Learned profiles for malicious encrypted network traffic identification
View Patent ↗The disclosure relates to detection of malicious network communications. In one embodiment, a method for identifying malicious encrypted network traffic associated with a malware software component communicating via a network is disclosed. The method includes training a neural network based on images for extracted portions of network traffic such that subsequent network traffic can be classified by the neural network to identify malicious network traffic associated with malware based on an image generated to represent a defined portion of the subsequent network traffic.
1. A method for identifying malicious encrypted network traffic associated with a malware software component communicating via a network, the method comprising:
defining, for the malware software component, a portion of network traffic including a plurality of contiguous bytes occurring at a predefined offset in a network communication of the malware software component;
extracting the defined portion of network traffic for each of a plurality of disparate network connections for the malware software component;
evaluating a metric for each byte in each extracted portion;
representing each extracted portion in a matrix data structure as an image of pixels wherein each pixel corresponds to a byte of the extracted portion; and
training a neural network based on the images for the extracted portions such that subsequent network traffic can be classified by the neural network to identify malicious network traffic associated with the malware software component based on an image generated to represent the defined portion of the subsequent network traffic.
2. The method of claim 1 wherein the metric is a Fourier transform coefficient.
3. The method of claim 1 wherein the metric is a measure of entropy as a measure of a degree of indeterminacy of bytes.
4. The method of claim 1 wherein the defined portion of network traffic is a subset of the network traffic subsequent to a transport protocol handshake and up to a predetermined endpoint.
5. The method of claim 4 wherein the predetermined endpoint is selected to correspond to an end of an application protocol connection setup portion of network traffic.
6. The method of claim 1 further comprising, in response to the identification of malicious network traffic, triggering a protective component to protect an endpoint of the network connections from the malicious encrypted network traffic.
7. The method of claim 6 wherein the protective component is operable to undertake one or more of:
terminating the network connection;
initiating a scan for malware installed at an endpoint computer system; and
adapting a level of security of an endpoint computer system or network connections.
8. The method of claim 2 wherein the portion of network traffic is defined such that an evaluated set of Fourier transform coefficients for the portion of encrypted malicious network traffic for a malware network communication distinguishes the malware network communication from non-malware network communication.
9. The method of claim 1 wherein the network connections are provided via a transmission control protocol (TCP) connection, and the portion is defined to be a continuous subset of traffic occurring over the network connections subsequent to a TCP handshake portion and up to a point in a flow of network traffic on the network connections where the traffic is encrypted.
10. A system for identifying malicious encrypted network traffic associated with a malware software component communicating via a network, the system comprising:
a memory and a processor, wherein the processor is adapted to:
define, for the malware software component, a portion of network traffic including a plurality of contiguous bytes occurring at a predefined offset in a network communication of the malware software component;
extract the defined portion of network traffic for each of a plurality of disparate network connections for the malware software component;
evaluate a metric for each byte in each extracted portion;
represent each extracted portion in a matrix data structure as an image of pixels
wherein each pixel corresponds to a byte of the extracted portion; and
train a neural network based on the images for the extracted portions such that subsequent network traffic can be classified by the neural network to identify malicious network traffic associated with the malware software component based on an image generated to represent the defined portion of the subsequent network traffic.
11. A non-transitory computer-readable storage medium storing a computer program element comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer system to perform the method as claimed in claim 1 .