Methods and systems for detecting compromised computers

• US 10,044,748 B2
• Filed: 02/09/2016
• Issued: 08/07/2018
• Est. Priority Date: 10/27/2005
• Status: Active Grant

• Current Assignee: Ecrime Management Strategies, Inc.
• Original Assignee: Georgia Institute of Technology (University System of Georgia), Georgia Tech Research Corporation (University System of Georgia)
• Inventors: Dagon, David, Feamster, Nick, Lee, Wenke, Edmonds, Robert, Lipton, Richard, Ramachandran, Anirudh
• Primary Examiner(s): Lee, Jason T
• Application Number:
  US15/019,272
• Publication Number:
  US 20160156660A1
• Time in Patent Office: 910 Days
• Field of Search: 726 22, 726 23
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A system and method for detecting a first network of compromised computers in a second network of computers, comprising: collecting Domain Name System (DNS) data for the second network; examining the collected data relative to DNS data from known comprised and/or uncompromised computers in the second network; and determining the existence of the first network and/or the identity of compromised computers in the second network based on the examination.

Claims

1. A method of detecting and remediating a network of compromised computers, comprising:

collecting, using a hardware processor, Domain Name System (DNS) data for a domain;

examining, using the hardware processor, the collected data to determine whether third level domain requests exceed second level domain requests for the domain; and

responsive to determining that the third level domain requests exceed the second level domain requests for the domain, determining that the domain is associated with a command and control computer for a botnet.

2. The method of claim 1, wherein the DNS data comprises DNS queries.

3. The method of claim 1, further comprising:

observing time zone and time of release information for the collected data.

4. The method of claim 1, wherein determining that the domain is associated with a command and control computer comprises determining a canonical SLD request rate;

and

determining if the determined canonical SLD request rate against deviates from a known mean.

5. The method of claim 1, further comprising, identifying, using the hardware processor, the internet protocol (IP) address of the command and control computer;

and

assigning, using the hardware processor, a sinkhole device to the IP address of the command and control computer.

6. The method of claim 5, wherein the sinkhole device captures network traffic from one or more infected bot computers.

7. The method of claim 6, further comprising analyzing, using the hardware processor, the network traffic from the one or more infected bot computers.

8. The method of claim 7, wherein the network traffic comprises at least one of information about attaching networks, victim information, operating system type, software installed, and patch level of installed software.

9. The method of claim 7, further comprising sharing, using the hardware processor, the analyzed network traffic from the one or more infected bot computers with a third party system.

10. The method of claim 7, further comprising requesting, using the hardware processor, that the domain associated with the command and control computer be revoked.

11. The method of claim 6, further comprising:

determining, based on the analyzed network traffic, an amount of synchronous requests from the one or more infected bots computers; and

generating, based the amount of synchronous requests, a diurnal model for at least one time zone.

12. The method of claim 11, wherein the diurnal model for at least one time zone comprises a diurnal model for a plurality of time zones, and

further comprising:

ranking the diurnal models for a plurality of time zones based on at least one of priority and patch management.

13. The method of claim 12, further comprising predicting, based on the ranking of the diurnal models, a short term growth of the botnet.

14. The method of claim 6, further comprising responding, using a tarpit device, to at least one of the one or more infected bot computers synchronous requests with at least one of a reset command, a blackholed response, a single acknowledgement, a plurality of acknowledgements, and a command to connect to another tarpit.

15. The method of claim 14, wherein the tarpit device is at least one of a network player tarpit, routing layer, and an application layer tarpit.

16. The method of claim 1, wherein examining the collected data further comprises:

analyzing one or more non-recursive DNS queries stored in a DNS cache.

17. The method of claim 16, wherein the non-recursive DNS queries have a time-to-live value.

18. An information handling device for detecting and remediating a network of compromised computers, comprising:

at least one hardware processor; and

a computer readable storage device having computer readable program code embodied therewith and executable by the at least one hardware processor, the computer readable program code comprising;

computer readable program code that collects Domain Name System (DNS) data for a domain;

computer readable program code that examines the collected data to determine whether third level domain requests exceed second level domain requests for the domain; and

responsive to determining that the third level domain requests exceed the second level domain requests for the domain, computer readable program code that determines that the domain is associated with a command and control computer for a botnet.

19. A method of detecting and remediating a network of compromised computers, comprising:

collecting, using a hardware processor, Domain Name System (DNS) data for a domain;

examining, using the hardware processor, the collected data to determine whether third level domain exceed of second level domain requests for the domain; and

determining, based on the examining, that the domain is associated with a command and control computer for a botnet, wherein determining that the domain is associated with a command and control computer comprises determining a canonical SLD request rate.