Distributed systems and methods for automatically detecting unknown bots and botnets

A local analyzer comprising:

• a network interface to receive a plurality of packets captured from network traffic;
• one or more processors communicatively coupled to the network interface;
• and
• a storage device communicatively coupled to the one or more processors, the storage device comprises
• a signature generating logic that, when executed by the one or more processors, generates a header signature based on information from a header obtained from a captured packet of the plurality of captured packets,
• a signature matching logic that, when executed by the one or more processors, determines whether the header signature corresponds to one of a plurality of packet header signatures corresponding to verified callbacks,
• an inspection logic that, when executed by the one or more processors and in response to the header signature failing to match any of the plurality of packet header signatures, detects whether the captured packet header includes one or more header anomalies, the captured packet header identified as having one or more header anomalies being a suspect header, and
• a local storage device that includes the plurality of packet header signatures corresponding to verified callbacks, the plurality of packet header signatures are updated with additional packet header signatures corresponding to verified callbacks, and
• a reporting logic that, when executed by the one or more processors and in response to the inspection logic detecting that the captured packet header includes one or more header anomalies, transmits the header signature and information associated with the captured packet to a central analyzer for further analysis to determine whether the captured packet is part of a malicious callback.

A central analyzer in communications with a plurality of local analyzers over a network, the central analyzer comprising:

• a network interface operable to receive information associated with a packet under analysis from a local analyzer of the plurality of local analyzers for further analysis to determine whether the packet under analysis is part of a malicious callback;
• one or more hardware processors;
• and
• a storage device coupled to the one or more hardware processors, the storage device comprises
• a signature matching logic that, when executed by the one or more hardware processors, determines whether a header signature for a suspect header of the packet under analysis corresponds to one of a plurality of header signatures associated with verified callbacks that are stored in a storage device accessible by the central analyzer,
• evaluation logic that, when executed by the one or more hardware processors, accesses content within the suspect header to determine a likelihood of the content being associated with malicious activity, and
• threat heuristics logic that, when executed by the one or more hardware processors, generates a pattern that contains attributes associated with the packet under analysis, analyzes the pattern, and determines a probability of one or more attributes associated with the pattern includes malware and is associated with a malicious callback,
• wherein the network interface further operable to return a message to the local analyzer containing information with respect to the suspect header being verified as corresponding to a malicious callback.