US 10,757,136 B2Granted

Botnet beaconing detection and mitigation

AssigneeVerizon Patent and Licensing Inc.

InventorsYonatan Fridman, Kenneth J. Mckeever, Karl Stang

Life of this patent

Estimating the term…

Loading patent…

Abstract

A botnet detector collects data associated with flows between a pair of network elements. The botnet detector processes the flow data to determine whether some of the flows are associated with botnet beaconing and/or tunneling. For example, the botnet detector may determine whether some of the flows occur at a regular interval or whether some of the flows are associated with extended length sessions, respectively. To determine whether some of the flows occur at a regular interval, the botnet detector may convert the flow data to the frequency domain and may determine an interval associated with a highest vector magnitude. If the botnet detector determines that the pair of network elements are exchanging beaconing or tunneling signals, the botnet detector may forward a notification that the pair of network elements are associated with the botnet.

Claims20

Dependent claims

A method comprising:

collecting, by a processor, flow data associated with flows between a plurality of network elements;
processing, by the processor, the flow data to identify that a subset of the flows, between a first network element and a second network element of the plurality of network elements, occur at a regular interval;
determining, by the processor, sessions of packet transmission associated with each flow of the subset of flows;
identifying, by the processor, one or more of the sessions that exceed a threshold amount of time;
identifying, by the processor, at least one of the one or more sessions in which the packet transmission is below a threshold number of packets;
determining, by the processor, that the at least one of the one or more sessions is associated with a botnet beacon and the regular interval corresponds to a botnet beaconing interval;
using, by the processor, the botnet beaconing interval to identify a third network element of the plurality of network elements associated with a same botnet as the first and second network elements;
and
forwarding, by the processor, a notification, wherein the notification includes information identifying the first, second, and third network elements as being associated with the same botnet.

6 more elements

A device comprising:

a communication interface;
a memory configured to store instructions;
and
a processor configured to execute one or more of the instructions to:
collect, via the communication interface, flow data associated with flows between a plurality of network elements;
process the flow data to identify that a subset of the flows, between a first network element and a second network element of the plurality of network elements, occur at a regular interval;
determine, based on the flow data, sessions between the first network element and the second network element, wherein the sessions relate to packet transmission of the flows;
identify one or more of the sessions that exceed a threshold amount of time;
identify at least one of the one or more sessions in which the packet transmission is below a threshold number of packets;
determine that the at least one of the one or more sessions is associated with a botnet beacon and the regular interval corresponds to a botnet beaconing interval;
use the botnet beaconing interval to identify a third network element of the plurality of network elements associated with a same botnet as the first and second network elements;
and
forward, via the communication interface, a notification, wherein the notification includes information identifying the first, second, and third network elements as being associated with the same botnet.

10 more elements

A non-transitory computer-readable medium to store instructions, wherein the instructions comprise:

one or more instructions that, when executed by a processor associated with a device, cause the processor to:
collect flow data associated with flows between a plurality of network elements;
process the flow data to identify that a subset of the flows, between a first network element and a second network element of the plurality of network elements, occur at a regular interval;
determine, based on the flow data, sessions between the first network element and the second network element, wherein the sessions relate to packet transmission of the flows;
identify one or more of the sessions that exceed a threshold amount of time;
identify at least one of the one or more sessions in which the packet transmission is below a threshold number of packets;
determine that the at least one of the one or more sessions is associated with a botnet beacon and the regular interval corresponds to a botnet beaconing interval;
use the botnet beaconing interval to identify a third network element of the plurality of network elements associated with a same botnet as the first and second network elements;
and
forward a notification, wherein the notification includes information identifying the first, second, and third network elements as being associated with the same botnet.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/838,889Filed 28 Aug 2015
Published: US 2017/0063921 A12 Mar 2017
Granted: 25 Aug 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification4 codes

H04L 63/1458
Countermeasures against malicious traffic: denial of Service
H04L 63/1466
Countermeasures against malicious traffic: active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g.…
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04L
Digital communication