Patent Application
20110126136
The present disclosure relates generally to network traffic analysis, and more particularly to botnet analysis and visualization.
The Internet provides users with access to a voluminous amount of information. However, connecting to the Internet also comes with certain risks. One of these is the risk of a user's computer being infected with malicious software.
Internet bots are often configured as malicious software. Internet bots, also referred to as bots, are software applications designed to run tasks automatically and autonomously based on commands from a separate entity. A collection of bots each operating on one of a number of networked computers is referred to as a botnet. Botnets may be commanded and controlled by a bot master who can control the bots of the botnet remotely. Bots of a botnet can be commanded to conduct distributed denial of service attacks or similar operations used to affect another entity's availability or functionality. What is needed is a method of detecting botnets to prevent or lessen the effect of malicious operations.
One embodiment is a method for botnet analysis and visualization. Network traffic is filtered to compile a list of messages. The identified messages are tokenized, classified, aggregated, and changes in the frequency of content and attributes of tokenized messages are identified. A display of the tokenized messages is generated and displayed via a user interface. The user interface is configured to allow a user to review data generated based on the filtered network traffic in order to detect potential botnet activity. User input may be used to adjust filtering and tokenization of the messages.
These and other advantages of the disclosure will be apparent to those of ordinary skill in the art by reference to the following detailed description and the accompanying drawings.
The patent or application file contains at least one drawing executed in color. Copies of this patent or patent application publication with color drawing(s) will be provided by the Office upon request and payment of the necessary fee.
Bots of a botnet may communicate with one another, one or more botnet command and control entities, or a third party entity. A botnet master transmits commands to bots of the botnet and, in response, the bots perform the commanded operations. The communications of botnet entities can be used to determine the existence of the botnet and allow for appropriate actions to be taken. For example, botnets can be detected by analyzing network traffic between botnet entities to identify the operation of botnets thereby allowing corrective action to be taken if necessary.
At step 104, a list of the messages matching the filter criteria are compiled. In one embodiment, the list of messages is stored in memory before being processed as described below. After the list of messages matching the filter criteria is compiled, the process proceeds to step 106.
At step 106, the messages contained in the list compiled at step 104 are tokenized. Tokenization is the process of assigning tokens to a message or specific portions of a message. For example, if a message concerns a denial-of-service attack and contains the count of the number of packets sent, the count can be replaced by a token. Tokenization allows messages that are generally similar in one or more aspects to be categorized based on the similar aspects common to the messages. Tokenization may also be used to remove differences between messages. For example, tokenization may be used to convert text in a message to lower case or remove punctuation from a message. After the messages are tokenized, the process proceeds to step 108.
At step 108, the filtered messages are classified based on classifying criteria. Classifying criteria, in one embodiment, comprises pattern matching (also referred to as PAT in
At step 110 the messages tokenized in step 108 are aggregated over time to facilitate detection of patterns. For example, tokenized messages may be grouped into time intervals of varying granularity such as minute, hour, or day. The tokenized messages may also be grouped into multiple intervals such as 5 minutes, 10 minutes, 1 hour, or 1 day. The tokens aggregated over time are then analyzed in step 112 to identify frequency changes of the tokens over time.
At step 114, the changes in frequency of the tokens identified in step 112 are grouped into time intervals (e.g., particular minute, hour, day, or multiple minutes, hours, or days) to facilitate the generation of a display of changes in frequency of tokens over time.
At step 116, a display of the changes in frequency of the tokens as a function of time is generated for display to a user via a user interface (described in detail below in connection with
It should be noted that steps 106 through 116, in one embodiment, are facilitated using the tool CoClTe (Coordinating Changes in Text). The CoClTe tool is described in detail in U.S. Patent Application Publication No. 2009/0018819, filed Jul. 11, 2007, entitled Tracking Changes in Stratified Data-Streams and U.S. Patent Application No. 12,325,157, filed Nov. 29, 2008, entitled Systems and Methods for Detecting and Coordinating Changes in Lexical Items, both of which are incorporated herein by reference.
Graph 204 indicates the number of messages that have been identified as potential communications among botnet entities in a botnet with each column representing messages grouped within a particular timeslot, in this case, each column representing one hour. Each message has been classified with a type (e.g., PAT for matching a pattern, PORT for an attempted attack on a given network port), a parameter with type-specific detail (e.g., the type of pattern or the port number for a PORT message), an IP address, and a direction (FROM/TO). Each combination of these four pieces of data from the classifier is assigned a unique color or fill pattern, and each column is split into segments. The relative frequency of each kind of message is used to determine the size of the segments.
Above graph 204 is graph 202 comprised of multiple columns. Each column indicates the number of change events (i.e. interesting increases, decreases, trend changes, etc.) within a particular timeslot, in this case, each column representing one hour. In this embodiment, different colors or fill patterns represent different magnitudes of increases or decreases of events. In other embodiments, change event data in graph 202 may be integrated in other various ways described below in conjunction with
Grouping the raw messages according to classification makes the data considerably less bulky, but there are still usually many different things happening in each timeslot. The user may be able to discern some of the more prominent patterns based on the “flow” of different colors or fill patterns in the graph. Less prominent patterns, however, are still difficult to spot. Interactive filtering and slicing operations may be performed as shown in
In
As noted above,
In
In this embodiment, a network “port” in this context corresponds to a particular piece of software that is listening for network connections on a machine. Consider, for example, a server machine that is running both web server software and email server software. These two pieces of software would be listening on different port numbers, so traffic bound for one can be distinguished from traffic bound for the other. An analogy would be that the machine's IP address is like an apartment building's street number, while a piece of server software's port number is like an apartment number within the building.
There are steady, cyclical attacks or probes to a single machine on each of port 445 and 135 as shown in graphs 602 and 606 respectively. Even though these appear fairly consistent, arrow icons, such as upward facing arrow icon 603, indicate that CoCite has identified change events that should be investigated further.
Attacks/probes to port 139 are similarly cyclical as shown in graph 604, but segments 604A and 604B indicate that two different IP addresses are involved. The attack represented by 604B appear to have some correlation to the attacks on port 135 shown in graph 606, while the attack represented by 604A appears to be somewhat counter-cyclical.
Attack/probes to ports 2967 and 2968 are far less common as shown in graphs 608 and 609 respectively. These are correlated, and also appear to involve three different IP addresses.
There is a small burst of attacks/probes to port 6667 as shown in graph 614.
A useful interpretation of this data would require inspection of the details in table 612 below graphs 602-610. One plausible scenario, for example, might be that the burst of probes to port 6667 shown in graph 614 represent a new kind of botnet attack, one that exploits a previously unknown bug in some piece of software on the victim machine. This burst would have been very difficult to detect in the views shown in the previous screenshots.
The data concerning potential attacks determined using the user interfaces displayed in
The steps of method 100 shown in
The foregoing Detailed Description is to be understood as being in every respect illustrative and exemplary, but not restrictive, and the scope of the general inventive concept disclosed herein is not to be determined from the Detailed Description, but rather from the claims as interpreted according to the full breadth permitted by the patent laws. It is to be understood that the embodiments shown and described herein are only illustrative of the principles of the present disclosure and that various modifications may be implemented by those skilled in the art without departing from the scope and spirit of the general inventive concept. Those skilled in the art could implement various other feature combinations without departing from the scope and spirit of the general inventive concept.
