Botnet beaconing detection and mitigation

1. A method comprising:

collecting, by a processor, flow data associated with flows between a plurality of network elements;

processing, by the processor, the flow data to identify that a subset of the flows, between a first network element and a second network element of the plurality of network elements, occur at a regular interval;

determining, by the processor, sessions of packet transmission associated with each flow of the subset of flows;

identifying, by the processor, one or more of the sessions that exceed a threshold amount of time;

identifying, by the processor, at least one of the one or more sessions in which the packet transmission is below a threshold number of packets;

determining, by the processor, that the at least one of the one or more sessions is associated with a botnet beacon and the regular interval corresponds to a botnet beaconing interval;

using, by the processor, the botnet beaconing interval to identify a third network element of the plurality of network elements associated with a same botnet as the first and second network elements; and

forwarding, by the processor, a notification, wherein the notification includes information identifying the first, second, and third network elements as being associated with the same botnet.

2. The method of claim 1 , wherein processing the flow data further includes:

determining the regular interval based on an interval associated with the subset of the flows.

3. The method of claim 1 , wherein processing the flow data includes:

determining a plurality of intervals associated with the flows;

identifying a most commonly occurring one of the plurality of intervals associated with the flows between the plurality of network elements; and

identifying the regular interval based on the most commonly occurring interval.

4. The method of claim 3 , wherein identifying the regular interval based on the most commonly occurring interval includes:

identifying a range of intervals that includes the most commonly occurring interval;

identifying a subset of the flows associated with the range of intervals; and

determining that the most commonly occurring interval corresponds to the regular interval when the subset of the flows includes at least a threshold number of flows.

5. The method of claim 1 , wherein processing the flow data includes:

converting the flow data to the frequency domain data;

determining an interval associated with a highest magnitude among intervals associated with the flows between the plurality of network elements; and

determining the regular interval based on the interval.

6. The method of claim 5 , wherein converting the flow data to the frequency domain includes applying a fast Fourier transform to the flow data.

7. The method of claim 5 , wherein processing the flow data further includes:

identifying a range of intervals that include the determined interval;

determining an average magnitude associated with the range of intervals;

calculating a sharpness value based on a comparison of the magnitude associated with the interval and average magnitude associated with the range of intervals; and

determining that the interval corresponds to the regular interval when the sharpness value satisfies a threshold value.

8. A device comprising:

a communication interface;

a memory configured to store instructions; and

a processor configured to execute one or more of the instructions to:

collect, via the communication interface, flow data associated with flows between a plurality of network elements;

process the flow data to identify that a subset of the flows, between a first network element and a second network element of the plurality of network elements, occur at a regular interval;

determine, based on the flow data, sessions between the first network element and the second network element, wherein the sessions relate to packet transmission of the flows;

identify one or more of the sessions that exceed a threshold amount of time;

identify at least one of the one or more sessions in which the packet transmission is below a threshold number of packets;

determine that the at least one of the one or more sessions is associated with a botnet beacon and the regular interval corresponds to a botnet beaconing interval;

use the botnet beaconing interval to identify a third network element of the plurality of network elements associated with a same botnet as the first and second network elements; and

forward, via the communication interface, a notification, wherein the notification includes information identifying the first, second, and third network elements as being associated with the same botnet.

9. The device of claim 8 , wherein the processor, when processing the flow data, is further configured to execute one or more of the instructions to:

determine the regular interval based on an interval associated with the subset of the flows.

10. The device of claim 8 , wherein the processor, when processing the flow data, is further configured to execute one or more of the instructions to:

determine a plurality of intervals associated with the flows;

identify a most commonly occurring one of the plurality of intervals associated with the flows between the plurality of network elements; and

identify the regular interval based on the most commonly occurring interval.

11. The device of claim 10 , wherein the processor, when identifying the regular interval based on the most commonly occurring interval, is further configured to execute one or more of the instructions to:

identify a range of intervals that include the most commonly occurring interval;

identify a subset of the flows associated with range of intervals; and

determine that most commonly occurring interval corresponds to the regular interval when the subset of the flows includes at least a threshold number of flows.

12. The device of claim 8 , wherein the processor, when processing the flow data, is further configured to execute one or more of the instructions to:

convert the flow data to the frequency domain data;

determine an interval associated with a highest magnitude among intervals associated with the flows between the plurality of network elements; and

determine the regular interval based on the determined interval.

13. The device of claim 12 , wherein the processor, when determining the interval, is further configured to execute one or more of the instructions to:

identify first intervals included in the intervals, wherein the first intervals include a smallest interval associated with the flows between the pair of network elements;

identify second intervals included in the intervals, wherein the second intervals include a largest interval associated with the flows between the pair of network elements;

filter the intervals to form third intervals, wherein filtering the intervals includes removing the first intervals and the second intervals from the intervals; and

determine the interval from the third intervals.

14. The device of claim 12 , wherein the processor, when processing the data, is further configured to execute one or more of the instructions to:

identify a range of intervals that include the determined interval;

determine an average magnitude associated with the range of intervals;

calculate a sharpness value based on a comparison of the magnitude associated with the interval and average magnitude associated with the range of intervals; and

determine that the interval corresponds to the regular interval when the sharpness value exceeds a threshold value.

15. A non-transitory computer-readable medium to store instructions, wherein the instructions comprise:

one or more instructions that, when executed by a processor associated with a device, cause the processor to:

collect flow data associated with flows between a plurality of network elements;

process the flow data to identify that a subset of the flows, between a first network element and a second network element of the plurality of network elements, occur at a regular interval;

determine, based on the flow data, sessions between the first network element and the second network element, wherein the sessions relate to packet transmission of the flows;

identify one or more of the sessions that exceed a threshold amount of time;

identify at least one of the one or more sessions in which the packet transmission is below a threshold number of packets;

determine that the at least one of the one or more sessions is associated with a botnet beacon and the regular interval corresponds to a botnet beaconing interval;

use the botnet beaconing interval to identify a third network element of the plurality of network elements associated with a same botnet as the first and second network elements; and

forward a notification, wherein the notification includes information identifying the first, second, and third network elements as being associated with the same botnet.

16. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions further cause the processor, when processing the flow data, to:

determine the regular interval based on an interval associated with the subset of the flows.

17. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions further cause the processor, when processing the flow data, to:

determine a plurality of intervals associated with the flows;

identify a most commonly occurring one of the plurality of intervals associated with the flows between the plurality of network elements; and

identify the regular interval based on the most commonly occurring interval.

18. The non-transitory computer-readable medium of claim 17 , wherein the one or more instructions further cause the processor, when processing the flow data, to:

identify a range of intervals that include the most commonly occurring interval;

identify a subset of the flows associated with range of intervals; and

determine that most commonly occurring interval corresponds to the regular interval when the subset of the flows includes at least a threshold number of flows.

19. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions further cause the processor, when processing the flow data, to:

convert the flow data to the frequency domain data;

determine an interval associated with a highest magnitude among intervals associated with the flows between the plurality of network elements; and

determine the regular interval based on the determined interval.

20. The non-transitory computer-readable medium of claim 19 , wherein the one or more instructions further cause the processor, when processing the data, to:

identify a range of intervals that include the determined interval;

determine an average magnitude associated with the range of intervals;

calculate a sharpness value based on a comparison of the magnitude associated with the interval and average magnitude associated with the range of intervals; and

determine that the interval corresponds to the regular interval when the sharpness value satisfies a threshold value.