System and method for generating rules for attack detection feedback system

1. A method for auto-generation of decision rules for attack detection feedback systems, the method executable on a server, the method comprising:

receiving at least one event from an event database, the at least one event having been generated from data obtained by at least one of a plurality of sensors in response to a given decision rule having been triggered on the at least one of the plurality of sensors and being associated therewith;

the data being representative of network traffic;

the given decision rule including at least one malicious attribute indicative of at least one malware control center interaction associated with a given malware control center, the given decision rule having been triggered by virtue of the at least one malicious attribute being present in the data;

the at least one malware control center interaction associated with the given malware control center and belonging to a given class of malware control center interactions;

analyzing the at least one event to determine whether the at least one event belongs to the given class of malware control center interactions;

if the at least one event belongs to the given class of malware control center interactions, extracting at least one new attribute from the at least one event, the at least one new attribute being different from the at least one malicious attribute associated with the given decision rule;

generating at least one new decision rule using the at least one new attribute;

transmitting the at least one new decision rule to each of the plurality of sensors; and

causing each one of the plurality of sensors to use the at least one new decision rule to detect at least one new malware control center interaction associated with the given malware control center and belonging to the given class of malware control center interactions;

wherein the at least one new decision rule comprises at least two of a domain name system (DNS) query monitoring, an hypertext transfer protocol (HTTP) query monitoring, a communication session monitoring, and a transport layer security (TLS) handshake and certificate monitoring.

2. The method of claim 1 , wherein the at least one new attribute is at least one of an internet protocol (IP) address of a receiver of the data and a domain name extracted from control headings of the data being transferred.

3. The method of claim 1 , wherein the at least one new decision rule is saved using a version control system.

4. The method of claim 3 , wherein the version control system is GU, SVN, CVS or Mercurial.

5. The method of claim 1 , further comprising receiving, from the at least one of the plurality of sensors, a passively compiled list of DNS queries with replies.

6. The method of claim 1 , wherein the at least one new decision rule, that includes HTTP query monitoring, is generated using a passively compiled list of DNS queries with replies received from the at least one of the plurality of sensors.

7. The method of claim 5 , wherein the at least one new decision rule, that includes HTTP query monitoring, are generated using a passively compiled list of DNS queries with replies received from the at least one of the plurality of sensors.

8. The method of claim 1 , further comprising generating the event database.

9. The method of claim 1 , further comprising updating the at least one new decision rule based on further data obtained by any one of the plurality of sensors.

10. The method of claim 1 , further comprising periodically updating the at least one new decision rule.

11. The method of claim 1 , wherein the periodically updating the at least one new decision rule is executed based on additional data sensed by any one of the plurality of sensors.

12. The method of claim 1 , wherein the at least one new decision rule is used in addition to the given decision rule.

13. The method of claim 1 , wherein the at least one new decision rule is for identifying malware control center interactions not identifiable by the given decision rule.

14. A system for auto-generation of decision rules for attack detection feedback systems, the system comprising a hardware server, the hardware server running a database configured, by the hardware server, to store data, the data comprising:

a list of rule IDs for detecting malware control center interactions;

a list of trusted domain names; and

a passiveDNS, the passiveDNS being a list of DNS queries with replies, passively compiled by a plurality of sensors;

a decision rule database; and

the hardware server being configured to:

receive at least one event from the database, the at least one event having been generated from network data obtained by at least one of the plurality of sensors in response to a given decision rule having been triggered on the at least one of the plurality of sensors and being associated therewith;

the network data being representative of network traffic;

the given decision rule including at least one malicious attribute indicative of at least one malware control center interaction associated with a given malware control center, the given decision rule having been triggered by virtue of the at least one malicious attribute being present in the data;

the at least one malware control center interaction associated with the given malware control center and belonging to a given class of malware control center interactions;

analyze the at least one event to determine whether the at least one event belongs to the given class of malware control center interactions based on the rule ID list obtained from the database;

if the at least one event belongs to the given class of malware control center interactions, extract at least one new attribute from the at least one event, the at least one new attribute being different from the at least one malicious attribute associated with the given decision rule;

determine whether the at least one new attribute is in the list of trusted domain names obtained from the database;

generate at least one new decision rule, the at least one new decision rule comprising monitoring DNS queries, HTTP queries, communication sessions, TLS handshakes and certificates, which are related to the at least one extracted attribute;

transmit the at least one new decision rule to each of the plurality of sensors; and

cause each one of the plurality of sensors to use the at least one new decision rule to detect at least one new malware control center interaction associated with the given malware control center and belonging to the given class of malware control center interactions.