Honey monkey network exploration

• US 9,596,255 B2
• Filed: 07/16/2014
• Issued: 03/14/2017
• Est. Priority Date: 03/01/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Wang, Yi-Min, Beck, Douglas
• Primary Examiner(s): Salad, Abdullahi E
• Application Number:
  US14/332,626
• Publication Number:
  US 20140331328A1
• Time in Patent Office: 972 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/9566 URL specific, e.g. using aliases, detecting broken or misspelled links
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A network can be explored to investigate exploitive behavior. For example, network sites may be actively explored by a honey monkey system to detect if they are capable of accomplishing exploits, including browser-based exploits, on a machine. Also, the accomplishment of exploits may be detected by tracing events occurring on a machine after visiting a network site and analyzing the traced events for illicit behavior. Alternatively, site redirections between and among uniform resource locators (URLs) may be explored to discover relationships between sites that are visited.

Claims

1. A method comprising:

determining redirection relationships between a particular website of a plurality of websites and other websites of the plurality of websites;

determining a rank of the particular website of the plurality of websites based at least on the redirection relationships between the particular website and the other websites of the plurality of websites;

reporting the rank of the particular website; and

causing display of a visual representation, the visual representation including a plurality of visual indicators, each of the plurality of visual indicators visually indicating a corresponding rank of a respective website of the plurality of websites, and the visual representation including a particular visual indicator indicating the rank of the particular website.

2. The method of claim 1, further comprising determining a number of the other websites with incoming redirection links that redirect traffic to the particular website, and wherein the rank is based at least on the number.

3. The method of claim 1, further comprising determining a number of outgoing redirection links in the particular website that redirect traffic to the other websites, and wherein the rank is based at least on the number.

4. The method of claim 1, further comprising determining a number of two-way redirection relationships between the particular website and the other websites of the plurality of websites, wherein a two-way relationship between the particular website and one of the other websites is based at least on:

an incoming redirection link in the one of the other websites that redirects traffic to the particular website, and

an outgoing redirection link in the particular website that redirects traffic to the one of the other websites; and

wherein the rank is based at least on the number.

5. The method of claim 1, further comprising determining a number of redirection relationships based at least on:

a first number of the other websites with incoming redirection links that redirect traffic to the particular website;

a second number of outgoing redirection links in the particular website that redirect traffic to the other websites; and

a third number of two-way redirection relationships between the particular website and the other websites of the plurality of websites, wherein a two-way relationship between the particular website and one of the other websites is based at least on;

an incoming redirection link in the one of the other websites that redirects traffic to the particular website, and

an outgoing redirection link in the particular website that redirects traffic to the one of the other websites; and

wherein the rank is based at least on the first number, the second number, and the third number.

6. The method of claim 1, wherein the particular visual indicator includes a bar graph that indicates a number of the other websites that have a traffic redirection relationship with the particular website.

7. The method of claim 1, further comprising blocking access to the particular website based at least on the rank.

8. The method of claim 1, further comprising determining the rank of the particular website based at least on a number of one or more exploit links hosted by the particular website, wherein the one or more exploit links redirect traffic to one or more exploit sites.

9. A computing system, comprising:

one or more processors;

memory; and

processor-executable instructions stored on the memory and executable by the one or more processors to cause the computing system to;

determine redirection relationships between a particular website of a plurality of websites and other websites of the plurality of websites;

determine a rank of the particular website of the plurality of websites based at least on the redirection relationships between the particular website and the other websites of the plurality of websites; and

report the rank of the particular website.

10. The computing system of claim 9, wherein the processor-executable instructions are further executable by the one or more processors to cause the computing system to:

determine a number of redirection relationships based at least on a number of the other websites with incoming redirection links that redirect traffic to the particular website; and

determine the rank based at least on the number.

11. The computing system of claim 9, wherein the processor-executable instructions are further executable by the one or more processors to:

determine a number of outgoing redirection links in the particular website that redirect traffic to the other websites; and

determine the rank based at least on the number.

12. The computing system of claim 9, wherein the processor-executable instructions are further executable by the one or more processors to cause the computing system to:

determine a number of two-way redirection relationships between the particular website and the other websites of the plurality of websites, wherein a two-way relationship between the particular website and one of the other websites is based at least on;

an incoming redirection link in the one of the other websites that redirects traffic to the particular website, and

an outgoing redirection link in the particular website that redirects traffic to the one of the other websites; and

determine the rank based at least on the number.

13. The computing system of claim 9, wherein the processor-executable instructions are further executable by the one or more processors to cause the computing system to:

determine a number of redirection relationships based at least on;

a first number of the other websites with incoming redirection links that redirect traffic to the particular website;

a second number of outgoing redirection links in the particular website that redirect traffic to the other websites; and

a third number of two-way redirection relationships between the particular website and the other websites of the plurality of websites, wherein a two-way relationship between the particular website and one of the other websites is based at least on;

an incoming redirection link in the one of the other websites that redirects traffic to the particular website, and

an outgoing redirection link in the particular website that redirects traffic to the one of the other websites; and

determine the rank based at least on the first number, the second number, and the third number.

14. The computing system of claim 9, wherein the processor-executable instructions are further executable by the one or more processors to cause the computing system to determine the rank of the particular website based at least on a number of one or more exploit links hosted by the particular website, wherein the one or more exploit links redirect traffic to one or more exploit sites.

15. A computing device comprising:

one or more hardware processors;

one or more memory devices storing instructions, the instructions executable by the one or more hardware processors to cause the computing device to;

determine redirection relationships between a particular website of a plurality of websites and other websites of the plurality of websites;

determine a rank of the particular website of the plurality of websites based at least on the redirection relationships between the particular website and the other websites of the plurality of websites;

report the rank of the particular website; and

determine resource allocation for monitoring of the particular website based at least in part on the rank of the particular website.

16. The computing device of claim 15, wherein the plurality of instructions are further executable by the one or more processors to cause the computing system to:

determine a number of redirection relationships based at least on a number of the other websites with incoming redirection links that redirect traffic to the particular website; and

determine the rank based at least on the number.

17. The computing device of claim 15, wherein the plurality of instructions are further executable by the one or more processors to cause the computing system to:

determine a number of outgoing redirection links in the particular website that redirect traffic to the other websites; and

determine the rank based at least on the number.

18. The computing device of claim 15, wherein the plurality of instructions are further executable by the one or more processors to cause the computing system to:

determine a number of two-way redirection relationships between the particular website and the other websites of the plurality of websites, wherein a two-way relationship between the particular website and one of the other websites is based at least on;

an incoming redirection link in the one of the other websites that redirects traffic to the particular website, and

an outgoing redirection link in the particular website that redirects traffic to the one of the other websites; and

determine the rank based at least on the number.

19. The computing device of claim 15, wherein the plurality of instructions are further executable by the one or more processors to cause the computing system to:

determine a number of redirection relationships based at least on;

a first number of the other websites with incoming redirection links that redirect traffic to the particular website;

a second number of outgoing redirection links in the particular website that redirect traffic to the other websites; and

a third number of two-way redirection relationships between the particular website and the other websites of the plurality of websites, wherein a two-way relationship between the particular website and one of the other websites is based at least on;

an incoming redirection link in the one of the other websites that redirects traffic to the particular website, and

an outgoing redirection link in the particular website that redirects traffic to the one of the other websites; and

determine the rank based at least on the first number, the second number, and the third number.

20. The computing device of claim 15, wherein the plurality of instructions are further executable by the one or more processors to cause the computing system to determine the rank of the particular website based at least on a number of one or more exploit links hosted by the particular website, wherein the one or more exploit links redirect traffic to one or more exploit sites.