Command and control cyber vaccine
Provided are systems, methods, and computer program products for a cyber-antibody technique. In various implementations, the technique includes monitoring, by a network device infected with an unknown malware program, packets set by the network device onto a network. The technique further includes identifying a packet that is associated with the unknown malware program. The packet can be identified from among the monitored packets. Identifying the packet can include determining a characteristic of the packet. The technique further includes identifying packets that have a characteristic similar to the characteristic of the packet. The technique can further include inserting data associated with a known malware program into the identified packets. The technique can further include distributing the characteristic to other network devices, to similarly taint packets that may be issued from those other network devices.
1. A method, comprising:
executing, by a network security device on a network, a plurality of malware programs;
monitoring processes launched by the plurality of malware programs to identify a process that causes a packet to be generated for transmission to an entity outside a security perimeter of the network, wherein the packet is addressed to a network location;
determining that the packet is for establishing a communication channel with the entity, wherein the communication channel enables command and control messages to be sent between a malware program from the plurality of malware programs and the entity;
determining a characteristic of the packet, wherein the characteristic identifies the packet among other packets addressed to the network location; and
initiating a process on a network device, wherein the process uses the characteristic of the packet to identify a first set of packets from among additional packets being sent from the network device to the network location, wherein each of the first set of packets have a characteristic similar to the characteristic of the packet, wherein a second set of packets from among the additional packets do not have the characteristic similar to the characteristic of the packet, wherein the process inserts data associated with a known malware program into the first set of packets and not into the second set of packets, and wherein, when the additional packets reach the security perimeter, the security perimeter detects the data associated with the known malware program in the first set of packets and not in the second set of packets and blocks the first set of packets from being sent outside the network while allowing the second set of packets to be sent outside the network.
2. The method of claim 1 , wherein determining the characteristic of the packet includes examining a header portion of the packet.
3. The method of claim 1 , wherein determining the characteristic of the packet includes examining a payload portion of the packet.
4. The method of claim 3 , wherein examining the payload portion includes identifying a character string.
5. The method of claim 1 , wherein the data associated with the known malware program infects the first set of additional packets with the known malware program.
6. The method of claim 1 , wherein the processes launched by the plurality of malware programs are monitored for minutes, hours, days, or weeks.
7. The method of claim 1 , further comprising:
receiving a second characteristic from the network, wherein the second characteristic can be used to identify a second packet sent to establish a communication channel; and
configuring the process on the network device to use the second characteristic to identify packets that have a characteristic that is similar to the second characteristic.
8. The method of claim 1 , wherein identifying the packet occurs in real time.
9. The method of claim 1 , wherein the network location is a legitimate network location.
10. A network security device on a network, comprising:
one or more processors; and
a non-transitory computer-readable medium including instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
executing a plurality of malware programs;
monitoring processes launched by the plurality of malware programs to identify a process that causes a packet to be generated for transmission to an entity outside a security perimeter of the network, wherein the packet is addressed to a network location;
determining that the packet is for establishing a communication channel with the entity, wherein the communication channel enables command and control messages to be sent between a malware program from the plurality of malware programs and the entity;
determining a characteristic of the packet, wherein the characteristic identifies the packet among other packets addressed to the network location; and
initiating a process on a network device, wherein the process uses the characteristic of the packet to identify a first set of packets from among additional packets being sent from the network device to the network location, wherein each of the first set of packets have a characteristic similar to the characteristic of the packet, wherein a second set of packets from among the additional packets do not have the characteristic similar to the characteristic of the packet, wherein the process inserts data associated with a known malware program into the first set of packets and not into the second set of packets, and wherein, when the additional packets reach the security perimeter, the security perimeter detects the data associated with the known malware program in the first set of packets and not in the second set of packets and blocks the first set of packets from being sent outside the network while allowing the second set of packets to be sent outside the network.
11. The network security device of claim 10 , wherein the instructions for determining the characteristic of the packet include instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
examining a header portion of the packet.
12. The network security device of claim 10 , wherein the instructions for determining the characteristic of the packet include instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
examining a payload portion of the packet.
13. The network security device of claim 12 , wherein the instructions for examining the payload portion include instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
identifying a character string.
14. The network security device of claim 10 , wherein the data associated with the known malware program infects the first set of packets with the known malware program.
15. The network security device of claim 10 , wherein the instructions for determining the characteristic of the packet include instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
receiving a second characteristic from the network, wherein the second characteristic can be used to identify a second packet sent to establish a communication channel; and
configuring the process on the network device to use the second characteristic to identify packets that have a characteristic that is similar to the second characteristic.
16. The network security device of claim 10 , wherein identifying the packet occurs in real time.
17. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions that, when executed by one or more processors of a network security device on a network, cause the one or more processors to:
execute a plurality of malware programs;
monitor processes launched by the plurality of malware programs to identify a process that causes a packet to be generated for transmission to an entity outside a security perimeter of the network, wherein the packet is addressed to a network location;
determine that the packet is for establishing a communication channel with the entity, wherein the communication channel enables command and control messages to be sent between a malware program from the plurality of malware programs and the entity;
determine a characteristic of the packet, wherein the characteristic identifies the packet among other packets addressed to the network location; and
initiate a process on a network device, wherein the process uses the characteristic of the packet to identify a first set of packets from among additional packets being sent from the network device to the network location, wherein each of the first set of packets have a characteristic similar to the characteristic of the packet, wherein a second set of packets from among the additional packets do not have the characteristic similar to the characteristic of the packet, wherein the process inserts data associated with a known malware program into the first set of packets and not into the second set of packets, and wherein, when the additional packets reach the security perimeter, the security perimeter detects the data associated with the known malware program in the first set of packets and not in the second set of packets and blocks the first set of packets from being sent outside the network while allowing the second set of packets to be sent outside the network.
18. The computer-program product of claim 17 , wherein the instructions for determining the characteristic of the packet include instructions that, when executed by the one or more processors, cause the one or more processors to:
examine a header portion of the packet.
19. The computer-program product of claim 17 , wherein the instructions for determining the characteristic of the packet include instructions that, when executed by the one or more processors, cause the one or more processors to:
examine a payload portion of the packet.
20. The computer-program product of claim 19 , wherein the instructions for examining the payload portion include instructions that, when executed by the one or more processors, cause the one or more processors to:
identify a character string.