Malware host netflow analysis system and method
A system and method for determining malware threats based on behavior of a host/IP address uses netflow data, white lists, black lists and machine learning classification with a model. A white list generation method may be used and a machine learning model validation method.
1. A system for determining if a host having an internet protocol (IP) address is malicious, the system comprising:
a computer having a processor, memory and a plurality of instructions so that the processor is configured to:
receive a set of netflow data wherein each piece of netflow data contains data about data traffic between a source internet protocol (IP) address of a host and a destination IP address, a black list that contains a list of one or more hosts that are malicious and a white list that contains a list of one or more hosts that are benign;
apply a classifier machine learning model to a set of features generated from the set of netflow data, the black list and the white list; and
generate a prediction using the classifier machine learning model for at least one of the hosts in the set of netflow data whether the host is malicious.
2. The system of claim 1 , wherein the processor is further configured to train the classifier machine learning model.
3. The system of claim 1 , wherein the processor is further configured to validate the classifier machine learning model using public information about an IP address of a host.
4. The system of claim 1 , wherein the processor is further configured to generate the white list.
5. The system of claim 1 , wherein the processor is further configured to extract one or more features from the set of netflow data.
6. A method for determining if a host having an internet protocol (IP) address is malicious, the method comprising:
receiving a set of netflow data wherein each piece of netflow data contains data about data traffic between a source internet protocol (IP) address of a host and a destination IP address, a black list that contains a list of one or more hosts that are malicious and a white list that contains a list of one or more hosts that are benign;
applying a classifier machine learning model to a set of features generated from the set of netflow data, the black list and the white list; and
generating a prediction using the classifier machine learning model for at least one of the hosts in the set of netflow data whether the host is malicious.
7. The method of claim 6 further comprising training the classifier machine learning model.
8. The method of claim 6 further comprising validating the classifier machine learning model using public information about an IP address of a host.
9. The method of claim 6 further comprising generating the white list using the set of netflow data.
10. The method of claim 6 further comprising extracting one or more features from the set of netflow data.
11. A method for generating a white list, comprising:
receiving a set of netflow data wherein each piece of netflow data contains data about data traffic between a source internet protocol (IP) address of a host and a destination IP address and a public white list of IP addresses;
extract a predetermined number of IP addresses from the public white list;
generating a plurality of IP addresses for hosts from the set of netflow data that satisfy a minimum connections threshold being a predetermined number of inbound and outbound connections during a predetermined period of time; and
generate a set of features for the hosts that satisfy the minimum connections threshold to produce a new white list.
12. The method of claim 11 , wherein extracting the IP addresses further comprises extracting the IP addresses within a time period.
13. The method of claim 12 , wherein extracting the IP addresses further comprises extracting IP addresses for hosts during a day and obtaining IP addresses from a given frequency range.
14. A method for validating a machine learning classifier model, comprising:
receiving a set of netflow data wherein each piece of netflow data contains data about data traffic between a source internet protocol (IP) address of a host and a destination IP address and a classifier model;
obtaining a plurality of IP addresses for hosts from the set of netflow data that satisfy a minimum connections threshold;
generating a plurality of features from the set of netflow data;
predicting, using the classifier model and the generated features, a host having an IP address that is malicious; and
scoring the predicted host based in public IP address information to validate the classifier model.
15. The method of claim 14 , wherein obtaining the plurality of IP addresses for hosts that satisfy a minimum connections threshold further comprises obtaining the plurality of IP addresses for hosts that satisfy a minimum connections threshold within a validation time period.
16. The method of claim 15 , wherein obtaining the plurality of IP addresses for hosts that satisfy a minimum connections threshold further comprises extracting IP addresses for hosts during a day and obtaining active IP addresses that meet predetermined criteria.