Heuristic based capture with replay to virtual machine

• US 8,171,553 B2
• Filed: 04/20/2006
• Issued: 05/01/2012
• Est. Priority Date: 04/01/2004
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: FireEye, Inc. (Alphabet Inc.)
• Inventors: Aziz, Ashar, Drzewiecki, Adrian, Radhakrishnan, Ramesh, Manni, Jayaraman, Amin, Muhammad
• Primary Examiner(s): Davis, Zachary A
• Application Number:
  US11/409,355
• Publication Number:
  US 20080005782A1
• Time in Patent Office: 2,203 Days
• Field of Search: 713/182, 713/188, 713/187, 726 22- 25
• US Class Current: 726/24
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/45537 Provision of facilities of other operating environments, e.g. WINE I/O emulation G06F13/105
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1491 : using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A suspicious activity capture system can comprise a tap configured to copy network data from a communication network, and a controller. The controller is coupled to the tap and is configured to receive the copy of the network data from the tap, analyze the copy of the network data with a heuristic to flag the network data as suspicious, and simulate transmission of the network data to a destination device.

Claims

1. An unauthorized activity capture system comprising:

a tap configured to copy network data from a communication network; and

a controller coupled to the tap and configured to receive the copy of the network data from the tap, analyze the copy of the network data with a heuristic to determine if the copy of the network data has one or more characteristics of a computer worm, flag at least a portion of the copy of the network data as suspicious by flagging the at least a portion of the copy of the network data for replay in an analysis environment based upon the heuristic determination that the at least a portion of the analyzed copy of the network data has one or more characteristics of a computer worm, and replay transmission of the suspicious, flagged network data copied from the communication network to a destination device.

2. The unauthorized activity capture system of claim 1 wherein the heuristic is configured to detect unknown source devices.

3. The unauthorized activity capture system of claim 1 wherein the heuristic is configured to detect the network data sent to an unassigned internet protocol address.

4. The unauthorized activity capture system of claim 1 wherein the heuristic is configured to detect the network data sent to an unassigned port address.

5. The unauthorized activity capture system of claim 1 wherein the controller further comprises a policy engine configured to flag the at least a portion of the analyzed copy of the network data as suspicious based on comparing the at least a portion of the analyzed copy of the network data to policies.

6. The unauthorized activity capture system of claim 1 wherein the controller further comprises a virtual machine pool configured to store a virtual machine.

7. The unauthorized activity capture system of claim 1 wherein the one or more characteristics of a computer worm include being configured to duplicate itself for propagation.

8. An unauthorized activity capture system comprising:

a tap configured to copy network data from a communication network; and

a controller configured to receive the copy of the network data from the tap, analyze the copy of the network data with a heuristic to determine if the network data has one or more characteristics of a computer worm, flag at least a portion of the copy of the network data as suspicious by flagging the at least a portion of the copy of the network data for replay in an analysis environment based upon the heuristic determination that the at least a portion of the analyzed copy of the network data has one or more characteristics of a computer worm, retrieve a virtual machine, configure a replayer to replicate the at least a portion of the analyzed copy of the network data which contains suspicious activity to the virtual machine, and identify unauthorized activity by analyzing a behavior of the virtual machine in response to the replication of the at least a portion of the analyzed copy of the network data.

9. The unauthorized activity capture system of claim 8 wherein the heuristic is configured to detect unknown source devices.

10. The unauthorized activity capture system of claim 8 wherein the heuristic is configured to detect the network data sent to an unassigned internet protocol address.

11. The unauthorized activity capture system of claim 8 wherein the heuristic is configured to detect the network data sent to a previously unused port address.

12. The unauthorized activity capture system of claim 8 wherein the unauthorized activity is the result of malware associated with the network data.

13. The unauthorized activity capture system of claim 8 wherein the unauthorized activity is the result of a hacker associated with the network data.

14. The unauthorized activity capture system of claim 8 wherein the controller further comprises a virtual machine pool configured to store the virtual machine.

15. The unauthorized activity capture system of claim 8 wherein the at least a portion of the analyzed copy of network data is replicated between the replayer and the virtual machine over a virtual switch.

16. The unauthorized activity capture system of claim 8 wherein the one or more characteristics of a computer worm include being configured to duplicate itself for propagation.

17. An unauthorized activity capture method comprising:

copying network data from a communication network;

analyzing the copied network data with a heuristic to determine if the copied network data has one or more characteristics of a computer worm;

flagging at least a portion of the analyzed copied network data as suspicious by flagging the at least a portion of the copy of the network data for replay in an analysis environment based upon the heuristic determination that the at least a portion of the analyzed copied network data has one or more characteristics of a computer worm; and

replaying transmission of the flagged at least a portion of the analyzed copied network data which was copied from the communication network to a destination device to identify unauthorized activity based on playback of the flagged suspicious at least a portion of the analyzed copy of the network data.

18. The method of claim 17 wherein replaying the transmission of the flagged at least a portion of the analyzed copied network data comprises:

retrieving a virtual machine configured to receive the flagged at least a portion of the analyzed copied network data;

configuring a replayer to transmit the flagged at least a portion of the analyzed copied network data to the virtual machine; and

performing a simulation by transmitting the previously flagged at least a portion of the analyzed copied network data to the virtual machine.

19. The method of claim 18 wherein retrieving the virtual machine includes accessing a virtual machine pool.

20. The method of claim 18 wherein the flagged at least a portion of the analyzed copied network data is transmitted between the replayer and the virtual machine over a virtual switch.

21. The method of claim 17 wherein the heuristic is configured to detect unknown source devices.

22. The method of claim 17 wherein the heuristic is configured to detect the network data sent to an unassigned internet protocol address.

23. The method of claim 17 wherein the heuristic is configured to detect the network data sent to a previously unused port address.

24. The method of claim 17 wherein identifying the unauthorized activity includes identifying malware associated with the network data.

25. The method of claim 17 wherein identifying the unauthorized activity includes identifying of a hacker associated with the network data.

26. The method of claim 17 wherein analyzing the copied network data flags the at least a portion of the copied network data as suspicious by comparing the copied network data to policies within a policy engine.

27. The method of claim 17 wherein the one or more characteristics of a computer worm include being configured to duplicate itself for propagation.

28. A non-transitory computer readable medium comprising:

computer readable code configured to direct a processor to copy network data from a communication network, analyze the copied network data with a heuristic to determine if the copied network data has one or more characteristics of a computer worm, flag at least a portion of the analyzed copied network data as suspicious by flagging the at least a portion of the copy of the network data for replay in an analysis environment based upon the heuristic determination that the at least a portion of the analyzed copied network data has one or more characteristics of a computer worm, and replay transmission of the flagged suspicious at least a portion of the analyzed copied network data copied from the network to a destination device to identify unauthorized activity based on playback of the flagged suspicious at least a portion of the analyzed copied network data.

29. The non-transitory computer readable medium of claim 28 wherein replaying transmission of the flagged suspicious at least a portion of the analyzed copied network data comprises directing the processor to retrieve a virtual machine configured to receive the flagged suspicious at least a portion of the analyzed copied network data, configuring a replayer to transmit the flagged suspicious at least a portion of the analyzed copied network data to the virtual machine, and performing a simulation by transmitting previously flagged at least a portion of the analyzed copied network data to the virtual machine.

30. The non-transitory computer readable medium of claim 28 wherein the one or more characteristics of a computer worm include being configured to duplicate itself for propagation.