Method and system for identifying malicious activity of pre-determined type in local area network

1. A computer implemented method for identifying malicious activity of a pre-determined type, the method being executable by a supervisory electronic device, the supervisory electronic device being part of a local area network (LAN), the LAN including a plurality of electronic devices configured to access network resources via the LAN and a wide area network (WAN) accessible by the LAN, the method comprising:

accessing, by the supervisory electronic device, a log to retrieve usage information associated with at least a portion of the plurality of electronic devices;

analyzing, by the supervisory electronic device, the usage information to identify a subset of electronic devices, the subset of electronic devices being candidates for being associated with malicious activity within the WAN;

analyzing, by the supervisory electronic device, for each of the subset of electronic devices a list of network resources accessed by a respective one of the subset of electronic devices via the WAN;

executing, by the supervisory electronic device a polling robot, the polling robot configured to:

transmit to each of the list of network resources a ping message, the ping message having a first pre-determined format having been generated based on the pre-determined type of malicious activity;

receive from at least some of the list of network resources a response message;

analyzing, by the supervisory electronic device, the response message;

responsive to the response message having a second pre-determined format, the second pre-determined format having been identified based on the pre-determined type of malicious activity:

determining, by the supervisory electronic device, that an associated network resource having generated the response message is associated with malicious activity.

2. The method of claim 1 , wherein in response to one of: (i) the response message not having the second pre-determined format and (ii) lack of response from a given one of the list of network resources, determining that the given one of the list of network resources is not associated with malicious activity.

3. The method of claim 1 , wherein the pre-determined type is blockchain mining.

4. The method of claim 3 , wherein the first pre-determined format and the second pre-determined format are part of STRATUM overlay protocol.

5. The method of claim 4 , wherein the first pre-determined format and the second pre-determined format are part of handshake messages of the STRATUM overlay protocol.

6. The method of claim 1 , wherein the usage information is associated with operation of the portion of the plurality of electronic devices.

7. The method of claim 6 , wherein the usage information comprises at least one of:

CPU usage;

disk usage for writing; and

disk usage for reading.

8. The method of claim 6 , wherein the analyzing the usage information comprises applying at least one heuristic to the usage information.

9. The method of claim 8 , wherein the at least one heuristic comprises:

determining an average CPU usage to be above a first threshold;

determining a coefficient of variation of the CPU usage to be below a second threshold;

determining the disk usage for reading to be above a third threshold; and

determining the disk usage for writing to be below a fourth threshold.

10. The method of claim 1 , wherein the usage information comprises a list of network addresses used by the portion of the plurality of electronic devices to access network resources via the WAN.

11. The method of claim 10 , wherein the analyzing the usage information comprises applying at least one heuristic to the usage information.

12. The method of claim 11 , wherein the at least one heuristic comprises determining if access to the network resource has been using a pre-determined port associated with the pre-determined type of malicious activity.

13. The method of claim 11 , wherein the at least one heuristic comprises:

determining if access to the network resource has been done using one of a TCP port 3333, TCP port 5555, TCP port 7777, TCP port 8080, TCP port 14433, TCP port 14444, TCP port 37781, TCP port 45700, TCP port 45560 and TCP port 6667.

14. The method of claim 1 , wherein LAN comprises a cloud-based computing environment, and wherein the plurality of electronic devices comprises a plurality of Virtual Machines (VM) executed in the cloud-based computing environment.

15. The method of claim 1 , wherein the plurality of computing devices comprises a plurality of physical electronic devices connectable to the LAN for accessing the WAN.

16. The method of claim 1 , further comprising executing a remedial action in association with the associated network resource that has been determined to be associated with malicious activity.

17. The method of claim 16 , wherein the remedial action comprises blocking traffic to the associated network resources from the LAN.

18. The method of claim 16 , wherein the remedial action comprises blocking all network access to the WAN for a given electronic device that has accessed the network resource.

19. A supervisory electronic device for identifying malicious activity of a pre-determined type, the supervisory electronic device being part of a local area network (LAN), the LAN including a plurality of electronic devices configured to access network resources via the LAN and a wide area network (WAN) accessible by the LAN, the supervisory electronic device comprising a processor being configured to:

access a log to retrieve usage information associated with at least a portion of the plurality of electronic devices;

analyze the usage information to identify a subset of electronic devices, the subset of electronic devices being candidates for being associated with malicious activity within the WAN;

analyze for each of the subset of electronic devices a list of network resources accessed by a respective one of the subset of electronic devices via the WAN;

execute a polling robot, the polling robot configured to:

transmit to each of the list of network resources a ping message, the ping message having a first pre-determined format having been generated based on the pre-determined type of malicious activity;

receive from at least some of the list of network resources a response message;

analyze the response message;

responsive to the response message having a second pre-determined format, the second pre-determined format having been identified based on the pre-determined type of malicious activity:

determine that an associated network resource having generated the response message is associated with malicious activity.

20. The device of claim 19 , wherein in response to one of: (i) the response message not having the second pre-determined format and (ii) lack of response from a given one of the list of network resources, the processor is configured to determine that the given one of the list of network resources is not associated with malicious activity.