METHODS AND SYSTEMS FOR NETWORK FLOW ANALYSIS

• US 20140059216A1
• Filed: 08/26/2013
• Published: 02/27/2014
• Est. Priority Date: 08/27/2012
• Status: Active Grant

• Current Assignee: Ecrime Management Strategies, Inc.
• Original Assignee: Damballa Incorporated
• Inventors: JERRIM, JOHN
• Granted Patent: US 10,547,674 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks

Abstract

A system and method comprising: receiving network flow data; identifying a peer to peer network flow within the network flow data comparing the peer to peer network flow to a known peer to peer application flow; labeling the peer to peer network flow as the known peer to peer application flow when the peer to peer network flow matches the known peer to peer application flow; and creating a data set to be associated with the labeled peer to flow.

Claims

1. A method comprising:

performing processing associated with receiving, with a flow creation module in communication with a computer comprising a database, network flow data;

performing processing associated with identifying, with a peer to peer flow detection module in communication with the computer, a peer to peer network flow within the network flow data;

performing processing associated with comparing, with a peer to peer classification module in communication with the computer, the peer to peer network flow to a known peer to peer application flow;

performing processing associated with labeling, with the peer to peer classification module, the peer to peer network flow as the known peer to peer application flow when the peer to peer network flow matches the known peer to peer application flow;

performing processing associated with creating a data set to he associated with the labeled peer to peer flow.

2. The method of claim 1, further comprising:

performing processing associated with determining, with a classification module in communication with the computer, whether the peer to peer network flow resembles a stored unclassified peer to peer application flow when the peer to peer network flow does not match the known peer to peer application flow.

3. The method of claim 2, further comprising:

performing processing associated with labeling, with the classification module, the peer to peer network flow as an unclassified peer to peer application flow when the peer to peer network flow does not resemble the stored unclassified peer to peer application flow.

4. The method of claim 3, further comprising:

performing processing associated with clustering, with an unclassified peer to peer clustering module in communication with the computer, the peer to peer network flow with the unclassified stored peer to peer application flows when the peer to peer network flow resembles the stored unclassified peer to peer application flow, the clustering forming a peer to peer application cluster.

5. The method of claim 4, further comprising:

performing processing associated with receiving, with a peer to peer identifier assignment module in communication with the computer, a label for the peer to peer application cluster, the label defining the peer to peer application cluster as a known peer to peer application flow.

6. The method of claim 1, wherein the performing processing associated with receiving the network flow data comprises creating the network flow data from packet information.

7. The method of claim 1, wherein the network flow data is received from a router.

8. The method of claim 1, wherein the performing processing associated with identifying the peer to peer network flow within the network flow data comprises comparing the network flow data to a white-listed known peer to peer application flow and ignoring the network flow data when it matches the white-listed known peer to peer application flow.

9. The method of claim 1, further comprising:

performing processing associated with examining the network flow data to determine whether a recent DNS lookup has been performed in relation to a remote computer associated with the peer to peer network flow and/or whether the peer to peer network flow is associated with a high activity domain; and

performing processing associated with ignoring the peer to peer network flow when it the a recent DNS lookup has been performed and/or when the peer to peer network flow is associated with the high activity domain.

10. The method of claim 1, wherein the performing processing associated with comparing the peer to peer network flow to a known peer to peer application flow comprises:

iteratively analyzing the peer to peer network flow over a plurality of epochs; and

comparing a characteristic of the peer to peer network flow observed during one of the plurality of epochs to a characteristic of the known peer to peer application flow;

wherein each of the plurality of epochs is a different length of time from each of the remaining plurality of epochs.

11. The method of claim 10, further comprising performing processing associated with ignoring, the peer to peer network flow when it is older than a longest of the plurality of epochs.

12. The method of claim 1, wherein the peer to peer network flow comprises a merged first peer to peer network flow and a second peer to peer network flow related to the first peer to peer network flow.

13. The method of claim 12, wherein a P2P faux-session creation module is used to merge the first peer to peer network flow and the second peer to peer network flow.

14. The method of claim 1, wherein the performing processing associated with comparing the peer to peer network flow to a known peer to peer application flow comprises generating a feature of the peer to peer network flow, the feature comprising:

a payload out, a payload in, a packet out, a packet in, a transmission control protocol (TCP) flag, a user datagram protocol (UDP) flag, an interne control message protocol (ICMP) flag, a high port—

high port flag, a high port—

low port flag, a low port—

low port flag, an internal TCP control port flag, an external TCP control port flag, an internal UDP control port flag, an external UDP control port flag, an average packet exchange rate, average active flows, maximum active simultaneous flows, maximum external hosts, total flows, a session duration, an average flow duration, maximum simultaneous data transfers, a one to one transfers flag, a many to one transfers flag, a percent of one to one transfers to total transfers, a number of persistent flows, a percent of persistent flows, a percent of one-way flows, a percent of low traffic flows, a percent of medium traffic flows, a percent of high traffic flows, a possible voice flag, a possible Internet radio flag, a possible audio share flag, a possible video share flag, a geographic dispersion, an NXDOMAIN response, or any combination thereof.

15. The method of claim 1, wherein the performing processing associated with comparing the peer to peer network flow to the known peer to peer application flow comprises:

examining a host involved with the peer to peer network flow to determine how the host has participated in a previous peer to peer application flow;

determining whether the peer to peer network flow is associated with a private network, a public network, and/or a public/private network; and

/or

biasing the comparison of the peer to peer network flow to the previous peer to peer application flow when the previous peer to peer application flow resembles the peer to peer network flow.

16. The method of claim 1, wherein the performing processing associated with receiving the label for the peer to peer application cluster comprises generating the label.

17. The method of claim 1, wherein the performing processing associated with receiving the label for the peer to peer application cluster comprises receiving the label from a user input.

18. The method of claim 1, further comprising performing processing associated with generating, with an alert module in communication with the computer, an alert when the label defines the peer to peer application cluster as malware.

19. The method of claim 14, farther comprising performing processing associated with displaying, with a display, the alert.