Malware detection for proxy server networks

1. A computer-implemented method executed by one or more processors, the method comprising:

passively monitoring, by an anti-malware system in data communication with a local area network (LAN), proxy connection requests sent from client devices on the LAN to a proxy, the proxy connection requests including a hostname and configured to direct the proxy to establish communication with a computer identified by the hostname on behalf of the client devices, wherein the anti-malware system is separate from the LAN;

determining, by the anti-malware system, identities of the client devices based on the proxy connection requests;

sending, by the anti-malware system and separately from the proxy establishing the directed communication, a domain name system (DNS) request to a DNS server to resolve an IP address for the hostname, wherein the DNS request includes the hostname from the proxy connection request, wherein the anti-malware system is configured to receive network traffic including interactions between the proxy, the client devices, and the DNS server to monitor anomalous network behavior;

identifying, by the anti-malware system, a DNS response from a DNS server in response to the DNS request;

determining, by the anti-malware system, that the DNS response is associated with a particular client device out of the plurality of client devices, based on the DNS response received by the anti-malware system;

updating, by the anti-malware system, DNS usage information for the particular client device based on the identified DNS response including the hostname from the proxy connection request; and

determining, by the anti-malware system, that the particular client is exhibiting anomalous behavior based on the updated DNS usage information.

2. The method of claim 1 , wherein identifying the DNS response including the hostname includes:

sending the DNS request including the hostname from the proxy connection request; and

receiving the DNS response.

3. The method of claim 1 , wherein the DNS usage information includes a DNS request rate for the particular client device, a DNS request failure rate for the particular client device, and hostnames included in DNS requests associated with the particular client device.

4. The method of claim 1 , wherein the hostname is included in a Uniform Resource Locator (URL).

5. The method of claim 1 , wherein the DNS request is sent by the proxy on behalf of the client devices and in response to the proxy connection request.

6. The method of claim 1 , further comprising:

performing a corrective action to the particular client device based on the determination.

7. The method of claim 6 , wherein the anomalous behavior is associated with a malicious software program, and the corrective action includes removing the particular client device from the network.

8. A system comprising:

one or more processors; and

computer memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

executing an anti-malware system, comprising;

identifying passively monitoring, by the anti-malware system in data communication with a local area network (LAN), proxy connection requests sent from client devices on the LAN to a proxy, the proxy connection requests including a hostname and configured to direct the proxy to establish communication with a computer identified by the hostname on behalf of the client devices, wherein the anti-malware system is separate from the LAN;

determining, by the anti-malware system, identities of the client devices based on the proxy connection requests;

sending, by the anti-malware system and separately from the proxy establishing the directed communication, a domain name system (DNS) request to a DNS server to resolve an IP address for the hostname, wherein the DNS request includes the hostname from the proxy connection request, wherein the anti-malware system is configured to receive network traffic including interactions between the proxy, the client devices, and the DNS server to monitor anomalous network behavior;

identifying, by the anti-malware system, a DNS response from a DNS server in response to the DNS request;

determining, by the anti-malware system, that the DNS response is associated with a particular client device out of the plurality of client devices, based on the DNS response received by the anti-malware system;

updating, by the anti-malware system, DNS usage information for the particular client device based on the identified DNS response including the hostname from the proxy connection request; and

determining, by the anti-malware system, that the particular client is exhibiting anomalous behavior based on the updated DNS usage information.

9. The system of claim 8 , wherein identifying the DNS response including the hostname includes:

sending the DNS request including the hostname from the proxy connection request; and

receiving the DNS response.

10. The system of claim 8 , wherein the DNS usage information includes a DNS request rate for the particular client device, a DNS request failure rate for the particular client device, and hostnames included in DNS requests associated with the particular client device.

11. The system of claim 8 , wherein the hostname is included in a Uniform Resource Locator (URL).

12. The system of claim 8 , wherein the DNS request is sent by the proxy on behalf of the client devices and in response to the proxy connection request.

13. The system of claim 8 , wherein the operations further comprise:

performing a corrective action to the particular client device based on the determination.

14. The system of claim 13 , wherein the anomalous behavior is associated with a malicious software program, and the corrective action includes removing the particular client device from the network.

15. A system comprising:

computing hardware operating together as an anti-malware system, the computing hardware comprising:

one or more network connections configured to communicate with a local area network (LAN);

one or more processors; and

computer-readable memory storing instructions that, when executed by the one or more processors, cause the one or more processors to operate the anti-malware system, comprising:

passively monitoring proxy connection requests sent from client devices on the LAN to a proxy, the proxy connection requests including a hostname and configured to direct the proxy to establish communication with a computer identified by the hostname on behalf of the client devices, wherein the anti-malware system is separate from the LAN;

determining identities of the client devices based on the proxy connection requests;

sending, separately from the proxy establishing the directed communication, a domain name system (DNS) request to a DNS server to resolve an IP address for the hostname, wherein the DNS request includes the hostname from the proxy connection request, wherein the anti-malware system is configured to receive network traffic including interactions between the proxy, the client devices, and the DNS server to monitor anomalous network behavior;

identifying, by the anti-malware system, a DNS response from a DNS server in response to the DNS request;

determining that the DNS response is associated with a particular client device out of the plurality of client devices, based on the DNS response received by the anti-malware system;

updating DNS usage information for the particular client device based on the identified DNS response including the hostname from the proxy connection request; and

determining that the particular client is exhibiting anomalous behavior based on the updated DNS usage information.

16. The system of claim 15 , wherein identifying the DNS response including the hostname includes:

sending the DNS request including the hostname from the proxy connection request; and

receiving the DNS response.

17. The system of claim 15 , wherein the DNS usage information includes a DNS request rate for the particular client device, a DNS request failure rate for the particular client device, and hostnames included in DNS requests associated with the particular client device.

18. The system of claim 15 , wherein the hostname is included in a Uniform Resource Locator (URL).

19. The system of claim 15 , wherein the DNS request is sent by the proxy on behalf of the client devices and in response to the proxy connection request.

20. The system of claim 15 , wherein the anomalous behavior is associated with a malicious software program.