Detecting attacks using passive network monitoring

1. A method for detecting one or more attacks in a network, wherein one or more processors in one or more network monitoring computers (NMCs) execute instructions to perform actions, comprising:

instantiating one or more network monitoring engines to passively monitoring one or more network flows using the one or more NMCs; and

responsive to the one or more network monitoring engines detecting one or more file write command operations based on information included in one or more packets of the one or more network flows, performing further actions, including:

instantiating a packet capture engine to selectively store captured portions of the one or more packets in a non-transitory storage medium;

instantiating an attack detection engine to perform actions, including:

executing one or more detection rules to analyze one or more portions of the one or more stored packets to identify file information that is associated with the one or more file write command operations; and

providing one or more metrics based on the one or more detection rules and a comparison of the one or more of the file information or the one or more file write command operations; and

responsive to one or more of the one or more metrics exceeding one or more threshold values, performing actions including:

capturing one or more read packets, wherein the one or more read packets are associated with one or more file read operations;

storing one or more read packet portions of the one or more read packets in one or more memory buffers;

extracting one or more portions of file data from the one or more stored read packet portions;

providing one or more files based on the one or more extracted portions of file data; and

providing one or more reports of one or more attacks based on the one or more exceeded threshold values.

2. The method of claim 1 , wherein providing the one or more metrics based on the one or more detection rules and one or more of the file information or the one or more file write command operations, further comprises:

comparing one or more portions of the file information to information included in one or more blacklists; and

responsive to one or more affirmative results of the comparison, incrementing one or more of the one or more metrics.

3. The method of claim 1 , wherein providing the one or more metrics based on the one or more detections rules and one or more of the file information or the one or more file write command operations, further comprises:

comparing one or more portions of the file information to information included in one or more whitelists; and

responsive to one or more negative results of the comparison, incrementing one or more of the one or more metrics.

4. The method of claim 1 , wherein the one or more attacks include one or more of Ransomware, man-in-the-middle, worm, Trojan, denial of service, spoofing, ARP (address resolution protocol) poison, Ping flood, Ping of death, Smurf, wiretapping, Port scan, Idle scan, buffer overflow, heap overflow, stack overflow, or format string attack.

5. The method of claim 1 , further comprising:

capturing one or more read packets, wherein the one or more read packets are associated with one or more file read operations;

storing one or more read packet portions of the one or more read packets in one or more memory buffers; and

responsive to the one or more of the one or more metrics exceeding the one or more threshold values, performing further actions, including:

extracting one or more portions of file data from the one or more stored read packet portions; and

providing one or more files based on the one or more extracted portions of file data.

6. The method of claim 1 , further comprising:

continuously capturing network traffic that is associated with the one or more network flows; and

storing the captured network traffic in a data store.

7. The method of claim 1 , wherein detecting the one or more file write operations, further comprises, comparing one or more other portions of the one or more packets to one or more values associated with one or more network file protocols.

8. A system for detecting one or more attacks in a network, comprising:

a network computer, comprising:

one or more transceivers that communicate over a network;

one or more memories that store at least one or more instructions; and

one or more processors that execute the one or more instructions to perform actions, including:

instantiating one or more network monitoring engines to passively monitoring one or more network flows using the one or more NMCs; and

responsive to the one or more network monitoring engines detecting one or more file write command operations based on information included in one or more packets of the one or more network flows, performing further actions, including:

instantiating a packet capture engine to selectively store captured portions of the one or more packets in a non-transitory storage medium;

instantiating an attack detection engine to perform actions, including:

executing one or more detection rules to analyze one or more portions of the one or more stored packets to identify file information that is associated with the one or more file write command operations; and

providing one or more metrics based on the one or more detection rules and a comparison of the one or more of the file information or the one or more file write command operations; and

responsive to one or more of the one or more metrics exceeding one or more threshold values, performing actions including:

capturing one or more read packets, wherein the one or more read packets are associated with one or more file read operations;

storing one or more read packet portions of the one or more read packets in one or more memory buffers;

extracting one or more portions of file data from the one or more stored read packet portions;

providing one or more files based on the one or more extracted portions of file data; and

providing one or more reports of one or more attacks based on the one or more exceeded threshold values; and

a client computer, comprising:

one or more transceivers that communicate over the network;

one or more memories that store at least one or more instructions; and

one or more processors that execute the one or more instructions to perform actions, including:

providing one or more portions of the one or more network flows.

9. The system of claim 8 , wherein providing the one or more metrics based on the one or more detection rules and one or more of the file information or the one or more file write command operations, further comprises:

comparing one or more portions of the file information to information included in one or more blacklists; and

responsive to one or more affirmative results of the comparison, incrementing one or more of the one or more metrics.

10. The system of claim 8 , wherein providing the one or more metrics based on the one or more detections rules and one or more of the file information or the one or more file write command operations, further comprises:

comparing one or more portions of the file information to information included in one or more whitelists; and

responsive to one or more negative results of the comparison, incrementing one or more of the one or more metrics.

11. The system of claim 8 , wherein the one or more attacks include one or more of Ransomware, man-in-the-middle, worm, Trojan, denial of service, spoofing, ARP (address resolution protocol) poison, Ping flood, Ping of death, Smurf, wiretapping, Port scan, Idle scan, buffer overflow, heap overflow, stack overflow, or format string attack.

12. The system of claim 8 , wherein the one or more processors of the network computer execute the one or more instructions to perform further actions, including:

capturing one or more read packets, wherein the one or more read packets are associated with one or more file read operations;

storing one or more read packet portions of the one or more read packets in one or more memory buffers; and

responsive to the one or more of the one or more metrics exceeding the one or more threshold values, performing further actions, including:

extracting one or more portions of file data from the one or more stored read packet portions; and

providing one or more files based on the one or more extracted portions of file data.

13. The system of claim 8 , wherein the one or more processors of the network computer execute the one or more instructions to perform actions, further comprising:

continuously capturing network traffic that is associated with the one or more network flows; and

storing the captured network traffic in a data store.

14. The system of claim 8 , wherein detecting the one or more file write operations, further comprises, comparing one or more other portions of the one or more packets to one or more values associated with one or more network file protocols.

15. A processor readable non-transitory storage media that includes instructions for detecting one or more attacks in a network, wherein execution of the instructions by one or more processors performs actions, comprising:

instantiating one or more network monitoring engines to passively monitoring one or more network flows using the one or more NMCs; and

responsive to the one or more network monitoring engines detecting one or more file write command operations based on information included in one or more packets of the one or more network flows, performing further actions, including:

instantiating a packet capture engine to selectively store captured portions of the one or more packets in a non-transitory storage medium;

instantiating an attack detection engine to perform actions, including:

executing one or more detection rules to analyze one or more portions of the one or more stored packets to identify file information that is associated with the one or more file write command operations; and

providing one or more metrics based on the one or more detection rules and a comparison of the one or more of the file information or the one or more file write command operations; and

responsive to one or more of the one or more metrics exceeding one or more threshold values, performing actions including:

capturing one or more read packets, wherein the one or more read packets are associated with one or more file read operations;

storing one or more read packet portions of the one or more read packets in one or more memory buffers;

extracting one or more portions of file data from the one or more stored read packet portions;

providing one or more files based on the one or more extracted portions of file data; and

providing one or more reports of one or more attacks based on the one or more exceeded threshold values.

16. The media of claim 15 , wherein providing the one or more metrics based on the one or more detection rules and one or more of the file information or the one or more file write command operations, further comprises:

comparing one or more portions of the file information to information included in one or more blacklists; and

responsive to one or more affirmative results of the comparison, incrementing one or more of the one or more metrics.

17. The media of claim 15 , wherein providing the one or more metrics based on the one or more detections rules and one or more of the file information or the one or more file write command operations, further comprises:

comparing one or more portions of the file information to information included in one or more whitelists; and

responsive to one or more negative results of the comparison, incrementing one or more of the one or more metrics.

18. The media of claim 15 , wherein the one or more attacks include one or more of Ransomware, man-in-the-middle, worm, Trojan, denial of service, spoofing, ARP (address resolution protocol) poison, Ping flood, Ping of death, Smurf, wiretapping, Port scan, Idle scan, buffer overflow, heap overflow, stack overflow, or format string attack.

19. The media of claim 15 , wherein the actions further comprise:

capturing one or more read packets, wherein the one or more read packets are associated with one or more file read operations;

storing one or more read packet portions of the one or more read packets in one or more memory buffers; and

responsive to the one or more of the one or more metrics exceeding the one or more threshold values, performing further actions, including:

extracting one or more portions of file data from the one or more stored read packet portions; and

providing one or more files based on the one or more extracted portions of file data.

20. The media of claim 15 , further comprising:

continuously capturing network traffic that is associated with the one or more network flows; and

storing the captured network traffic in a data store.

21. A network computer for detecting one or more attacks in a network, comprising:

one or more transceivers that communicate over a network;

one or more memories that store at least one or more instructions; and

one or more processors that execute the one or more instructions to perform actions, including:

instantiating one or more network monitoring engines to passively monitoring one or more network flows using the one or more NMCs; and

responsive to the one or more network monitoring engines detecting one or more file write command operations based on information included in one or more packets of the one or more network flows, performing further actions, including:

instantiating a packet capture engine to selectively store captured portions of the one or more packets in a non-transitory storage medium;

instantiating an attack detection engine to perform actions, including:

executing one or more detection rules to analyze one or more portions of the one or more stored packets to identify file information that is associated with the one or more file write command operations; and

providing one or more metrics based on the one or more detection rules and a comparison of the one or more of the file information or the one or more file write command operations; and

responsive to one or more of the one or more metrics exceeding one or more threshold values, performing actions including:

capturing one or more read packets, wherein the one or more read packets are associated with one or more file read operations;

storing one or more read packet portions of the one or more read packets in one or more memory buffers;

extracting one or more portions of file data from the one or more stored read packet portions;

providing one or more files based on the one or more extracted portions of file data; and

providing one or more reports of one or more attacks based on the one or more exceeded threshold values.

22. The network computer of claim 21 , wherein providing the one or more metrics based on the one or more detection rules and one or more of the file information or the one or more file write command operations, further comprises:

comparing one or more portions of the file information to information included in one or more blacklists; and

responsive to one or more affirmative results of the comparison, incrementing one or more of the one or more metrics.

23. The network computer of claim 21 , wherein providing the one or more metrics based on the one or more detections rules and one or more of the file information or the one or more file write command operations, further comprises:

comparing one or more portions of the file information to information included in one or more whitelists; and

responsive to one or more negative results of the comparison, incrementing one or more of the one or more metrics.

24. The network computer of claim 21 , wherein the one or more processors execute the one or more instructions to perform actions, further comprising:

continuously capturing network traffic that is associated with the one or more network flows; and

storing the captured network traffic in a data store.

25. The network computer of claim 21 , wherein the one or more processors execute the one or more instructions to perform further actions, including:

capturing one or more read packets, wherein the one or more read packets are associated with one or more file read operations;

storing one or more read packet portions of the one or more read packets in one or more memory buffers; and

responsive to the one or more of the one or more metrics exceeding the one or more threshold values, performing further actions, including:

extracting one or more portions of file data from the one or more stored read packet portions; and

providing one or more files based on the one or more extracted portions of file data.

26. The network computer of claim 21 , wherein the one or more attacks include one or more of Ransomware, man-in-the-middle, worm, Trojan, denial of service, spoofing, ARP (address resolution protocol) poison, Ping flood, Ping of death, Smurf, wiretapping, Port scan, Idle scan, buffer overflow, heap overflow, stack overflow, or format string attack.