IDENTIFICATION OF MALWARE SITES USING UNKNOWN URL SITES AND NEWLY REGISTERED DNS ADDRESSES

• US 20150195291A1
• Filed: 01/13/2015
• Published: 07/09/2015
• Est. Priority Date: 05/24/2011
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: Zuk, Nir, Lazzarato, Renzo, Xie, Huagang
• Granted Patent: US 9,473,528 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

In some embodiments, identification of malware sites using unknown URL sites and newly registered DNS addresses includes performing a heuristic analysis for information associated with a network site; and assigning a score based on the heuristic analysis, in which the score indicates whether the network site is potentially malicious. In some embodiments, the system includes a security appliance that is in communication with the Internet. In some embodiments, the network site is associated with a network domain and/or a network uniform resource locator (URL). In some embodiments, performing a heuristic analysis for information associated with a network site further includes determining if a network site has recently been registered. In some embodiments, performing a heuristic analysis for information associated with a network site further includes determining if a network site is associated with recently changed DNS information. In some embodiments, performing a heuristic analysis for information associated with a network site further includes determining geographical information as well as an IP network location associated with the network site.

Claims

1. (canceled)

2. A system, comprising:

a processor configured to;

perform a heuristic analysis for information associated with a network site, wherein performing the heuristic analysis for information associated with the network site further comprises;

determine whether the network site has a change in domain name system (DNS) information, the change in DNS information including a change in domain name, a change in ownership of a network uniform resource locator (URL), a new IP address outside of the same subnet, or any combination thereof;

in the event that the DNS information of the network site has changed, determine when the change in the DNS information occurred;

determine whether an IP address related to the network site is periodically unavailable based on DNS presence information; and

determine source information associated with the network site, wherein the source information includes geographical information associated with the network site and IP network related source information, wherein the determining of the source information is based on a regional Internet registry (RIR), a border gateway protocol (BGP) table, or any combination thereof; and

assign a score based on the heuristic analysis, wherein the score indicates whether the network site is potentially malicious; and

a memory coupled to the processor and configured to provide the processor with instructions.

3. The system recited in claim 2, wherein the system includes a security appliance that is in communication with the Internet, and wherein the network site is associated with a network domain and/or the URL.

4. The system recited in claim 2, wherein the system includes a security cloud service that is in communication with the Internet, and wherein the network site is associated with a network domain and/or the URL.

5. The system recited in claim 2, wherein performing the heuristic analysis for information associated with the network site further comprises:

determine if the network site has recently been registered.

6. The system recited in claim 2, wherein assigning the score based on the heuristic analysis further comprises:

compare the score with a predefined threshold; and

in the event that the score exceeds the predefined threshold, determine that the network site is potentially malicious.

7. The system recited in claim 2, wherein performing the heuristic analysis for information associated with the network site further comprises:

perform an analysis of links between pages of the same network site to measure navigability of the network site;

perform an analysis of links to and from other network sites to identify links to and from suspicious network sites;

perform an analysis of an amount of plain text, script, hypertext markup language (HTML) content, and/or uniform resource locator (URL) suitable for human navigation of the network site;

or perform any combination thereof.

8. The system recited in claim 2, wherein performing the heuristic analysis for information associated with the network site further comprises:

in the event that the DNS information of the network site has changed, determine when the change in the DNS information occurred.

9. The system recited in claim 2, wherein performing the heuristic analysis for information associated with the network site further comprises:

determine whether an IP address related to the network site is periodically unavailable based on DNS presence information.

10. The system recited in claim 2, wherein determining source information associated with the network site further comprises:

determine the source information based on a regional Internet registry (RIR), a border gateway protocol (BGP) table, or any combination thereof.

11. The system recited in claim 2, wherein performing the heuristic analysis for information associated with the network site further comprises:

determine if the network site has recently been registered; and

assign the score based on the length of time since a domain registration, whether the DNS information of the network site has changed, and the source information associated with the network site.

12. The system recited in claim 2, wherein the processor is further configured to:

determine a plurality of network sites that have recently been registered; and

generate a list of potentially malicious network sites based on the plurality of network sites that have recently been registered, whether the DNS information of the network site has changed, and the source information associated with the network site.

13. The system recited in claim 2, wherein the processor is further configured to:

generate a list of DNS changes for a plurality of network sites; and

store the list of DNS changes.

14. The system recited in claim 2, wherein the score indicates that the network site is potentially malicious, wherein the system includes a security cloud service that is in communication with the Internet, wherein the network site is associated with a network domain and/or the URL, and wherein the processor is further configured to:

publish the network site to a security appliance for blocking access to/from the network site.

15. The system recited in claim 2, wherein the score indicates that the network site is potentially malicious, wherein the system includes a security appliance that is in communication with the Internet, wherein the network site is associated with a network domain and/or the URL, and wherein the processor is further configured to:

block access to/from the network site.

16. The system recited in claim 2, wherein the score indicates that the network site is potentially malicious, wherein the system includes a security appliance that is in communication with the Internet, wherein the network site is associated with a network domain and/or the URL, and wherein the processor is further configured to:

monitor access to/from the network site to determine whether the network site is a botnet site.

17. The system recited in claim 2, wherein the score indicates that the network site is potentially malicious, wherein the system includes a security appliance that is in communication with the Internet, wherein the network site is associated with a network domain and/or the URL, and wherein the processor is further configured to:

apply a security policy based on the determination that the network site is potentially malicious; and

report that the network site is a potential malware site.

18. The system recited in claim 2, wherein the score indicates that the network site is potentially malicious, wherein the system includes a security cloud service that is in communication with the Internet, wherein the network site is associated with a network domain and/or the URL, and wherein the processor is further configured to:

determine that the network site is a malware site if a virus sample attempts to connect to the network site.

19. The system recited in claim 2, wherein the system includes a security cloud service that is in communication with the Internet, and wherein the processor is further configured to:

receive a plurality of network sites from one or more security appliances that are each associated with a subscription to the security cloud service, wherein the security cloud service performs the heuristic analysis for information associated with each of the network sites to identify which, if any, of the network sites is potentially malicious.

20. The system recited in claim 2, wherein the system includes a security cloud service that is in communication with the Internet, and wherein the processor is further configured to:

receive a plurality of botnet reports; and

aggregate the plurality of botnet reports to correlate potentially suspicious botnet behavior to determine whether the network site is potentially malicious.

21. A method, comprising:

performing a heuristic analysis for information associated with a network site using a processor of a device in communication with a network, wherein performing the heuristic analysis for information associated with the network site further comprises;

determining whether the network site has a change in domain name system (DNS) information, the change in DNS information including a change in domain name, a change in ownership of a network uniform resource locator (URL), a new IP address outside of the same subnet, or any combination thereof; and

determining source information associated with the network site, wherein the source information includes geographical information associated with the network site and IP network related source information; and

assigning a score based on the heuristic analysis, wherein the score indicates whether the network site is potentially malicious.