Using packet fingerprinting at an endpoint to detect malware
Aspects of the present disclosure are directed to on-device firewall and library agents integrated with secure agents on network connected endpoints. The on-device firewall and library agents enable inline analysis and inspection of data packets using protocol fingerprints generated for the data packets using an on-device malware detection engine. In one aspect, a network device includes a driver configured to capture a plurality of data packets received at the network device; and an on-device malware detection engine configured to receive at least a subset of the plurality of packets, and generate a fingerprint for the subset of the plurality of packets, the fingerprint being indicative of whether the plurality of data packets are associated with an external malware communication.
1 . A network device comprising:
a driver configured to capture a plurality of data packets received at the network device; and
an on-device malware detection engine configured to:
receive at least a subset of the plurality of packets, and
generate a fingerprint for the subset of the plurality of packets, the fingerprint being indicative of whether the plurality of data packets are associated with an external malware communication, wherein
the network device is a user device that is communicatively coupled to one or more cloud-based services and devices in a network, and
the fingerprint is generated before the plurality of packets reach the one or more cloud-based services and devices in the network.
2 . The network device of claim 1 , wherein the on-device malware detection engine is configured to generate the fingerprint inline with reception and processing of the plurality of packets at the network device.
3 . The network device of claim 1 , further comprising:
a firewall agent on the network device configured to determine whether to drop the plurality of packets or permit the plurality of packets to pass through, based on the fingerprint.
4 . The network device of claim 1 , wherein the on-device malware detection engine is configured to generate the fingerprint using a malware detection database.
5 . The network device of claim 4 , wherein the malware detection database is generated using a machine learning engine.
6 . The network device of claim 5 , wherein the machine learning engine is cloud-based and is trained using metadata of previously examined data packets for which the on-device malware detection engine has generated fingerprints.
7 . The network device of claim 1 , further comprising:
a connection agent configured to provide secure network access to the network device, and
the driver and the on-device malware detection engine are software modules within the connection agent.
8 . The network device of claim 7 , wherein the network device is an endpoint terminal connected to a network using the connection agent.
9 . One or more non-transitory computer-readable media comprising computer-readable instructions, which when executed by one or more processors of a network device, cause the network device to:
capture a plurality of data packets received at the network device;
receive at least a subset of the plurality of packets, and
generate a fingerprint for the subset of the plurality of packets, the fingerprint being indicative of whether the plurality of data packets are associated with an external malware communication, wherein
the network device is a user device that is communicatively coupled to one or more cloud-based services and devices in a network, and
the fingerprint is generated before the plurality of packets reach the one or more cloud-based services and devices in the network.
10 . The one or more non-transitory computer-readable media of claim 9 , wherein the network device includes an on-device malware detection engine configured to generate the fingerprint inline with reception and processing of the plurality of packets at the network device.
11 . The one or more non-transitory computer-readable media of claim 9 , wherein the execution of the computer-readable instructions further cause the network device to determine whether to drop the plurality of packets or permit the plurality of packets to pass through, based on the fingerprint.
12 . The one or more non-transitory computer-readable media of claim 9 , wherein the fingerprint is generated using a malware detection database.
13 . The one or more non-transitory computer-readable media of claim 12 , wherein the malware detection database is generated using a machine learning engine.
14 . The one or more non-transitory computer-readable media of claim 13 , wherein the machine learning engine is cloud-based and is trained using metadata of previously examined data packets for which the on-device malware detection engine has generated fingerprints.
15 . The one or more non-transitory computer-readable media of claim 9 , wherein the network device comprises:
a connection agent configured to provide secure network access to the network device, and
a driver and an on-device malware detection engine as software modules within the connection agent to capture the plurality of data packets and generate the fingerprint.
16 . A method for on-device inspection of network traffic, the method comprising:
capturing a plurality of data packets received at a network device;
using an on-device malware detection engine,
processing a subset of the plurality of packets, and
generating a fingerprint for the subset of the plurality of packets, the fingerprint being indicative of whether the plurality of data packets are associated with an external malware communication, wherein
the network device is a user device that is communicatively coupled to one or more cloud-based services and devices in a network, and
the fingerprint is generated before the plurality of packets reach the one or more cloud-based services and devices in the network.
17 . The method of claim 16 , further comprising:
determining whether to drop the plurality of packets or permit the plurality of packets to pass through, based on the fingerprint.
18 . The method of claim 16 , wherein the on-device malware detection engine generates the fingerprint using a malware detection database.
19 . The method of claim 18 , wherein the malware detection database is generated using a machine learning engine.
20 . The method of claim 19 , wherein the machine learning engine is cloud-based and is trained using metadata of previously examined data packets for which the on-device malware detection engine has generated fingerprints.