Aggregating network sessions into meta-sessions for ranking and classification

1. A method comprising:

obtaining session data related to a plurality of network sessions, a given one of the plurality of network sessions being associated with a set of two or more of a plurality of client devices;

analyzing the session data to identify one or more features of respective ones of the plurality of network sessions;

utilizing the one or more features to aggregate the plurality of network sessions into a plurality of meta-sessions, a given one of the meta-sessions comprising a set of two or more of the plurality of network sessions having features exhibiting at least a threshold level of similarity;

selecting a classifier for ranking the meta-sessions based on a scoring function that characterizes performance of the selected classifier in ranking meta-sessions having at least one designated characteristic;

ranking the meta-sessions utilizing the selected classifier;

providing a designated number of the ranked meta-sessions for additional processing to determine whether respective ones of the meta-sessions in the designated number of the ranked meta-sessions are potentially malicious; and

modifying access by the plurality of client devices to an additional network session responsive to the additional network session comprising session data with one or more features exhibiting at least the threshold level of similarity to one of the meta-sessions in the designated number of the ranked meta-sessions determined to be potentially malicious;

wherein the method is performed by at least one processing device comprising a processor coupled to a memory.

2. The method of claim 1 wherein the processing device comprises a network security system configured to communicate with the plurality of client devices over at least one network.

3. The method of claim 1 wherein the one or more features comprise indicators of compromise, the indicators of compromise comprising at least one of:

malware signatures; and

Internet Protocol (IP) addresses and IP domains associated with known potentially malicious network sessions.

4. The method of claim 1 wherein the one or more features comprise technical indicators associated with network protocols of respective ones of the plurality of network sessions, the technical indicators comprising at least one of:

a direct communication with an Internet Protocol (IP) address rather than an IP domain in a host header;

a hypertext transfer protocol (HTTP) POST request without a referrer header; and

an HTTP POST request in a given network session that does not utilize one or more other HTTP requests.

5. The method of claim 1 wherein the one or more features comprise session analysis features, the session analysis features comprising at least one of:

a connection originated from a first one of the plurality of client devices within a designated portion of a network to a second one of the plurality of client devices outside the designated portion of the network;

a connection originated from the second client device outside the designated portion of the network to the first client device within the designated portion of the network;

an entropy for payload streams of a given network session; and

a ratio of send versus receive data for the given network session.

6. The method of claim 1 wherein the given meta-session comprises two or more network sessions utilizing a same session protocol between a first one of the plurality of client devices and a second one of the plurality of client devices over a designated time period.

7. The method of claim 1 wherein ranking the meta-sessions comprises generating a list of the meta-sessions ordered based on risk of potential maliciousness.

8. The method of claim 7 wherein the scoring function characterizes the performance of the selected classifier in ranking meta-sessions that are potentially malicious at a top of the ordered list of the meta-sessions.

9. The method of claim 1 wherein the scoring function utilizes an exponential decay parameter, the exponential decay parameter assigning importance to the meta-sessions based on respective positions of the meta-sessions in an ordered list of the meta-sessions.

10. The method of claim 9 wherein the exponential decay parameter gives higher weight to a first x meta-sessions in the ordered list of the meta-sessions and exponentially lower weights to meta-sessions after the first x meta-sessions in the ordered list of the meta-sessions.

11. The method of claim 1 wherein the scoring function utilizes a precision parameter, the precision parameter characterizing an average precision at a designated position in an ordered list of the meta-sessions.

12. The method of claim 11 wherein the designated position is selected based on resources available for determining whether respective ones of the meta-sessions in the designated number of the ranked meta-sessions are potentially malicious.

13. The method of claim 12 wherein the designated position is adjusted over time as the resources available for determining whether respective ones of the meta-sessions in the designated number of the ranked meta-sessions are potentially malicious change.

14. The method of claim 1 wherein modifying access by the plurality of client devices to the additional network session comprises at least one of:

terminating the additional network session;

preventing a given one of the plurality of client devices from joining the additional network session;

causing the given client device to join the additional network session in a sandboxed application environment on the given client device.

15. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device cause the at least one processing device:

to obtain session data related to a plurality of network sessions, a given one of the plurality of network sessions being associated with a set of two or more of a plurality of client devices;

to analyze the session data to identify one or more features of respective ones of the plurality of network sessions;

to utilize the one or more features to aggregate the plurality of network sessions into a plurality of meta-sessions, a given one of the meta-sessions comprising a set of two or more of the plurality of network sessions having features exhibiting at least a threshold level of similarity;

to select a classifier for ranking the meta-sessions based on a scoring function that characterizes performance of the selected classifier in ranking meta-sessions having at least one designated characteristic;

to rank the meta-sessions utilizing the selected classifier;

to provide a designated number of the ranked meta-sessions for additional processing to determine whether respective ones of the meta-sessions in the designated number of the ranked meta-sessions are potentially malicious; and

to modify access by the plurality of client devices to an additional network session responsive to the additional network session comprising session data with one or more features exhibiting at least the threshold level of similarity to one of the meta-sessions in the designated number of the ranked meta-sessions determined to be potentially malicious.

16. The computer program product of claim 15 wherein the scoring function utilizes an exponential decay parameter, the exponential decay parameter assigning importance to the meta-sessions based on respective positions of the meta-sessions in an ordered list of the meta-sessions.

17. The computer program product of claim 15 wherein the scoring function utilizes a precision parameter, the precision parameter characterizing an average precision at a designated position in an ordered list of the meta-sessions, the designated position being selected based on resources available for determining whether respective ones of the meta-sessions in the designated number of the ranked meta-sessions are potentially malicious.

18. An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;

the at least one processing device being configured:

to obtain session data related to a plurality of network sessions, a given one of the plurality of network sessions being associated with a set of two or more of a plurality of client devices;

to analyze the session data to identify one or more features of respective ones of the plurality of network sessions;

to utilize the one or more features to aggregate the plurality of network sessions into a plurality of meta-sessions, a given one of the meta-sessions comprising a set of two or more of the plurality of network sessions having features exhibiting at least a threshold level of similarity;

to select a classifier for ranking the meta-sessions based on a scoring function that characterizes performance of the selected classifier in ranking meta-sessions having at least one designated characteristic;

to rank the meta-sessions utilizing the selected classifier;

to provide a designated number of the ranked meta-sessions for additional processing to determine whether respective ones of the meta-sessions in the designated number of the ranked meta-sessions are potentially malicious; and

to modify access by the plurality of client devices to an additional network session responsive to the additional network session comprising session data with one or more features exhibiting at least the threshold level of similarity to one of the meta-sessions in the designated number of the ranked meta-sessions determined to be potentially malicious.

19. The apparatus of claim 18 wherein the scoring function utilizes an exponential decay parameter, the exponential decay parameter assigning importance to the meta-sessions based on respective positions of the meta-sessions in an ordered list of the meta-sessions.

20. The apparatus of claim 18 wherein the scoring function utilizes a precision parameter, the precision parameter characterizing an average precision at a designated position in an ordered list of the meta-sessions, the designated position being selected based on resources available for determining whether respective ones of the meta-sessions in the designated number of the ranked meta-sessions are potentially malicious.