IDENTIFYING MALICIOUS WEB INFRASTRUCTURES

• US 20160261608A1
• Filed: 06/18/2015
• Published: 09/08/2016
• Est. Priority Date: 03/06/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hu, Xin, Jang, Jiyong, Wang, Ting, Zhang, Jialong
• Granted Patent: US 9,578,042 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Identifying malicious servers is provided. Malicious edges between server vertices corresponding to visible servers and invisible servers involved in network traffic redirection chains are determined based on determined graph-based features within a bipartite graph corresponding to invisible server vertices involved in the network traffic redirection chains and determined distance-based features corresponding to the invisible server vertices involved in the network traffic redirection chains. Malicious server vertices are identified in the bipartite graph based on the determined malicious edges between the server vertices corresponding to the visible servers and invisible servers involved in the network traffic redirection chains. Access by client devices is blocked to malicious servers corresponding to the identified malicious server vertices in the bipartite graph.

Claims

1. A computer-implemented method for identifying malicious servers, the computer-implemented method comprising:

determining, by a computer, malicious edges between server vertices corresponding to visible servers and invisible servers involved in network traffic redirection chains based on determined graph-based features within a bipartite graph corresponding to visible and invisible server vertices involved in the network traffic redirection chains and determined distance-based features corresponding to the invisible server vertices involved in the network traffic redirection chains;

identifying, by the computer, malicious server vertices in the bipartite graph based on the determined malicious edges between the server vertices corresponding to the visible servers and invisible servers involved in the network traffic redirection chains; and

blocking, by the computer, access by client devices to malicious servers corresponding to the identified malicious server vertices in the bipartite graph.

2. The computer-implemented method of claim 1 further comprising:

placing, by the computer, each server in a plurality of identified servers within a network in the bipartite graph based on locating each server in one of a visible server list or an invisible server list.

3. The computer-implemented method of claim 2, wherein the placing, by the computer, each server in the plurality of identified servers within the network in the bipartite graph further comprises:

searching, by the computer, a set of server domain name white lists to determine whether a server in the plurality of identified servers within the network is listed in a set of server domain name white lists;

querying, by the computer, a set of search engines to determine whether the server in the plurality of identified servers within the network is listed in a server domain name search result;

responsive to the computer determining that the server in the plurality of identified servers within the network is not listed in the set of server domain name white lists and not listed in the server domain name search result, identifying, by the computer, the server as an invisible server and adding, by the computer, the server to the invisible server list; and

responsive to the computer determining that the server in the plurality of identified servers within the network is listed in at least one of the set of server domain name white lists and the server domain name search result, identifying, by the computer, the server in the plurality of identified servers as a visible server and adding, by the computer, the server to the visible server list.

4. The computer-implemented method of claim 1 further comprising:

inputting, by the computer, the determined graph-based features within the bipartite graph corresponding to the invisible server vertices involved in the network traffic redirection chains and the determined distance-based features corresponding to the invisible server vertices involved in the network traffic redirection chains into a machine learning classifier.

5. The computer-implemented method of claim 4, wherein the determined graph-based features are out-degree, in-degree, and a ratio between out-degree and in-degree for each invisible server involved in a network traffic redirection chain.

6. The computer-implemented method of claim 4, wherein the determined distance-based features are distance between IP address numbers of each of the invisible servers, difference in domain name registration information between each of the invisible servers, and distance in physical location between each of the invisible servers.

7. The computer-implemented method of claim 1 further comprising:

assigning, by the computer, a malicious score to those invisible servers identified as malicious.

8. The computer-implemented method of claim 7 further comprising:

generating, by the computer, a visibility score for those invisible servers identified as malicious.

9. The computer-implemented method of claim 8 further comprising:

adding, by the computer, the assigned malicious score and the generated visibility score to corresponding server vertices within a server network traffic propagation chain graph; and

propagating, by the computer, the assigned malicious score and the generated visibility score of a corresponding server vertex to neighboring invisible server vertices within the server network traffic propagation chain graph.

10. The computer-implemented method of claim 9 further comprising:

generating, by the computer, a new malicious score and a new visibility score for each of the neighboring server vertices within the server network traffic propagation chain graph based on the propagating of malicious and visibility scores; and

identifying, by the computer, each server corresponding to a server vertex within the propagation graph having the generated new malicious score greater than a predefined malicious score threshold value and having the generated new visibility score less than a predefined visibility score threshold value as a malicious server.