Malware beacon detection system
A system that detects malware by analyzing message logs to identify message patterns that are periodic with similar-sized messages. These patterns may indicate malware since malware often sends beacon messages to a command-and-control system that are often periodic and of relatively similar length. The system may group message logs by the combination of source and destination and analyze each group for patterns of periodicity and message length uniformity. Entropy may be used to measure the uniformity of message lengths and message intervals, with low (or zero) entropy suggesting malware. Message intervals that repeat after several messages may be detected by testing subsequence sums for uniformity at different possible periods. Additional factors may be used to assess the risk, such as the duration of communication, and threat intelligence on the source or destination. The system may perform automated actions to eliminate or mitigate detected risks, such as blocking further communication.
1. A malware beacon detection system comprising:
a memory comprising software instructions; and,
a computer or a server comprising a processor that executes said software instructions configured to
receive a multiplicity of message logs, each message log of said multiplicity of message logs comprising
a source;
a destination;
a timestamp; and
a message length;
group said multiplicity of message logs into at least one communication pair group, wherein each communication pair group of said at least one communication pair group comprises message logs of said multiplicity of message logs having a same source and a same destination;
for each of said at least one communication pair group
calculate a message interval series comprising differences between said timestamp associated with successive message logs in each of said at least one communication pair group;
calculate a message length series comprising said message length for each message log in each of said at least one communication pair group;
calculate a length uniformity score that measures how closely said message length series conforms to a constant sequence;
for each period greater than or equal to one message interval and less than or equal to half of a length of said message interval series,
partition said message interval series into subsequences of length equal to said each period;
calculate a subsequence sum series comprising a sum of each subsequence of said subsequences;
calculate an entropy of said subsequence sum series;
calculate a periodicity score as a minimum entropy of said subsequence sum series across said each period greater than or equal to one message interval and less than or equal to said half of the length of said message interval series; and
calculate a malware beacon risk score as a function of said periodicity score and on said length uniformity score,
wherein said malware beacon risk score is a quantitative or qualitative ranking comprising a range of low threat, medium threat and high threat; and,
perform one or more automated response actions that is triggered based on said malware beacon risk score to eliminate or mitigate a malware threat,
wherein said one or more automated response actions are performed dependent on whether said malware beacon risk score is ranked as said low threat, said medium threat or said high threat, such that each automated response action of said one or more automated response actions is different and configured for each of said low threat, said medium threat and said high threat.
2. The malware beacon detection system of claim 1 , wherein said processor is further configured to remove outliers from said message interval series and from said message length series before calculating said periodicity score and said length uniformity score.
3. The malware beacon detection system of claim 1 , wherein said periodicity score comprises an entropy of said message interval series.
4. The malware beacon detection system of claim 1 , wherein said length uniformity score comprises an entropy of said message length series.
5. The malware beacon detection system of claim 1 , wherein said periodicity score comprises a degree to which said message interval series repeats.
6. The malware beacon detection system of claim 5 , wherein said degree to which said message interval series repeats according to said period is calculated by
calculating said degree to which said message interval series repeats according to said period as a measure of how closely said subsequence sum series conforms to said constant sequence.
7. The malware beacon detection system of claim 6 , wherein said measure of how closely said subsequence sum series conforms to said constant sequence comprises an entropy of said subsequence sum series.
8. The malware beacon detection system of claim 1 , wherein said malware beacon risk score is further based on a duration of communications between said source and said destination.
9. The malware beacon detection system of claim 1 , wherein said malware beacon risk score is further based on a threat assessment score assigned to one or both of said source and said destination.
10. The malware beacon detection system of claim 1 , wherein said malware beacon risk score is further based on a size of one or more messages between said source and said destination.
11. The malware beacon detection system of claim 1 , wherein said malware beacon risk score is further based on whether communication between said source and said destination is detected on multiple systems.
12. The malware beacon detection system of claim 1 , wherein said malware beacon risk score is further based on a request method utilized in communication between said source and said destination.
13. The malware beacon detection system of claim 1 , wherein said malware beacon risk score is further based on a resource type accessed in communication between said source and said destination.
14. The malware beacon detection system of claim 1 , wherein said one or more automated response actions comprise one or more of blocking outbound traffic on network devices, isolating an endpoint on a network, launching a system scan, and adding assets to a watchlist.
15. A malware beacon detection system comprising:
a memory comprising software instructions; and,
a computer or a server comprising a processor that executes said software instructions configured to
receive a multiplicity of message logs, each message log of said multiplicity of message logs comprising
a source;
a destination;
a timestamp; and
a message length;
group said multiplicity of message logs into at least one communication pair group, wherein each communication pair group of said at least one communication pair group comprises message logs of said multiplicity of message logs having a same source and a same destination;
for each communication pair group,
calculate
a message interval series comprising differences between said timestamp associated with successive message logs in each of said at least one communication pair group;
a message length series comprising said message length for each message log in each of said at least one communication pair group;
remove outliers from said message interval series and from said message length series;
for each period greater than or equal to one message interval and less than or equal to half of a length of said message interval series,
partition said message interval series into subsequences of length equal to said each period;
calculate a subsequence sum series comprising a sum of each subsequence of said subsequences;
calculate an entropy of said subsequence sum series;
calculate a periodicity score as a minimum entropy of said subsequence sum series across said each period greater than or equal to one message interval and less than or equal to said half of the length of said message interval series;
calculate a length uniformity score based on an entropy of said message length series;
calculate a malware beacon risk score as a function of
said periodicity score;
said length uniformity score;
a duration of communications between said source and said destination; and
a threat assessment score assigned to one or both of said source and said destination,
wherein said malware beacon risk score is a quantitative or qualitative ranking comprising a range of low threat, medium threat and high threat; and,
perform one or more automated response actions that is triggered based on said malware beacon risk score to eliminate or mitigate a malware threat,
wherein said one or more automated response actions are performed dependent on whether said malware beacon risk score is ranked as said low threat, said medium threat or said high threat, such that each automated response action of said one or more automated response actions is different and configured for each of said low threat, said medium threat and said high threat.