AUTOMATION DISCOVERY TO IDENTIFY MALICIOUS ACTIVITY

• US 20140075558A1
• Filed: 08/30/2013
• Published: 03/13/2014
• Est. Priority Date: 08/31/2012
• Status: Active Grant

• Current Assignee: Ecrime Management Strategies, Inc.
• Original Assignee: Damballa Incorporated
• Inventors: WARD, JOSEPH, HOBSON, ANDREW
• Granted Patent: US 9,166,994 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Systems and methods may use automation discovery to identify malicious activity. An automation discovery system comprising a processor in communication with a network and in communication with a database may receive potentially automated network traffic data. The system may analyze the potentially automated network traffic data to determine whether the potentially automated network traffic data is likely to be automated. When the potentially automated network traffic data is not likely to be automated, the system may generate a low automation confidence score associated with the potentially automated network traffic data. When the potentially automated network traffic data is likely to be automated, the system may generate a high automation confidence score associated with the potentially automated network traffic data.

Claims

1. A method comprising:

receiving, with an automation discovery system comprising a processor in communication with a network, potentially automated network traffic data;

analyzing, with the automation discovery system, the potentially automated network traffic data to determine whether the potentially automated network traffic data is likely to be automated;

when the potentially automated network traffic data is not likely to be automated, generating, with the automation discovery system, a low automation confidence score associated with the potentially automated network traffic data; and

when the potentially automated network traffic data is likely to be automated, generating, with the automation discovery system, a high automation confidence score associated with the potentially automated network traffic data, the high automation confidence score being higher than the low automation confidence score.

2. The method of claim 1, wherein:

the potentially automated network traffic data comprises data associated with a plurality of network communications; and

analyzing the potentially automated network traffic data comprises determining that a time delta between each of at least two sets of at least two of the plurality of network communications is indicative of non-human activity.

3. The method of claim 2, wherein determining that the time delta between each of at least two sets of at least two of the plurality of network communications is indicative of non-human activity comprises performing a statistical analysis to determine whether each time delta is similar to each other time delta.

4. The method of claim 3, wherein analyzing the potentially automated network traffic data further comprises:

determining that the potentially automated network traffic data is likely to be automated when each time delta is similar to each other time delta; and

determining that the potentially automated network traffic data is not likely to be automated when each time delta is not similar to each other time delta.

5. The method of claim 1, further comprising:

sending, with the automation discovery system, the low automation confidence score or the high automation confidence score to a display in communication with the automation discovery system.

6. The method of claim 1, wherein receiving, with the automation discovery system, potentially automated network traffic data comprises:

monitoring observed network traffic;

identifying observed network traffic with a known malicious source and/or destination or a low reputation source and/or destination; and

collecting the identified observed network traffic as the potentially automated network traffic data.

7. The method of claim 1, wherein the potentially automated network traffic data comprises metadata associated with suspicious network traffic.

8. The method of claim 7, further comprising:

monitoring, with a monitoring system comprising a processor in communication with the network, network traffic to and/or from an asset associated with the network;

assessing, with the monitoring system, the network traffic to determine a source and/or destination for the network traffic and/or content of the network traffic;

determining, with the monitoring system, whether the network traffic is suspicious network traffic based on the assessed source and/or destination and/or content;

when the network traffic is determined to be suspicious network traffic, capturing, with the monitoring system, metadata associated with the suspicious network traffic and storing the metadata in a database in communication with the processor; and

when the network traffic is not determined to be suspicious network traffic, disregarding, with the monitoring system, metadata associated with the network traffic.

9. The method of claim 8, wherein the monitoring comprises monitoring a transport protocol of the network traffic, monitoring an application protocol of the network traffic, monitoring a source and/or destination of the network traffic, and/or monitoring content of the network traffic.

10. The method of claim 8, wherein the determining whether the network traffic is suspicious network traffic is based on a low reputation score associated with the source and/or destination for the network traffic, a suspicious DGA cluster associated with the source and/or destination for the network traffic, a suspicious DGA cluster associated with the content of the network traffic, and/or a suspicious content element within the content of the network traffic.

11. The method of claim 8, further comprising:

when the network traffic is determined to be suspicious network traffic, indexing, with the monitoring system, the metadata.

12. The method of claim 8, wherein the metadata comprises a source port, a destination port, a transport protocol, an application protocol, a time stamp, a duration, a source identifier, a destination identifier, a bytes in count, a bytes out count, a connection success indicator, a connection status, a DNS RR set, HTTP data, a file within the content of the network traffic, the content of the network traffic, and/or a subsequent communication.

13. The method of claim 8, further comprising:

when the network traffic is determined to be suspicious network traffic, sending, with the monitoring system, a report indicating that the network traffic is determined to be suspicious network traffic to a display in communication with the monitoring system.

14. The method of claim 8, wherein determining whether the network traffic is suspicious network traffic comprises determining that all traffic to and/or from the asset is suspicious network traffic when the asset is an asset with a potential malware infection.

15. A system comprising:

a database; and

an automation discovery system comprising a processor in communication with a network and in communication with the database, the automation discovery system being constructed and arranged to;

receive potentially automated network traffic data;

analyze the potentially automated network traffic data to determine whether the potentially automated network traffic data is likely to be automated;

when the potentially automated network traffic data is not likely to be automated, generate a low automation confidence score associated with the potentially automated network traffic data; and

when the potentially automated network traffic data is likely to be automated, generate a high automation confidence score associated with the potentially automated network traffic data, the high automation confidence score being higher than the low automation confidence score.

16. The system of claim 15, wherein:

the potentially automated network traffic data comprises data associated with a plurality of network communications; and

the automation discovery system is constructed and arranged to analyze the potentially automated network traffic data by determining that a time delta between each of at least two sets of at least two of the plurality of network communications is indicative of non-human activity.

17. The system of claim 16, wherein the automation discovery system is constructed and arranged to determine that the time delta between each of at least two sets of at least two of the plurality of network communications is indicative of non-human activity with a method comprising performing a statistical analysis to determine whether each time delta is similar to each other time delta.

18. The system of claim 16, wherein the automation discovery system is further constructed and arranged to analyze the potentially automated network traffic data by:

determining that the potentially automated network traffic data is likely to be automated when each time delta is similar to each other time delta; and

determining that the potentially automated network traffic data is not likely to be automated when each time delta is not similar to each other time delta.

19. The system of claim 15, wherein the automation discovery system is further constructed and arranged to send the low automation confidence score or the high automation confidence score to a display in communication with the automation discovery system.

20. The system of claim 15, wherein the automation discovery system is constructed and arranged to receive the potentially automated network traffic data by:

monitoring observed network traffic;

identifying observed network traffic with a known malicious source and/or destination or a low reputation source and/or destination; and

collecting the identified observed network traffic as the potentially automated network traffic data.

21. The system of claim 15, wherein the potentially automated network traffic data comprises metadata associated with suspicious network traffic.

22. The system of claim 21, further comprising:

a monitoring system comprising a processor in communication with the network and in communication with the database, the monitoring system being constructed and arranged to;

monitor network traffic to and/or from an asset associated with the network;

assess the network traffic to determine a source and/or destination for the network traffic and/or content of the network traffic;

determine whether the network traffic is suspicious network traffic based on the assessed source and/or destination and/or content;

when the network traffic is determined to be suspicious network traffic, capture metadata associated with the suspicious network traffic and store the metadata in the database; and

when the network traffic is not determined to be suspicious network traffic, disregard metadata associated with the network traffic.

23. The system of claim 22, wherein the monitoring comprises monitoring a transport protocol of the network traffic, monitoring an application protocol of the network traffic, monitoring a source and/or destination of the network traffic, and/or monitoring content of the network traffic.

24. The system of claim 22, wherein the determining whether the network traffic is suspicious network traffic is based on a low reputation score associated with the source and/or destination for the network traffic, a suspicious DGA cluster associated with the source and/or destination for the network traffic, a suspicious DGA cluster associated with the content of the network traffic, and/or a suspicious content element within the content of the network traffic.

25. The system of claim 22, wherein the monitoring system is further constructed and arranged to:

when the network traffic is determined to be suspicious network traffic, index the metadata.

26. The system of claim 22, wherein the metadata comprises a source port, a destination port, a transport protocol, an application protocol, a time stamp, a duration, a source identifier, a destination identifier, a bytes in count, a bytes out count, a connection success indicator, a connection status, a DNS RR set, HTTP data, a file within the content of the network traffic, the content of the network traffic, and/or a subsequent communication.

27. The system of claim 22, wherein the monitoring system is further constructed and arranged to:

when the network traffic is determined to be suspicious network traffic, send a report indicating that the network traffic is determined to be suspicious network traffic to a display in communication with the monitoring system.

28. The system of claim 22, wherein the monitoring system is constructed and arranged to determine whether the network traffic is suspicious network traffic with a method comprising determining that all traffic to and/or from the asset is suspicious network traffic when the asset is an asset with a potential malware infection.