Heuristic botnet detection

• US 8,555,388 B1
• Filed: 05/24/2011
• Issued: 10/08/2013
• Est. Priority Date: 05/24/2011
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: Wang, Xinran, Xie, Huagang
• Primary Examiner(s): Flynn, Nathan
• Assistant Examiner(s): LAKHIA, VIRAL S
• Application Number:
  US13/115,016
• Time in Patent Office: 868 Days
• Field of Search: 726 23- 24, 726/4, 726/11, 726 28- 29, 713/165, 713/188, 709/245
• US Class Current: 726/23
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

In some embodiments, heuristic botnet detection is provided. In some embodiments, heuristic botnet detection includes monitoring network traffic to identify suspicious network traffic; and detecting a bot based on a heuristic analysis of the suspicious network traffic behavior using a processor, in which the suspicious network traffic behavior includes command and control traffic associated with a bot master. In some embodiments, heuristic botnet detection further includes assigning a score to the monitored network traffic, in which the score corresponds to a botnet risk characterization of the monitored network traffic (e.g., based on one or more heuristic botnet detection techniques); increasing the score based on a correlation of additional suspicious behaviors associated with the monitored network traffic (e.g., based on one or more heuristic botnet detection techniques); and determining the suspicious behavior is associated with a botnet based on the score.

Claims

1. A system, comprising:

a processor configured to;

monitor network traffic to identify suspicious network traffic, wherein the monitored network traffic includes HTTP traffic, IRC traffic, and unclassified application traffic;

monitor behavior indicated in the network traffic to identify malware, wherein the monitored behaviors that indicate potential malware include one or more of the following;

connecting to a non-standard HTTP port for HTTP traffic, visiting a non-existent domain, downloading executable files with non-standard executable file extensions, performing a DNS query for an email server, communicating using HTTP header with a shorter than common length, communicating using a post method in HTTP traffic, connecting to a non-standard IRC port for IRC traffic, and communicating unclassified traffic over an HTTP port; and

detect a bot based on a heuristic analysis of the suspicious network traffic behavior, wherein the suspicious network traffic behavior includes command and control traffic associated with a bot master; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1, wherein the suspicious behavior is a malware download.

3. The system recited in claim 1, wherein the suspicious behavior is a command and control communication determined using a plurality of heuristics.

4. The system recited in claim 1, wherein the monitored network traffic includes malware URLs and unclassified URLs.

5. The system recited in claim 1, wherein the monitored network traffic includes firewall logs.

6. The system recited in claim 1, wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

identify generic command and control traffic patterns; and

identify specific command and control traffic patterns.

7. The system recited in claim 1, wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

classify the monitored network traffic as command and control traffic associated with a bot master.

8. The system recited in claim 1, wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

correlate the suspicious network traffic behavior with a plurality of other suspicious behaviors.

9. The system recited in claim 1, wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

correlate the suspicious network traffic behavior with a plurality of other suspicious behaviors associated with a client or a plurality of clients.

10. The system recited in claim 1, wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

assign a score to the monitored network traffic, wherein the score corresponds to a botnet risk characterization of the monitored network traffic.

11. The system recited in claim 1, wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

assign a score to the monitored network traffic, wherein the score corresponds to a botnet risk characterization of the monitored network traffic; and

increase the score based on a correlation of additional suspicious behaviors associated with the monitored network traffic.

12. The system recited in claim 1, wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

assign a score to the monitored network traffic, wherein the score corresponds to a botnet risk characterization of the monitored network traffic;

increase the score based on a correlation of additional suspicious behaviors associated with the monitored network traffic; and

determine the suspicious behavior is associated with a botnet based on the score.

13. The system recited in claim 1, wherein the monitored behaviors that indicate potential malware include one or more of the following:

visiting a domain with a domain name that is longer than a common domain name length, visiting a dynamic DNS domain, visiting a fast-flux domain, and visiting a recently created domain.

14. The system recited in claim 1, wherein the monitored visited domain related behavior indicates a potentially malicious domain based on one or more of the following:

a domain name length of a visited domain, whether a visited domain is a dynamic DNS domain, whether a visited domain is a fast-flux domain, and whether a visited domain is a recently created domain.

19. The system recited in claim 1, wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

assign a score to the monitored network traffic, wherein the score corresponds to a botnet risk characterization of the monitored network traffic;

increase the score based on a correlation of additional suspicious behaviors associated with the monitored network traffic;

determine the suspicious behavior is malicious based on the score falling within a first value range; and

determine the suspicious behavior is associated with a botnet based on the score falling within a second value range, the first value range being different from the second value range.

15. A method, comprising:

monitoring network traffic to identify suspicious network traffic, wherein the monitored network traffic includes HTTP traffic, IRC traffic, and unclassified application traffic;

monitoring behavior indicated in the network traffic to identify malware, wherein the monitored behaviors that indicate potential malware include one or more of the following;

connecting to a non-standard HTTP port for HTTP traffic, visiting a non-existent domain, downloading executable files with non-standard executable file extensions, performing a DNS query for an email server, communicating using HTTP header with a shorter than common length, communicating using a post method in HTTP traffic, connecting to a non-standard IRC port for IRC traffic, and communicating unclassified traffic over an HTTP port; and

detecting a bot based on a heuristic analysis of the suspicious network traffic behavior using a processor;

wherein the suspicious network traffic behavior includes command and control traffic associated with a bot master.

16. The method of claim 15 further comprising:

assigning a score to the monitored network traffic, wherein the score corresponds to a botnet risk characterization of the monitored network traffic;

increasing the score based on a correlation of additional suspicious behaviors associated with the monitored network traffic; and

determining the suspicious behavior is associated with a botnet based on the score.

17. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

monitoring network traffic to identify suspicious network traffic, wherein the monitored network traffic includes HTTP traffic, IRC traffic, and unclassified application traffic;

monitoring behavior indicated in the network traffic to identify malware, wherein the monitored behaviors that indicate potential malware include one or more of the following;

connecting to a non-standard HTTP port for HTTP traffic, visiting a non-existent domain, downloading executable files with non-standard executable file extensions, performing a DNS query for an email server, communicating using HTTP header with a shorter than common length, communicating using a post method in HTTP traffic, connecting to a non-standard IRC port for IRC traffic, and communicating unclassified traffic over an HTTP port; and

detecting a bot based on a heuristic analysis of the suspicious network traffic behavior using a processor;

wherein the suspicious network traffic behavior includes command and control traffic associated with a bot master.

18. The computer program product recited in claim 17, further comprising computer instructions for:

assigning a score to the monitored network traffic, wherein the score corresponds to a botnet risk characterization of the monitored network traffic;

increasing the score based on a correlation of additional suspicious behaviors associated with the monitored network traffic; and

determining the suspicious behavior is associated with a botnet based on the score.