Malware beaconing detection methods
A method for detecting malware beaconing in a network, the method includes capturing network traffic over a network connection at a network connected device, representing the network traffic over the network connection as a set of tuples wherein each of the tuples includes at least a source Internet Protocol address, a destination Internet Protocol address, and a destination port, associating timestamps with each of the set of tuples, and analyzing the tuples using the timestamps based on frequency of connections to determine malware beaconing on the network, wherein the analyzing is performed by a computing device.
1. A method for detecting malware beaconing in a network, the method comprising:
capturing network traffic over a network connection at a network connected device;
representing the network traffic over the network connection as a set of tuples wherein each of the tuples defines an Open Systems Interconnection (OSI) layer 4 communications session and includes at least a source Internet Protocol address, a destination Internet Protocol address, and a destination port;
associating timestamps with each of the set of tuples;
performing a frequency analysis of the tuples using the timestamps based on frequency of connections to determine malware beaconing on the network, wherein the performing the frequency is analysis is performed by a computing device; and
displaying to a user one or more connections identified as malware beaconing.
2. The method of claim 1 wherein the performing the frequency analysis of the set of tuples comprises performing a Fourier analysis.
3. The method of claim 2 wherein the Fourier analysis is a discrete Fourier transform.
4. The method of claim 1 wherein the performing the frequency analysis comprises inserting each of the connections into a time bucket based on the corresponding timestamp and inserting each duration between consecutive connections into duration buckets.
5. The method of claim 4 wherein each time bucket is stored in a time bucket hash map.
6. The method of claim 5 wherein each of the duration buckets is stored in a duration hash map.
7. The method of claim 4 wherein the performing the frequency analysis further comprises determining a smallest range of consecutive duration buckets containing T percent of all connections, wherein T is a threshold value.
8. The method of claim 7 wherein T is at least 80 percent.
9. The method of claim 8 wherein T is less than or equal to 90 percent.
10. The method of claim 7 wherein the performing the frequency analysis further comprises determining values for a low end and a high end of the smallest range of consecutive duration buckets containing T percent of all the connections.
11. The method of claim 7 wherein the performing the frequency analysis further comprises determining a difference in time between the consecutive duration buckets.
12. The method of claim 7 wherein the performing the frequency analysis further comprises determining a spread as a difference between first and last timestamps.
13. The method of claim 7 wherein the performing the frequency analysis further comprises determining at least one of range values, range, spread, fill, and size.
14. The method of claim 1 wherein the performing the frequency analysis further comprises obtaining at least one statistical measure associated with the network traffic.
15. The method of claim 1 further comprising reconfiguring a firewall to prevent network connections to the destination address and the destination port associated with the malware beaconing.
16. The method of claim 1 further comprising identifying software containing the malware.
17. The method of claim 16 further comprising removing the malware from the network.
18. The method of claim 1 wherein the network includes a firewall having a stateful mechanism.
19. The method of claim 11 wherein the performing the frequency analysis is based in part on data size of the network traffic.
20. A method for detecting malware beaconing in a network, the method comprising:
capturing network traffic over a network connection at a network connected device;
representing the network traffic over the network connection as a set of tuples wherein each of the tuples defines an Open Systems Interconnection (OSI) layer 4 communications session and includes at least a source Internet Protocol address, a destination Internet Protocol address, and a destination port;
associating timestamps with each of the set of tuples;
identifying malware beaconing on the network by analyzing the tuples using the timestamps based on frequency of connections, wherein the analyzing is performed by a computing device; and
alerting a user of the presence of malware beaconing when a measure of data size of the network traffic exceeds a threshold associated with malware beaconing.