Detecting attacks and quarantining malware infected devices
Attacks on a network device, e.g. an IoT device, are detected by analyzing network traffic and subsequently quarantining or blocking the network device on the network to prevent lateral movement of malware. The techniques described herein relate to developing a baseline of network device activity corresponding with a network device during a learning period and comparing the baseline of network device activity with new network activity by the network device in order to identify potentially unusual network device activity by the network device. If unusual network activity is found, remedial actions such as quarantining the network device or restricting some access to a network may be initiated.
1. A method comprising:
receiving, from a first device on a network, incoming network traffic;
receiving previous network traffic from a second device having the same device type as the first device on an isolated network for a predetermined time period,
creating a network traffic baseline based on the previous network traffic;
comparing the network traffic baseline associated with the incoming network traffic;
determining, based on the comparison, an anomaly type associated with the incoming network traffic; and
changing access to the network by the first device according to an access restriction selected from a set of access restrictions, wherein the access restriction corresponds to the anomaly type.
2. The method of claim 1 , further comprising:
analyzing the incoming network traffic to determine a device type of the first device;
identifying a plurality of devices having the device type; and
associating the network traffic baseline with the plurality of devices.
3. The method of claim 1 , further comprising:
analyzing the incoming network traffic to determine a device class of the first device; and
identifying a plurality of devices having the device class; and
associating the network traffic baseline with the plurality of devices.
4. The method of claim 1 , further comprising determining, by a machine learning engine and from the received previous network traffic, a machine learning model, wherein:
the comparing the network traffic baseline to the incoming network traffic includes applying the machine learning model to the incoming network traffic to determine an anomaly prediction; and
the anomaly type is determined according to the anomaly prediction.
5. The method of claim 1 , wherein the changing access to the network is based at least partially on an anomaly severity of an anomaly identified in the incoming network traffic.
6. The method of claim 1 , wherein:
the access restriction is associated with a role of the first device; and
the changing access includes changing the role of the first device.
7. The method of claim 1 , wherein the changing access includes one or more or a combination of:
quarantining the first device from the network;
removing, from the first device, access to a subset of devices on the network; and
logging network traffic of the first device within the network.
8. The method of claim 1 , wherein the network traffic baseline is associated with the device type of the first device, wherein the method further comprises:
determining the device type of the first device based on the incoming network traffic;
querying a data store for the network traffic baseline matching the device type; and
retrieving the network traffic baseline from the data store.
9. The method of claim 1 , wherein the comparing the network traffic baseline with the incoming network traffic includes one or more or a combination of:
comparing a domain name of the network traffic baseline with a corresponding domain name of the incoming network traffic;
comparing a packet rate of the network traffic baseline with a corresponding packet rate of the incoming network traffic; and
comparing a data rate of the network traffic baseline with a corresponding data rate of the incoming network traffic.
10. A non-transitory computer-readable medium having encoded therein programming code executable by one or more processors to perform or control performance of operations comprising:
receiving, from a first device on a network, incoming network traffic;
receiving previous network traffic from a second device having the same device type as the first device on an isolated network for a predetermined time period,
creating a network traffic baseline based on the previous network traffic;
comparing the network traffic baseline associated with the incoming network traffic;
determining, based on the comparison, an anomaly type associated with the incoming network traffic; and
changing access to the network by the first device according to an access restriction selected from a set of access restrictions, wherein the access restriction corresponds to the anomaly type.
11. The non-transitory computer-readable medium of claim 10 , wherein the operations further comprise:
analyzing the incoming network traffic to determine a device type of the first device; and
identifying a plurality of devices having the device type; and
associating the network traffic baseline with the plurality of devices.
12. The non-transitory computer-readable medium of claim 10 , wherein the operations further comprise:
analyzing the incoming network traffic to determine a device class of the first device;
identifying a plurality of devices having the device class; and
associating the network traffic baseline with the plurality of devices.
13. The non-transitory computer-readable medium of claim 10 , wherein:
the operations further comprise determining, by a machine learning engine and from the received previous network traffic, a machine learning model;
the comparing the network traffic baseline to the incoming network traffic includes applying the machine learning model to the incoming network traffic to determine an anomaly prediction; and
the anomaly type is determined according to the anomaly prediction.
14. The non-transitory computer-readable medium of claim 10 , wherein the changing access to the network is based at least partially on an anomaly severity of an anomaly identified in the incoming network traffic.
15. The non-transitory computer-readable medium of claim 10 , wherein:
the access restriction is associated with a role of the first device; and
the changing access includes changing the role of the first device.
16. The non-transitory computer-readable medium of claim 10 , wherein the changing access includes one or more or a combination of:
quarantining the first device from the network;
removing, from the first device, access to a subset of devices on the network; and
logging network traffic of the first device within the network.
17. The non-transitory computer-readable medium of claim 10 , wherein:
the network traffic baseline is associated with the device type of the first device; and
the operations further comprise:
determining the device type of the first device based on the incoming network traffic;
querying a data store for the network traffic baseline matching the device type; and
retrieving the network traffic baseline from the data store.
18. The non-transitory computer-readable medium of claim 10 , wherein the comparing the network traffic baseline with the incoming network traffic includes one or more or a combination of:
comparing a domain name of the network traffic baseline with a corresponding domain name of the incoming network traffic;
comparing a packet rate of the network traffic baseline with a corresponding packet rate of the incoming network traffic; and
comparing a data rate of the network traffic baseline with a corresponding data rate of the incoming network traffic.
19. A system comprising:
one or more processors; and
a non-transitory computer-readable medium including:
a data collector executable by the one or more processors to receive, from a first device on a network, incoming network traffic, and to receive previous network traffic from a second device having the same device type as the first device on an isolated network for a predetermined time period; and
a traffic analyzer executable by the one or more processors to:
receive, from the data collector, the incoming network traffic and the previous network traffic;
create a network traffic baseline based on the previous network traffic;
compare the network traffic baseline with the incoming network traffic;
determine, based on the comparison, an anomaly type associated with the incoming network traffic; and
change access to the network by the first device according to an access restriction selected from a set of access restrictions, wherein the access restriction corresponds to the anomaly type.
20. The system of claim 19 , wherein the device profiler is further executable by the one or more processors to determine, based on analyzing the incoming network traffic, a device class of the first device, wherein the network traffic baseline is associated with a plurality of devices having the device class.