Classification of unwanted or malicious software through the identification of encrypted data communication

• US 8,549,625 B2
• Filed: 12/12/2008
• Issued: 10/01/2013
• Est. Priority Date: 12/12/2008
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Ollmann, Gunter D.
• Primary Examiner(s): LANIER, BENJAMIN E
• Application Number:
  US12/333,607
• Publication Number:
  US 20100154032A1
• Time in Patent Office: 1,754 Days
• Field of Search: 726 22- 25, 713/188
• US Class Current: 726/22
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method for identifying malware or unauthorized software communications implemented within a computer infrastructure, the method including detecting an encrypted communication and determining identification data for the encrypted communication. Additionally, the method includes comparing the detected encrypted communication to at least one of a list of applications authorized for encrypted communications using the identification data and a list of authorized destinations of encrypted communications using the identification data. Furthermore, the method includes identifying the detected encrypted communication as an unauthorized encrypted communication in response to a determination that at least one of the detected encrypted communication is from an unauthorized application, which is not on the list of applications authorized for encrypted communications, based on the comparing and the detected encrypted communication is to an unauthorized destination, which is not on the list of authorized destinations.

Claims

1. A method for identifying unauthorized encrypted communications, the method comprising:

a computer detecting an encrypted communication;

**

the computer determining a source and destination of the encrypted communication;

the computer comparing the source of the detected encrypted communication to a predetermined list of applications authorized to send encrypted communications to the computer and the destination of the detected encrypted communication to a predetermined list of destinations authorized for encrypted communications, and

if the source of the detected encrypted communication is on the predetermined list of authorized applications and the destination of the detected encrypted communication is on the predetermined list of destinations authorized for encrypted communications, the computer allowing the detected encrypted communication to proceed, and

if the source of the detected encrypted communication is not on the predetermined list of authorized applications, the computer determining if the detected encrypted communication was sent from an application that is on a network trusted by the computer, and, if so, the computer adding the application on the trusted network to the predetermined list of applications authorized to send encrypted communications; and

the computer subsequently receiving another encrypted communication from the application on the trusted network, and in response, the computer determining that a source of the other encrypted communication is the application on the trusted network and that the application on the trusted network is on the predetermined list of authorized applications, and, in response, if the destination of the other encrypted communication is on the predetermined list of destinations authorized for encrypted communications the computer allowing the other encrypted communication to proceed.

2. The method of claim 1, wherein if the source of the detected encrypted communication is not on the predetermined list of authorized applications, further comprising the step of blocking, by the computer, the detected encrypted communication.

3. The method of claim 1, wherein the source of the detected encrypted communication is on the predetermined list of authorized applications and the destination of the detected encrypted communication is on the predetermined list of destinations authorized for encrypted communications, and, in response, further comprising the step of processing, by the computer, the detected encrypted communication.

4. The method of claim 2 further comprising identifying, by the computer, the source of the detected encrypted communication as at least one of malware and an unauthorized software deployment if the source of the detected encrypted communication is not on the predetermined list of authorized applications.

5. The method of claim 4 further comprising:

sending, by the computer, an identification of the detected encrypted communication as an unauthorized encrypted communication to a user; and

receiving an instruction from the user to one of;

add an unauthorized application from which the detected encrypted communication was sent to the predetermined list of applications authorized to send encrypted communications and allow the detected encrypted communication; and

block the unauthorized encrypted communication.

11. The method of claim 1, further comprising:

the computer comparing the destination to a predetermined list of destinations that are not authorized for encrypted communications, and if the destination of the detected encrypted communication is on the predetermined list of destinations that are not authorized for encrypted communications the computer blocking the detected encrypted communication.

12. The method of claim 11, wherein the predetermined list of destinations that are not authorized for encrypted communications include one of destinations in a foreign country that is not authorized for encrypted communications and destinations of an internet service provider that is not authorized for encrypted communications.

13. The method of claim 11, wherein the predetermined list of destinations that are not authorized for encrypted communications include unauthorized peer-to-peer network destinations.

6. A computer system for identifying unauthorized encrypted communications, the computer system comprising:

a computer-readable tangible storage device, a memory, and a central processing unit;

first program instructions to detect an encrypted communication;

second program instructions to determine a source and destination of the encrypted communication;

third program instructions to compare the source of the encrypted communication to a predetermined list of applications authorized to send encrypted communications and the destination of the detected encrypted communication to a predetermined list of destinations authorized for encrypted communications, and if the source of the detected encrypted communication is on the predetermined list of authorized applications and the destination of the detected encrypted communication is on the predetermined list of destinations authorized for encrypted communications, allow the detected encrypted communication to proceed, and if the source of the detected encrypted communication is not on the predetermined list of authorized applications, determine if the detected encrypted communication was sent from an application that is on a network trusted by the computer system, and if so, add the application on the trusted network to the list of applications authorized to send encrypted communications; and

fourth program instructions to subsequently receive another encrypted communication from the application on the trusted network, and in response, determine that a source of the other encrypted communication is the application on the trusted network and that the application on the trusted network is on the predetermined list of authorized applications, and in response, if the destination of the other encrypted communication is on the predetermined list of destinations authorized for encrypted communications allow the other encrypted communication to proceed, wherein the first program instructions, the second program instructions, the third program instructions, and the fourth program instructions are stored in the computer-readable tangible storage device for execution by the central processing unit via the memory.

7. The computer system of claim 6, wherein if the source of the detected encrypted communication is not on the predetermined list of authorized applications, further comprising fifth program instructions to block the detected encrypted communication, wherein the fifth program instructions are stored in the computer-readable tangible storage device for execution by the central processing unit via the memory.

8. The computer system of claim 6, wherein the source of the detected encrypted communication is on the predetermined list of authorized applications and the destination of the detected encrypted communication is on the predetermined list of destinations authorized for encrypted communications, and in response, further comprising sixth program instructions to:

process the detected encrypted communication, wherein the sixth program instructions are stored in the computer-readable tangible storage device for execution by the central processing unit via the memory.

9. The computer system of claim 6 further comprising seventh program instructions to receive the predetermined list of applications authorized to send encrypted communications and store the list of applications authorized to send the encrypted communications,

wherein the seventh program instructions are stored in the computer-readable tangible storage device for execution by the central processing unit via the memory.

10. A computer program product comprising a computer-readable tangible storage device having readable program code embodied in the computer-readable tangible storage device, the computer program product includes at least one component operable to:

receive a predetermined list of applications authorized to send encrypted communications;

detect an encrypted communication;

determine a source of the encrypted communication and a destination for the encrypted communication;

compare the source of the detected encrypted communication to the predetermined list of applications authorized to send the encrypted communications and the destination of the detected encrypted communication to a predetermined list of destinations authorized for encrypted communications, and if the source of the detected encrypted communication is on the predetermined list of authorized applications and the destination of the detected encrypted communication is on the predetermined list of destinations authorized for encrypted communications, allow the detected encrypted communication to proceed, and if the source of the detected encrypted communication is not on the predetermined list of authorized applications, determine if the detected encrypted communication was sent from an application that is on a network that is trusted, and if so, add the application on the trusted network to the predetermined list of applications authorized to send encrypted communications; and

subsequently receive another encrypted communication from the application on the trusted network, and in response, determine that the source of the other encrypted communication is the application on the trusted network and that the application on the trusted network is on the predetermined list of authorized applications, and in response, if the destination of the other encrypted communication is on the predetermined list of destinations authorized for encrypted communications allow the other encrypted communication to proceed.