Structural command and control detection of polymorphic malware

1. A method comprising:

receiving, at a service, a plurality of process hashes for processes executed by a plurality of devices;

receiving, at the service, traffic data indicative of traffic between the plurality of devices and a plurality of remote server domains;

forming, by the service, a bipartite graph based on the process hashes and the traffic data, wherein the bipartite graph comprises a first set of nodes, each of which representing a process hash for a process executing on a device, and a second set of nodes, each of which representing a server domain, and wherein an edge in the bipartite graph between a node in the first set and a node in the second set represents network traffic between a particular process and a particular server domain;

identifying, by the service, a subset of the plurality of processes as exhibiting polymorphic malware behavior based at least on an average prevalence of each process hash that is associated with each server domain according to the bipartite graph; and

causing, by the service, performance of a mitigation action in the network based on the identified subset of processes identified as exhibiting polymorphic malware behavior,

wherein the identifying of the subset of the plurality of processes as exhibiting polymorphic malware behavior comprises:

pruning the bipartite graph by selecting server domains that are contacted by a threshold number of the processes such that the average prevalence of each process hash that is associated with each server domain is less than or equal to a defined threshold.

2. The method as in claim 1 , wherein the mitigation action comprises one of: blocking network traffic associated with a device hosting one of the processes identified as exhibiting polymorphic malware behavior, blocking network traffic associated with a server domain, or generating an alert regarding the identified processes.

3. The method as in claim 1 , wherein identifying, by the service and based on the bipartite graph, the subset of the plurality of processes as exhibiting polymorphic malware behavior further comprises:

co-clustering the process hashes and server domains in the graph into clusters by clustering the process hashes based on the server domains to which they connected and by clustering the server domains based on the processes hashes that connected to them; and

determining that a process hash in a particular one of the clusters is associated with malware.

4. The method as in claim 3 , wherein identifying, by the service and based on the bipartite graph, the subset of the plurality of processes as exhibiting polymorphic malware behavior further comprises:

labeling the other process hashes in the particular cluster as associated with malware.

5. The method as in claim 3 , wherein identifying, by the service and based on the bipartite graph, the subset of the plurality of processes as exhibiting polymorphic malware behavior further comprises:

labeling server domains in a cluster to which the particular cluster communicated as command and control servers.

6. The method as in claim 1 , wherein the service receives the process hashes from anti-malware engines executed by the plurality of devices.

7. The method as in claim 1 , wherein the service receives the traffic data from a router or switch.

8. The method as in claim 1 , wherein the service is a cloud-based service.

9. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed configured to:

receive a plurality of process hashes for processes executed by a plurality of devices;

receive traffic data indicative of traffic between the plurality of devices and a plurality of remote server domains;

form a bipartite graph based on the process hashes and the traffic data, wherein the bipartite graph comprises a first set of nodes, each of which representing a process hash for a process executing on a device, and a second set of nodes, each of which representing a server domain, and wherein an edge in the bipartite graph between a node in the first set and a node in the second set represents network traffic between a particular process and a particular server domain;

identify a subset of the plurality of processes as exhibiting polymorphic malware behavior based at least on an average prevalence of each process hash that is associated with each server domain according to the bipartite graph; and

cause performance of a mitigation action in the network based on the identified subset of processes identified as exhibiting polymorphic malware behavior,

wherein the apparatus identifies the subset of the plurality of processes as exhibiting polymorphic malware behavior by:

pruning the bipartite graph by selecting server domains that are contacted by a threshold number of the processes such that the average prevalence of each process hash that is associated with each server domain is less than or equal to a defined threshold.

10. The apparatus as in claim 9 , wherein the mitigation action comprises one of: blocking network traffic associated with a device hosting one of the processes identified as exhibiting polymorphic malware behavior, blocking network traffic associated with a server domain, or generating an alert regarding the identified processes.

11. The apparatus as in claim 9 , wherein the apparatus identifies, based on the bipartite graph, the subset of the plurality of processes as exhibiting polymorphic malware behavior by:

co-clustering the process hashes and server domains in the graph into clusters by clustering the process hashes based on the server domains to which they connected and by clustering the server domains based on the processes hashes that connected to them; and

determining that a process hash in a particular one of the clusters is associated with malware.

12. The apparatus as in claim 11 , wherein the apparatus identifies, based on the bipartite graph, the subset of the plurality of processes as exhibiting polymorphic malware behavior further by:

labeling the other process hashes in the particular cluster as associated with malware.

13. The apparatus as in claim 9 , wherein the apparatus identifies, based on the bipartite graph, the subset of the plurality of processes as exhibiting polymorphic malware behavior further by:

labeling server domains in a cluster to which the particular cluster communicated as command and control servers.

14. The apparatus as in claim 9 , wherein the apparatus receives the process hashes from anti-malware engines executed by the plurality of devices.

15. The apparatus as in claim 9 , wherein the apparatus receives the traffic data from a router or switch.

16. The apparatus as in claim 9 , wherein the apparatus provides a cloud-based service to the devices.

17. A tangible, non-transitory, computer-readable medium storing program instructions that cause a service to execute a process comprising:

receiving, at the service, a plurality of process hashes for processes executed by a plurality of devices;

receiving, at the service, traffic data indicative of traffic between the plurality of devices and a plurality of remote server domains;

forming, by the service, a bipartite graph based on the process hashes and the traffic data, wherein the bipartite graph comprises a first set of nodes, each of which representing a process hash for a process executing on a device, and a second set of nodes, each of which representing a server domain, and wherein an edge in the bipartite graph between a node in the first set and a node in the second set represents network traffic between a particular process and a particular server domain;

identifying, by the service, a subset of the plurality of processes as exhibiting polymorphic malware behavior based at least on an average prevalence of each process hash that is associated with each server domain according to the bipartite graph; and

causing, by the service, performance of a mitigation action in the network based on the identified subset of processes identified as exhibiting polymorphic malware behavior,

wherein the identifying of the subset of the plurality of processes as exhibiting polymorphic malware behavior comprises:

pruning the bipartite graph by selecting server domains that are contacted by a threshold number of the processes such that the average prevalence of each process hash that is associated with each server domain is less than or equal to a defined threshold.

18. The computer-readable medium as in claim 17 , wherein identifying, by the service and based on the bipartite graph, the subset of the plurality of processes as exhibiting polymorphic malware behavior further comprises:

co-clustering the process hashes and server domains in the graph into clusters by clustering the process hashes based on the server domains to which they connected and by clustering the server domains based on the processes hashes that connected to them; and

determining that a process hash in a particular one of the clusters is associated with malware.