Network-based infection detection using host slowdown

1. A computer-implemented method for facilitating host malware detection, the method comprising:

a) determining, by a communications network device that passively monitors one or more network links between (A) a host and (B) at least one peer of the host, a baseline set of response time information for each of one or more types of transactions, wherein the response time information indicates a time including a delay between the host receiving a particular type of message from the at least one peer of the host and the host responding to the particular type of message, and wherein the communications network device is (A) a separate and distinct network entity from the host and the at least one peer of the host, and (B) included in or attached to one of a network switch, a network router, or a network hub;

b) determining, by the communications network device, a later set of response time information for each of the one or more types of transactions indicating a time including a delay between the host receiving a particular type of message from at least one peer of the host and the host responding to the particular type of message;

c) determining, by the communications network device, whether or not host slowdown has occurred by comparing the baseline set of response time information for at least one of the one or more types of transactions and the later set of response time information for the at least one of the one or more types of transactions; and

d) controlling the execution of a host malware protection policy using at least the determination of whether or not host slowdown has occurred.

2. The computer-implemented method of claim 1 wherein the act of determining the baseline set of response time information includes

1) for each of the one or more types of transactions involving the host, measuring at least one host response time delay,

2) for each of the one or more types of transactions involving the host, saving each of the at least one host response time delay,

3) for each of the one or more types of transactions involving the host, aggregating the saved at least one host response time delay,

4) generating, for the host, a delay characteristic vector using the aggregated at least one host response time delay for the one or more types of transactions involving the host, and

5) saving the delay characteristic vector.

3. The method of claim 1 wherein the act determining a later set of response time information for each of the one or more types of transactions involving the host is performed by an edge router using a SPAN port.

4. The method of claim 1 wherein the act of determining a later set of response time information for each of the one or more types of transactions involving the host is performed at a local area network hub.

5. The method of claim 1 wherein the act of determining a later set of response time information for each of the one or more types of transactions involving the host is performed at a network switch.

6. The method of claim 1 wherein at least one of the one or more types of transactions involving the host is a domain name system (DNS) transaction.

7. The method of claim 6 wherein each of the baseline set of response time information and the later set of response time information indicate a time including a delay between a dns-reply message received by the host from the at least one peer of the host and a tcp_syn/udp message sent from the host in response to the dns-reply message received.

8. The method of claim 1 wherein at least one of the one or more types of transactions involving the host is a transmission control protocol (TCP) transaction.

9. The method of claim 8 wherein each of the baseline set of response time information and the later set of response time information indicate a time including a delay between a tcp-reply message received by the host from the at least one peer of the host and a tcp_syn/udp message sent from the host in response to the tcp-reply message received.

10. The method of claim 1 wherein at least one of the one or more types of transactions involving the host is a post office protocol (POP) transaction.

11. The method of claim 10 wherein each of the baseline set of response time information and the later set of response time information indicate a time including a delay between a reply message received by the host from the at least one peer of the host and a transaction message sent from the host in response to the reply message received.

12. The method of claim 1 wherein at least one of the one or more types of transactions involving the host is a challenge-response transaction.

13. The method of claim 12 wherein each of the baseline set of response time information and the later set of response time information indicate a time including a delay between a challenge message received by the host from the at least one peer of the host and a response message sent from the host in response to the challenge message received.

14. The method of claim 1 wherein at least one of the one or more types of transactions involving the host is a digital signature verification transaction.

15. The method of claim 14 wherein each of the baseline set of response time information and the later set of response time information indicate a time including a delay between a retrieve keys message received by the host from the at least one peer of the host and a reply message sent from the host in response to the retrieve keys message received.

16. The method of claim 1 wherein the act of determining whether or not host slowdown has occurred using the baseline set of response time information and the later set of response time information uses at least one of (A) a feature vector comparison, (B) a statistical test, (C) hypothesis testing, and (D) a heuristic.

17. The method of claim 1 wherein the act of determining whether or not host slowdown has occurred by comparing the baseline set of response time information for at least one of the one or more types of transactions and the later set of response time information for at least one of the one or more types of transactions determines that a host slowdown has occurred if the later set of response time information indicates at least a 10 percent increase in delay in at least one of the one or more types of transactions involving the host from the baseline set of response time information.

18. A computer-implemented method comprising:

a) determining, by a communications network device that passively monitors one or more network links between A) a host and (B at least one peer of the host, a baseline set of response time information for each of one or more types of transactions, wherein the response time information indicates a time including a delay between the host receiving a particular type of message from the at least one peer of the host and the host responding to the particular type of message, and wherein the monitoring communications network device is (A) a separate and distinct network entity from the host and the at least one peer of the host, and (B) included in or attached to one of a network switch, network router, or a network hub;

b) determining, by the communications network device, a later set of response time information for each of the one or more types of transactions indicating a time including a delay between the host receiving a particular type of message from at least one peer of the host and the host responding to the particular type of message;

c) determining, by the communications network device, whether or not one of (A) a hardware modification of the host, (B) a hardware defect of the host, (C) a firmware update of the host, (D) a software update of the host, (E) a firmware problem of the host, or (F) a software problem of the host, has occurred by comparing the baseline set of response time information for at least one of the one or more types of transactions and the later set of response time information for the at least one of the one or more types of transactions; and

d) controlling the execution of a host change protection policy using at least the determination of whether or not one of (A) a hardware modification of the host, (B) a hardware defect of the host, (C) a firmware update of the host, (D) a software update of the host, (E) a firmware problem of the host, or (F) a software problem of the host has occurred.

19. A communications network device for facilitating host malware detection by passively monitoring one or more network links between (A) a host and (B) at least one peer of the host, the communications network device comprising:

a) at least one processor;

b) at least one input device; and

c) at least one storage device storing a computer executable code which, when executed by the at least one processor, causes the at least one processor to perform a method of

i) determining a baseline set of response time information for each of one or more types of transactions, wherein the response time information indicates a time including a delay between the host receiving a particular type of message from the at least one peer of the host and the host responding to the particular type of message, and wherein the communications network device is (A) a separate and distinct network entity from the host and the at least one peer of the host, and (B) included in or attached to one of a network switch, a network router, or a network hub;

ii) determining a later set of response time information for each of the one or more types of transactions indicating a time including a delay between the host receiving a particular type of message from at least one peer of the host and the host responding to the particular type of message;

iii) determining whether or not host slowdown has occurred by comparing the baseline set of response time information for at least one of the one or more types of transactions and the later set of response time information for the at least one of the one or more types of transactions; and

iv) controlling the execution of a host malware protection policy using at least the determination of whether or not host slowdown has occurred.

20. The monitoring apparatus of claim 19 wherein determining the baseline set of response time information includes

1) measuring at least one host response time delay for each of the one or more types of transactions involving the host,

2) saving each of the at least one host response time delay for each of the one or more types of transactions involving the host,

3) aggregating the saved at least one host response time delay for each of the one or more types of transactions involving the host,

4) generating, for the host, a delay characteristic vector using the aggregated at least one host response time delay for the one or more types of transactions involving the host, and

5) saving the delay characteristic vector.