Malicious relay and jump-system detection using behavioral indicators of actors

1. A method for identifying malicious network communications comprising:

receiving network traffic of a network;

extracting a set of metadata from the network traffic, the set of metadata representing network traffic between respective pairs of nodes of a plurality of pairs of nodes; and

detecting a common node acting as a relay on the network, the common node being a common to a source node and a destination node, detecting the common node acting as a relay by at least:

generating a source time series vector representing network traffic between the source node and the common node based on the set of metadata and a destination time series vector representing network traffic between the common node and the destination node based on the set of metadata,

generating a plurality of similarity scores by comparing the source time series vector and the destination time series vector, wherein the similarity scores correspond to a similarity of network behavior across legs of a potential relay arrangement, and

generating an alarm when a similarity score of the plurality of similarity scores is beyond a threshold, the alarm indicating that the common node is part of a relay arrangement.

2. The method of claim 1 , wherein a first similarity score of the plurality of similarity scores is generated based on a source time series vector and a destination time series vector before any temporal offset is applied to the source time series vector or the destination time series vector and a second similarity score of the plurality of similarity scores is generated after applying a temporal offset to the source time series vector or the destination time series vector.

3. The method of claim 1 , wherein the network traffic between the source node and the common node consists of network traffic from the source node and to the common node, and the network traffic between the common node and the destination node consists of network traffic from the common node and to the destination node.

4. The method of claim 1 , wherein the set of metadata is organized into different sessions, the source time series vector corresponds to a first session, and the destination time series vector corresponds to a second session.

5. The method of claim 1 , further comprising:

detecting a second common node acting as a second relay on the network, the second common node being common to a second source node and a second destination node, detecting the second common node acting as a relay by at least:

generating a second source time series vector representing network traffic between the second source node and the second common node based on the set of metadata and a second destination time series vector representing network traffic between the common node and the destination node based on the set of metadata, and

generating a second plurality of similarity scores by comparing the second source time series vector and the second destination time series vector, at least one second similarity score of the second plurality of similarity scores is generated after applying a temporal offset to the second source time series vector or the second destination time series vector, and

generating a second alarm when a second similarity score of the second plurality of similarity scores is beyond a threshold, the second alarm indicating that the second common node is part of a relay arrangement.

6. The method of claim 1 , wherein the source node, the common node, or the destination node is external to the network.

7. The method of claim 1 , wherein the source node, the common node, or the destination node is in a partitioned area of a network, and only a subset of nodes internal to the network have a trust-permission to access the partitioned area of the network.

8. A computer program product embodied on a non-transitory computer readable medium having stored thereon a sequence of instructions which, when executed by a processor causes the processor to execute a set of acts for identifying malicious network communications, the set of acts comprising:

receiving network traffic of a network;

extracting a set of metadata from the network traffic, the set of metadata representing network traffic between respective pairs of nodes of a plurality of pairs of nodes; and

detecting a common node acting as a relay on the network, the common node being a common to a source node and a destination node, detecting the common node acting as a relay by at least:

generating a source time series vector representing network traffic between the source node and the common node based on the set of metadata and a destination time series vector representing network traffic between the common node and the destination node based on the set of metadata,

generating a plurality of similarity scores by comparing the source time series vector and the destination time series vector, wherein the similarity scores correspond to a similarity of network behavior across legs of a potential relay arrangement, and

generating an alarm when a similarity score of the plurality of similarity scores is beyond a threshold, the alarm indicating that the common node is part of a relay arrangement.

9. The computer program product of claim 8 , wherein a first similarity score of the plurality of similarity scores is generated based on a source time series vector and a destination time series vector before any temporal offset is applied to the source time series vector or the destination time series vector and a second similarity score of the plurality of similarity scores is generated after applying a temporal offset to the source time series vector or the destination time series vector.

10. The computer program product of claim 8 , wherein the network traffic between the source node and the common node consists of network traffic from the source node and to the common node, and the network traffic between the common node and the destination node consists of network traffic from the common node and to the destination node.

11. The computer program product of claim 8 , wherein the set of metadata is organized into different sessions, the source time series vector corresponds to a first session, and the destination time series vector corresponds to a second session.

12. The computer program product of claim 8 , further comprising:

detecting a second common node acting as a second relay on the network, the second common node being common to a second source node and a second destination node, detecting the second common node acting as a relay by at least:

generating a second source time series vector representing network traffic between the second source node and the second common node based on the set of metadata and a second destination time series vector representing network traffic between the common node and the destination node based on the set of metadata, and

generating a second plurality of similarity scores by comparing the second source time series vector and the second destination time series vector, at least one second similarity score of the second plurality of similarity scores is generated after applying a temporal offset to the second source time series vector or the second destination time series vector, and

generating a second alarm when a second similarity score of the second plurality of similarity scores is beyond a threshold, the second alarm indicating that the second common node is part of a relay arrangement.

13. The computer program product of claim 8 , wherein the source node, the common node, or the destination node is external to the network.

14. The computer program product of claim 8 , wherein the source node, the common node, or the destination node is in a partitioned area of a network, and only a subset of nodes internal to the network have a trust-permission to access the partitioned area of the network.

15. A system for detecting threats on a network, comprising:

a computer processor to execute a set of program code instructions;

a memory to hold the set of program code instructions, in which the set of program code instructions comprises program code to perform:

receiving network traffic of a network;

extracting a set of metadata from the network traffic, the set of metadata representing network traffic between respective pairs of nodes of a plurality of pairs of nodes; and

detecting a common node acting as a relay on the network, the common node being a common to a source node and a destination node, detecting the common node acting as a relay by at least:

generating a source time series vector representing network traffic between the source node and the common node based on the set of metadata and a destination time series vector representing network traffic between the common node and the destination node based on the set of metadata,

generating a plurality of similarity scores by comparing the source time series vector and the destination time series vector, wherein the similarity scores correspond to a similarity of network behavior across legs of a potential relay arrangement, and

generating an alarm when a similarity score of the plurality of similarity scores is beyond a threshold, the alarm indicating that the common node is part of a relay arrangement.

16. The system of claim 15 , wherein a first similarity score of the plurality of similarity scores is generated based on a source time series vector and a destination time series vector before any temporal offset is applied to the source time series vector or the destination time series vector and a second similarity score of the plurality of similarity scores is generated after applying a temporal offset to the source time series vector or the destination time series vector.

17. The system of claim 15 , wherein the network traffic between the source node and the common node consists of network traffic from the source node and to the common node, and the network traffic between the common node and the destination node consists of network traffic from the common node and to the destination node.

18. The system of claim 15 , wherein the set of metadata is organized into different sessions, the source time series vector corresponds to a first session, and the destination time series vector corresponds to a second session.

19. The system of claim 15 , wherein the source node, the common node, or the destination node is external to the network.

20. The system of claim 15 , wherein the source node, the common node, or the destination node is in a partitioned area of a network, and only a subset of nodes internal to the network have a trust-permission to access the partitioned area of the network.