Monitoring darknet access to identify malicious activity

• US 8,413,238 B1
• Filed: 07/21/2008
• Issued: 04/02/2013
• Est. Priority Date: 07/21/2008
• Status: Active Grant

• Current Assignee: Zscaler Incorporated
• Original Assignee: Zscaler Incorporated
• Inventors: Sutton, Michael
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): NASH, LASHANYA RENEE
• Application Number:
  US12/176,912
• Time in Patent Office: 1,716 Days
• Field of Search: 726/3, 726/13, 726/22, 726/23, 726/26, 709/223, 709/224, 709/225
• US Class Current: 726/23
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Systems, methods and apparatus for a distributed security that monitors communications to identify access attempts to/from darknet addresses. Such attempts can be inferred to be associated with malicious activity and a notification or other corrective action can be provided identifying such potentially malicious activity.

Claims

1. A computer-implemented method, comprising:

identifying with a first server a list of darknet addresses utilizing a plurality of techniques and providing the list of darknet addresses to a second server, wherein the second server is unassociated with any internet protocol addresses on the list of darknet addresses;

continually monitoring with the second server all communications originating from or destined to a protected network external to a network edge of the protected network, wherein the first server and the second server cooperatively forming a distributed security system external to the protected network, and wherein the list of darknet addresses comprises addresses external to the protected network;

comparing with the second server destination or source addresses of the monitored communications originating from or destined to the protected network to the list of darknet addresses;

if a match is found between the destination or source addresses and the list of darknet addresses, providing notification of potential malicious activity originating from or destined to the protected network and blocking the potential malicious activity with the second server such that the potential malicious activity does not enter the protected network or leave the second server;

updating the list of darknet addresses at the first server or the second server using one or more of the plurality of techniques including proactively scanning addresses and passively monitoring addresses, and distributing updates between the first server and the second server;

wherein updating a list of darknet addresses comprises;

compiling a list of active addresses from autonomous systems communications originated by routers;

identifying potential darknet addresses based upon gaps identified in the list of active addresses;

attempting to connect to the identified potential darknet addresses; and

if the attempt to connect to the identified potential darknet addresses is unsuccessful, adding the potential darknet addresses to the list of darknet addresses.

2. The computer-implemented method of claim 1, wherein compiling a list of darknet addresses comprises querying a database associated with a regional Internet registry.

3. The computer-implemented method of claim 1, wherein compiling a list of darknet addresses comprises identifying a sudden increase in traffic destined for a range of internet protocol addresses.

4. The computer-implemented method of claim 3, further comprising:

attempting to connect to an address within the range of internet protocol addresses; and

if the attempt to connect to connect to the range of internet protocol addresses is unsuccessful, adding the potential darknet addresses to the list of darknet addresses.

5. The computer-implemented method of claim 1, further comprising if a match is found between the destination addresses and the list of darknet addresses, blocking further communications from a device originating communications with a destination address on the list of darknet addresses and taking appropriate additional steps to control future communications from the device and provide notification of a potential infection.

6. The computer-implemented method of claim 1, further comprising if a match is found between the destination addresses and the list of darknet addresses, removing malicious code from a device associated with the communication including a destination address matching an address from the list of darknet addresses.

7. A non-transitory computer readable media storing software comprising instructions executable by a processing device and upon such execution cause the processing device to perform operations comprising:

receiving, from a first server over a network, a list of darknet addresses identified utilizing a plurality of techniques, wherein the processing device is unassociated with any internet protocol addresses on the list of darknet addresses;

continually monitoring all communications originating from or destined to a protected network external to a network edge of the protected network, wherein the first server and the processing device cooperatively forming a distributed security system external to the protected network, and wherein the list of darknet addresses comprises addresses external to the protected network;

comparing destination addresses of the monitored communications originating from or destined to the protected network to the list of darknet addresses;

if a match is found between the destination addresses and the list of darknet addresses, providing notification of potential malicious activity originating from the protected network and blocking the potential malicious activity with the processing device such that the potential malicious activity does not enter the protected network or leave the processing device;

proactively scanning addresses and passively monitoring addresses to provide updates to the list of darknet addresses and providing the updates to the first server;

wherein updating a list of darknet addresses comprises;

compiling a list of active addresses from autonomous systems communications originated by routers;

identifying potential darknet addresses based upon gaps identified in the list of active addresses;

attempting to connect to the identified potential darknet addresses; and

if the attempt to connect to connect to the identified potential darknet addresses is unsuccessful, adding the potential darknet addresses to the list of darknet addresses.

8. The software of claim 7, wherein compiling a list of darknet addresses comprises querying a database associated with a regional Internet registry.

9. The software of claim 7, wherein compiling a list of darknet addresses comprises identifying a sudden increase in traffic destined for a range of internet protocol addresses.

10. The software of claim 9, wherein the instructions are further operable to cause the processing system to perform an operation comprising:

attempting to connect to an address within the range of internet protocol addresses; and

if the attempt to connect to connect to the range of internet protocol addresses is unsuccessful, adding the potential darknet addresses to the list of darknet addresses.

11. The software of claim 7, wherein the instructions are further operable to cause the processing system to perform an operation comprising:

if a match is found between the destination addresses and the list of darknet addresses, refusing further communications from a device originating communications with a destination address on the list of darknet addresses.

12. The software of claim 7, wherein the instructions are further operable to cause the processing system to perform an operation comprising:

if a match is found between the destination addresses and the list of darknet addresses, removing malicious code from a device associated with the communication including a destination address matching an address from the list of darknet addresses.

13. A distributed security system, comprising:

an authority node device comprising a darknet address list generator configured to generate and maintain a list of darknet addresses using a plurality of techniques;

one or more processing node devices communicatively coupled to the authority node using a network, wherein the authority node device and the one or more processing node devices cooperatively form the distributed security system, wherein the one or more processing node devices are unassociated with any internet protocol addresses on the list of darknet addresses and each of the one or more processing node devices configured to;

receive the list of darknet address from the authority node device;

establish communications with a plurality of users;

monitor all of the communications of the plurality of users with devices external to the one or more processing node devices and a protected network protected by the distributed security system, wherein the distributed security system is external to the protected network, and wherein the list of darknet addresses comprises addresses external to the protected network;

detect addresses in the communications as being part of the list of darknet addresses;

prevent malicious activity based on the detected addresses, wherein the malicious activity is prevented by blocking at the one or more processing node devices without the malicious activity entering the network protected by the distributed security system;

proactively scan and passively monitor addresses to determine updates to the list of darknet addresses; and

communicate the updates to the authority node device and receive additional updates to the list of darknet addresses from the authority node device; and

wherein each of the one or more processing node devices comprises a darknet processor configured to identify darknet addresses for the list of darknet addresses using a local routing table monitor configured to monitor routing tables to identify unused nodes, a local address scanner configured to randomly select addresses or select suspicious addresses to attempt communication therewith, and a local passive monitor configured to detect sudden changes in a range of addresses.

14. The distributed security system of claim 13, wherein the authority node device comprises:

a registry query engine configured to query an address database;

a routing table monitor configured to monitor routing tables to identify unused nodes;

an address scanner configured to randomly select addresses or select suspicious addresses to attempt communication therewith; and

a passive monitor configured to detect sudden changes in a range of addresses;

wherein the authority node device utilizes each of the registry query engine, the routing table monitor, the address scanner and the passive monitor to create and maintain the list of darknet addresses.

15. The distributed security system of claim 13, wherein each of the one or more processing node device comprises:

a virus scanner configured to monitor the communications of the plurality of users to classify content as infected or clean;

a uniform resource locator (URL) filter to monitor the communications of the plurality of users to classify URL addresses as allowed or restricted; and

a data leakage protection engine to monitor the communications of the plurality of users to identify leaking content;