Email-based worm propagation properties

• US 20070226799A1
• Filed: 03/21/2006
• Published: 09/27/2007
• Est. Priority Date: 03/21/2006
• Status: Abandoned Application

• Current Assignee: Riverbed Technology Incorporated
• Original Assignee: Riverbed Technology Incorporated
• Inventors: Gopalan, Prem, Jamieson, Kyle, Mavrommatis, Panayiotis
• Application Number:
  US11/387,087
• Publication Number:
  US 20070226799A1
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system, method and computer program product for email-based worm detection and mitigation are disclosed. The system, method, and computer program product are configured to identify a signature representing content prevalent in email-based network traffic, generate a client list for the identified signature, determine if a number of clients included in the client list exceeds a threshold, and generate a worm signature based on the signature if the number of clients included in the client list exceeds the threshold.

Claims

1. A computer program product residing on a computer readable medium for intrusion detection, the computer program product comprising instructions for causing a processor to:

identify a signature representing content prevalent in email-based network traffic;

generate a client list for the identified signature;

determine if a number of clients included in the client list exceeds a threshold; and

generate a worm signature based on the identified signature if the number of clients included in the client list exceeds the threshold.

2. The computer program product of claim 1 wherein the instructions to identify a signature representing content prevalent in email traffic comprise instructions to:

receive packet payload data; and

analyze the packet payload data to identify recurring sets of bits.

3. The computer program product of claim 2 wherein the instructions to analyze the packet payload data to identify recurring sets of bits comprises instructions to:

extract a plurality of sets of bits having a predetermined length;

compute a hash of each of the plurality of sets of bits; and

count the number of times a particular hash value occurs during a period of time.

4. The computer program product of claim 1 wherein the computer program product further comprises instructions for causing a processor to:

clear the client list for the identified signature after a predetermined length of time.

5. The computer program product of claim 1 wherein the computer program product further comprises instructions for causing a processor to:

determine if the email-based network traffic comprises traffic from an external client; and

if the email-based network traffic comprises traffic from an external client, exclude the external client from the client list.

6. The computer program product of claim 1 wherein the computer program product further comprises instructions for causing a processor to:

determine if the email-based network traffic comprises traffic from a mail server; and

if the email-based network traffic comprises traffic from the mail server, exclude the mail server from the client list.

7. The computer program product of claim 1 wherein the computer program product further comprises instructions for causing a processor to:

determine if the email-based network traffic comprises traffic from an automated mail application; and

if the email-based network traffic comprises traffic from the automated mail application, exclude the automated mail application from the client list.

8. The computer program product of claim 1 wherein the computer program product further comprises instructions for causing a processor to:

determine if an average frequency exceeds a frequency threshold; and

generate a worm signature if the average frequency exceeds the frequency threshold.

9. The computer program product of claim 1 wherein the computer program product further comprises instructions for causing a processor to:

determine if an average number of distinct servers contacted exceeds a number of servers threshold; and

generate a worm signature if the number of distinct servers contacted exceeds the number of servers threshold.

10. The computer program product of claim 1 wherein the computer program product further comprises instructions for causing a processor to:

detect exploit-based worms.

11. The computer program product of claim 10 wherein the instructions for causing a processor to detect exploit-based worms comprise instructions for causing a processor to:

identify a signature representing content prevalent in network traffic;

determine if the traffic including the identified signature exhibits propagation;

determine if the traffic including the identified signature exhibits connectedness; and

generate a worm signature based on the identified signature if the signature exhibits both connectedness and propagation.

12. A method comprising:

identifying a signature representing content prevalent in email-based network traffic;

generating a client list for the identified signature;

determining if a number of clients included in the client list exceeds a threshold; and

generating a worm signature based on the identified signature if the number of clients included in the client list exceeds the threshold.

13. The method of claim 12, wherein identifying a signature representing content prevalent in email traffic comprises:

receiving packet payload data; and

analyzing the packet payload data to identify recurring sets of bits;

extracting a plurality of sets of bits having a predetermined length;

computing a hash of each of the plurality of sets of bits; and

counting the number of times a particular hash value occurs during a period of time.

14. The method of claim 12, further comprising

clearing the client list for the identified signature after a predetermined length of time.

15. The method of claim 12, further comprising:

determining if the email-based network traffic comprises traffic from an external client; and

if the email-based network traffic comprises traffic from an external client, excluding the external client from the client list.

16. The method of claim 12, further comprising:

determining if the email-based network traffic comprises traffic from a mail server; and

if the email-based network traffic comprises traffic from the mail server, excluding the mail server from the client list.

17. The method of claim 12, further comprising:

determining if the email-based network traffic comprises traffic from an automated mail application; and

if the email-based network traffic comprises traffic from the automated mail application,

excluding the automated mail application from the client list.

18. The method of claim 12, further comprising:

determining if an average frequency exceeds a frequency threshold; and

generating a worm signature if the average frequency exceeds the frequency threshold.

19. The method of claim 12, further comprising:

determining if an average number of distinct servers contacted exceeds a number of servers threshold; and

generating a worm signature if the number of distinct servers contacted exceeds the number of servers threshold.

20. The method of claim 12, further comprising:

detecting exploit-based worms.

21. An intrusion detection system, comprising:

a profiler configured to;

identify a signature representing content prevalent in email-based network traffic;

generate a client list for the identified signature;

determine if a number of clients included in the client list exceeds a threshold; and

generate a worm signature based on the identified signature if the number of clients included in the client list exceeds the threshold.

22. The system of claim 21 wherein the profiler is further configured to:

receive packet payload data;

analyze the packet payload data to identify recurring sets of bits

extract a plurality of sets of bits having a predetermined length;

compute a hash of each of the plurality of sets of bits; and

count the number of times a particular hash value occurs during a period of time.

23. The system of claim 21 wherein the profiler is further configured to:

determine if the email-based network traffic comprises traffic from an external client; and

if the email-based network traffic comprises traffic from an external client, exclude the external client from the client list.

24. The system of claim 21 wherein the profiler is further configured to:

determine if the email-based network traffic comprises traffic from a mail server; and

if the email-based network traffic comprises traffic from the mail server, exclude the mail server from the client list.

25. The system of claim 21 wherein the profiler is further configured to:

determine if the email-based network traffic comprises traffic from an automated mail application; and

if the email-based network traffic comprises traffic from the automated mail application, exclude the automated mail application from the client list.

26. The system of claim 21 wherein the profiler is further configured to:

determine if an average frequency exceeds a frequency threshold; and

generate a worm signature if the average frequency exceeds the frequency threshold.

27. The system of claim 21 wherein the profiler is further configured to:

determine if an average number of distinct servers contacted exceeds a number of servers threshold; and

generate a worm signature if the number of distinct servers contacted exceeds the number of servers threshold.