Detecting injection attacks using passive network monitoring

1. A method for monitoring network traffic using one or more network computers, comprising:

determining one or more requests that are provided to a server in a monitored network based on a first portion of network traffic;

determining one or more suspicious requests based on one or more characteristics of the one or more provided requests;

employing one or more characteristics of the one or more suspicious requests to provide correlation information associated with at least the one or more suspicious requests;

determining one or more dependent actions performed by the server, wherein the one or more dependent actions include one or more of dependent requests sent to one or more other servers in the monitored network and one or more other dependent actions performed by the one or more other servers in response to the one or more dependent requests;

employing one or more characteristics of the one or more dependent actions to evaluate the one or more dependent actions;

determining the result of the one or more dependent actions performed by the server and one or more other servers in the monitored network; and

in response to determining anomalous activity associated with the evaluation of the one or more dependent actions based on one or more correlations with the one or more suspicious requests, providing one or more reports that include information associated with the anomalous activity by the server and the one or more other servers in the monitored network, wherein the anomalous activity comprises, an injection attack based on malformed information included in the one or more suspicious requests that is associated with one or more of one or more malformed shell instructions, malformed command instructions, or malformed interprocess communication associated with the one or more dependent actions, and wherein the determining of the anomalous activity includes:

determining malformed information that is included in the one or more dependent actions based on an association with other malformed information that is included in the one or more suspicious requests; and

further determining the anomalous activity based on one or more of the malformed information or the other malformed information.

2. The method of claim 1 , further comprising:

determining a source of the anomalous activity based on one or more of the correlation information, the one or more suspicious requests, the one or more dependent actions, or the one or more results associated with the one or more dependent actions; and

including the source of the anomalous activity in the one or more reports.

3. The method of claim 1 , wherein determining the one or more dependent actions, further comprises, comparing identifier information in a payload of one or more actions with other identifier information included in a payload of the one or more requests, wherein an affirmative result indicates that the one or more actions are the one or more dependent actions.

4. The method of claim 1 , wherein determining the anomalous activity, further comprises:

determining one or more inconsistencies associated with the one or more suspicious requests, or the one or more dependent requests; and

further determining the anomalous activity based on the one or more determined inconsistencies.

5. The method of claim 1 , wherein the one or more characteristics of the one or more suspicious requests, includes, one or more of contents of the one or more suspicious requests, a sender of the one or more suspicious requests, a target of the one or more suspicious requests, tuple information, time of day, network utilization, or a rate of requests sent or received.

6. The method of claim 1 , wherein the anomalous activity further comprises, an injection attack based on malformed information included in the one or more suspicious requests that is associated with malformed structured query language (SQL) instructions that are included in the one or more dependent actions.

7. A processor readable non-transitory storage media that includes instructions for monitoring network traffic using one or more network computers, wherein execution of the instructions by the one or more network computers performs the method comprising:

determining one or more requests that are provided to a server in a monitored network based on a first portion of network traffic;

determining one or more suspicious requests based on one or more characteristics of the one or more provided requests;

employing one or more characteristics of the one or more suspicious requests to provide correlation information associated with at least the one or more suspicious requests;

determining one or more dependent actions performed by the server, wherein the one or more dependent actions include one or more of dependent requests sent to one or more other servers in the monitored network and one or more other dependent actions performed by the one or more other servers in response to the one or more dependent requests;

employing one or more characteristics of the one or more dependent actions to evaluate the one or more dependent actions;

determining the result of the one or more dependent actions performed by the server and one or more other servers in the monitored network; and

in response to determining anomalous activity associated with the evaluation of the one or more dependent actions based on one or more correlations with the one or more suspicious requests, providing one or more reports that include information associated with the anomalous activity by the server and the one or more other servers in the monitored network, wherein the anomalous activity comprises, an injection attack based on malformed information included in the one or more suspicious requests that is associated with one or more of one or more malformed shell instructions, malformed command instructions, or malformed interprocess communication associated with the one or more dependent actions, and wherein the determining of the anomalous activity includes:

determining malformed information that is included in the one or more dependent actions based on an association with other malformed information that is included in the one or more suspicious requests; and

further determining the anomalous activity based on one or more of the malformed information or the other malformed information.

8. The media of claim 7 , further comprising:

determining a source of the anomalous activity based on one or more of the correlation information, the one or more suspicious requests, the one or more dependent actions, or the one or more results associated with the one or more dependent actions; and

including the source of the anomalous activity in the one or more reports.

9. The media of claim 7 , wherein determining the one or more dependent actions, further comprises, comparing identifier information in a payload of one or more actions with other identifier information included in a payload of the one or more requests, wherein an affirmative result indicates that the one or more actions are the one or more dependent actions.

10. The media of claim 7 , wherein the one or more characteristics of the one or more suspicious requests, includes, one or more of contents of the one or more suspicious requests, a sender of the one or more suspicious requests, a target of the one or more suspicious requests, tuple information, time of day, network utilization, or a rate of requests sent or received.

11. The media of claim 7 , wherein the anomalous activity further comprises, an injection attack based on malformed information included in the one or more suspicious requests that is associated with malformed structured query language (SQL) instructions that are included in the one or more dependent actions.

12. A network monitoring computer (NMC) for monitoring communication over a network between one or more computers, comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

determining one or more requests that are provided to a server in a monitored network based on a first portion of network traffic;

determining one or more suspicious requests based on one or more characteristics of the one or more provided requests;

employing one or more characteristics of the one or more suspicious requests to provide correlation information associated with at least the one or more suspicious requests;

determining one or more dependent actions performed by the server, wherein the one or more dependent actions include one or more of dependent requests sent to one or more other servers in the monitored network and one or more other dependent actions performed by the one or more other servers in response to the one or more dependent requests;

employing one or more characteristics of the one or more dependent actions to evaluate the one or more dependent actions;

determining the result of the one or more dependent actions performed by the server and one or more other servers in the monitored network; and

in response to determining anomalous activity associated with the evaluation of the one or more dependent actions based on one or more correlations with the one or more suspicious requests, providing one or more reports that include information associated with the anomalous activity by the server and the one or more other servers in the monitored network, wherein the anomalous activity comprises, an injection attack based on malformed information included in the one or more suspicious requests that is associated with one or more of one or more malformed shell instructions, malformed command instructions, or malformed interprocess communication associated with the one or more dependent actions, and wherein the determining of the anomalous activity includes:

determining malformed information that is included in the one or more dependent actions based on an association with other malformed information that is included in the one or more suspicious requests; and

further determining the anomalous activity based on one or more of the malformed information or the other malformed information.

13. The NMC of claim 12 , wherein the one or more processors execute instructions that perform actions, further comprising:

determining a source of the anomalous activity based on one or more of the correlation information, the one or more suspicious requests, the one or more dependent actions, or the one or more results associated with the one or more dependent actions; and

including the source of the anomalous activity in the one or more reports.

14. The NMC of claim 12 , wherein determining the one or more dependent actions, further comprises, comparing identifier information in a payload of one or more actions with other identifier information included in a payload of the one or more requests, wherein an affirmative result indicates that the one or more actions are the one or more dependent actions.

15. The NMC of claim 12 , wherein determining the anomalous activity, further comprises:

determining one or more inconsistencies associated with the one or more suspicious requests, or the one or more dependent requests; and

further determining the anomalous activity based on the one or more determined inconsistencies.

16. The NMC of claim 12 , wherein the one or more characteristics of the one or more suspicious requests, includes, one or more of contents of the one or more suspicious requests, a sender of the one or more suspicious requests, a target of the one or more suspicious requests, tuple information, time of day, network utilization, or a rate of requests sent or received.

17. The NMC of claim 12 , wherein the anomalous activity further comprises, an injection attack based on malformed information included in the one or more suspicious requests that is associated with malformed structured query language (SQL) instructions that are included in the one or more dependent actions.