes identifying network communications characteristics associated with potential malware; and
a malicious traffic sensor implemented as part of a computing device and communicatively coupled to the one or more traffic analysis devices, the malicious traffic sensor to receive a portion of the analyzed network traffic, the malicious traffic sensor comprises
one or more virtual machines that perform activities in response to a processing of the received portion of the analyzed network traffic, and
a controller communicatively coupled to the one or more virtual machines, the controller to select software profiles for the one or more virtual machines and determine whether the received portion of the analyzed network traffic comprises malware by at least (i) monitoring behaviors of the one or more virtual machines during processing of the portion of the analyzed network traffic, (ii) determining whether the monitored behaviors denote a presence of malware by at least determining that a probability of the portion of the analyzed network traffic including malware exceeds a predetermined threshold, and (iii) responsive to the probability of the portion of the analyzed network traffic including malware exceeds a predetermined threshold, generating an identifier for the portion of the analyzed network traffic, the identifier operating as a signature for use in detecting the malware in at least a second computing device that is different from the computing device and communicatively coupled to the computing device via the communication network.
2. The system of claim 1 , wherein the malicious traffic sensor is configured to copy at least the portion of the analyzed network traffic and provide the portion of the analyzed network traffic to the one or more virtual machines.
3. The system of claim 2 , wherein the one or more virtual machines are part of a virtual computer network that is transparent to and separate from the communication network.
4. The system of claim 1 further comprising:
a malicious traffic blocking system in communication with the malicious traffic sensor over the communication network and configured to receive the identifier from the malicious traffic sensor to block the propagation of the malicious traffic within the communication network.
5. The system of claim 4 , wherein the signature includes a Transfer Control Protocol (TCP) or a User Datagram Protocol (UDP) port number.
6. The system of claim 1 , further comprising:
a management system in communication with the malicious traffic sensor, the management system to distribute the identifier to a malicious traffic blocking system of a second system that is separate from the first system.
7. The system of claim 6 , wherein the management system automatically distributes the identifier to the malicious traffic blocking system of the second system.
8. The system of claim 7 , wherein the management system distributes a software update to the malicious traffic sensor in response to payment of a subscription fee or refrains from distributing the software update to the malicious traffic sensor in response to non-payment of the subscription fee.
9. The system of claim 1 , wherein the signature comprises a universal resource locator (URL) and the malicious traffic blocking system is capable of filtering by one or more URLs.
10. The system of claim 1 , wherein the signature is for use by an inline signature based intrusion detection system, the signature being shared with the inline signature based intrusion detection system.
11. The system of claim 1 , wherein the malware is a passive computer worm propagating within the communication network.
12. The system of claim 1 , wherein the received portion of the analyzed network data comprises data from the network traffic propagating over the communication network.
13. The system of claim 1 , wherein the signature is based on the monitored behaviors corresponding to one or more anomalous behaviors.
14. The system of claim 1 , wherein the signature is based on the portion of the analyzed network traffic when the probability of the portion of the analyzed network traffic including malware exceeds the predetermined threshold.
15. A method comprising:
monitoring communications traffic from a communication network;
filtering the communications traffic from the communication network, the filtered communications traffic comprises one or more suspicious characteristics associated with malicious traffic, wherein the one or more suspicious characteristics indicating that the filtered communication traffic should be analyzed to determine whether or not the filtered communications traffic comprises malware;
determining whether the filtered communications traffic comprises malware by analyzing the filtered communications traffic, the analyzing of the filtered communications traffic comprises (i) monitoring behaviors of one or more virtual machines during processing of at least a portion of the filtered communications traffic and (ii) determining whether the monitored behaviors denote a presence of malware within the filtered communications traffic by at least determining that a probability of the portion of the filtered communications traffic including malware exceeds a predetermined threshold; and
responsive to the probability of the portion of the filtered communications traffic exceeding a predetermined threshold, generating an identifier for the portion of the filtered communications traffic, the identifier operating as a signature for use in detecting the malware in other communications traffic that is different from the communications traffic and propagating over the communication network.
16. The method of claim 15 , wherein the one or more virtual machines correspond to virtual computer system using machine virtualization technologies to analyze the processing of the filtered communications traffic in an alternate computer network.
17. The method of claim 16 , wherein
the filtering the communications traffic comprises copying at least the portion of filtered communications traffic from the communications traffic; and
the monitoring of the behaviors of the one or more virtual machines comprises analyzing processing of the portion of filtered communications traffic to a virtual destination device in the alternate computer network.
18. The method of claim 15 , wherein the monitoring of the one or more virtual machines during analyzing of the filtered communications traffic comprises:
executing the one or more virtual machines; and
identifying one or more anomalous behaviors performed by the one or more virtual machines during processing of the portion of filtered communications traffic.
19. The method of claim 15 further comprising distributing the identifier to an unauthorized activity detection system different from an unauthorized activity detection system that is determining whether the filtered communications traffic comprises malware and the generating of the identifier for the portion of the filtered communications traffic.
20. The method of claim 19 further comprising blocking the communications traffic including the malware from further propagating over the communication network.
21. A non-transitory machine readable medium having embodied thereon executable code, the executable code being executable by a processor to perform an unauthorized activity defense method comprising:
monitoring communications traffic from a communication network;
filtering the communications traffic from the communication network, the filtered communications traffic comprises one or more suspicious characteristics of malicious traffic, wherein the one or more suspicious characteristics identifying whether the filtered communication traffic should be analyzed to determine whether or not the filtered communications traffic comprises malware;
determining whether the filtered communications traffic comprises malware by analyzing the filtered communications traffic, the analyzing comprising (i) monitoring behaviors of one or more virtual machines during processing of at least a portion of the filtered communications traffic and (ii) determining whether the monitored behaviors denote a presence of malware within the filtered communications traffic by at least determining that a probability of the portion of the filtered communications traffic including malware exceeds a predetermined threshold; and
responsive to the probability of the portion of the filtered communications traffic exceeding a predetermined threshold, generating an identifier for the portion of the filtered communications traffic, the identifier operating as a signature for use in detecting the malware in other communications traffic that is different from the communications traffic and propagating over the communication network.