System and method for detection of malicious network resources
A method and system for detection of malicious network resources in a distributed computer system are provided. The method comprises: receiving, by a first computing device, disposed inside the distributed computer system, an outbound traffic, detecting, by the first computing device, a suspicious external IP address in the outbound traffic, scanning, by the first computing device, a suspicious device located at the suspicious IP address to obtain a list of services running thereon, transmitting, by the first computing device, the suspicious IP address and the list of services to a second computing device disposed outside the distributed computer system, comparing, by the second computing device, the list of services with known malicious services, and in response to a match between at least one service from the list of services and a respective one of the known malicious services: determining the suspicious device, at the suspicious IP address, as being malicious.
1. A computer-implementable method for detection of malicious network resources, the method being executable by a first computing device of a distributed computer system, the first computing device being disposed inside of a perimeter of the distributed computer system, the first computing device being configured to communicatively connect to a second computing device of the distributed computer system, the second computing device being disposed outside of the perimeter of the distributed computer system, the method comprising:
receiving, by a communication module of the first computing device, an outbound traffic of the distributed computer system,
detecting, by a first analysis module of the first computing device, at least one suspicious external IP address in the outbound traffic,
scanning, by a scanning module of the first computing device, at least one suspicious device located at the detected at least one suspicious IP address to obtain a list of services running on the at least one suspicious device,
transmitting, by the communication module of the first computing device, the at least one suspicious IP address and the list of services to the second computing device, the transmitting being for triggering the second computing device to execute:
comparing, using a second analysis module of the second computing device, the list of services with a data on known malicious services, and
in response to a match between at least one service from the list of services and a respective one of the known malicious services:
determining, by the second analysis module of the second computing device, the at least one suspicious device, located at the at least one suspicious IP address as being a malicious one,
generating, by a notification module of the second computing device, at least one report on detection of malicious activity in the distributed computer system,
in response to an absence of the match between the at least one service from the list of services and the respective one of the known malicious services:
determining, by the second analysis module of the second computing device, an interval of ownership of the at least one suspicious IP address, and
in response to the interval of ownership being less than a threshold value, determining, by the second analysis module of the second computing device, the at least one suspicious device, located at the at least one suspicious IP address as being malicious one,
generating, by the notification module of the second computing device, the at least one report on detection of the malicious activity in the distributed computer system, and
in response to the interval of ownership exceeding the threshold value, determining, by the analysis module of the second computing device, the at least one suspicious device as being a legitimate one.
2. The method of claim 1 , wherein in response to the scanning module of the first computing device being incapable of accessing the at least one suspicious device located at the at least one suspicious IP address, the method further comprises:
transmitting, by the communication module of the first computing device, data about the at least one suspicious IP address to the second computing device, thereby triggering the second computing device to execute:
scanning, by a second scanning module of the second computing device, the at least one suspicious device located at the at least one suspicious IP address, and
obtaining, by the second scanning module of the second computing device, the list of services running on the at least one suspicious device.
3. The method of claim 1 , wherein the detecting, by the first analysis module of the first computing device, the at least one suspicious IP address in the outbound traffic comprises:
detecting at least one anomalous traffic fragment in the outbound traffic,
extracting, from the at least one anomalous traffic fragment, at least one IP address of a computing device to which the at least one traffic fragment is addressed, and
determining the extracted at least one IP address as being the at least one suspicious IP address.
4. The method of claim 3 , wherein the detecting the at least one anomalous traffic fragment in the outbound traffic, comprises applying at least one of:
a deep neural network having been trained on a tagged traffic,
a OneClassSVM classifier having been trained on legitimate traffic samples,
machine learning models, including at least one of: a Random Forest Classifier, an XGBoost machine-learning model, a KNN machine-learning model, an AdaBoost machine-learning model, that have been trained on tagged samples of traffic,
searching in the outbound traffic by pre-determined feature signatures, and
using a sliding window approach to collect statistical features of traffic logs of the outbound traffic.
5. The method of claim 1 , wherein the triggering the second computing device to execute the comparing the list of services with the data on the known malicious services comprises triggering the second computing device to use a network graph model of a communication network to which the distributed computer system is coupled.
6. The method of claim 1 , wherein the triggering the second computing device to execute the determining the interval of ownership of the at least one suspicious IP address comprises triggering the second computing device to use historical data on activity of IP addresses of a communication network to which the distributed computer system is coupled.
7. The method of claim 1 , wherein the transmitting is for further triggering the second computing device to transmit the at least one generated report on detection of the malicious activity in the distributed computer system to an operator thereof, the transmitting the at least one generated report comprising transmitting using at least one of:
an e-mail,
an SMS,
an MMS,
a push notification,
an instant messenger message, and
an API event.
8. A computing device of a distributed computer system for detection of malicious network resources, the computing device being disposed inside of a perimeter of the distributed computer system, the computing device comprising:
a processor and a non-transitory computer-readable medium storing instructions, the processor, upon executing the instructions, being configured to execute:
receiving, by a communication module of the computing device, an outbound traffic of the distributed computer system,
detecting, by an analysis module of the computing device, at least one suspicious external IP address in the outbound traffic,
scanning, by a scanning module of the computing device, at least one suspicious device located at the detected at least one suspicious IP address to obtain a list of services running on the at least one suspicious device, and
transmitting, by the communication module of the computing device, the at least one suspicious IP address and the list of services to an other computing device of the distributed computer system, which is disposed outside the perimeter of the distributed computer system, the transmitting being for triggering the other computing device to execute:
receiving, from the computing device, the at least one suspicious IP address and the list of services running on the at least one suspicious device;
comparing the list of services with a data on known malicious services, and
in response to a match between at least one service from the list of services and a respective one of the known malicious services:
determining the at least one suspicious device, located at the at least one suspicious IP address as being a malicious one,
generating at least one report on detection of malicious activity in the distributed computer system,
in response to an absence of the match between the at least one service from the list of services and the respective one of the known malicious services:
determining an interval of ownership of the at least one suspicious IP address, and
in response to the interval of ownership being less than a threshold value,
determining the at least one suspicious device, located at the at least one suspicious IP address as being malicious one, and
generating the at least one report on detection of the malicious activity in the distributed computer system, and
in response to the interval of ownership exceeding the threshold value, determining the at least one suspicious device as being a legitimate one.