Detecting injection attacks using passive network monitoring

A network monitoring computer (NMC) for monitoring communication over a network between one or more computers, comprising:

• a memory that stores at least instructions;
• and
• one or more processors that execute instructions that are configured to cause performance of actions, including:
• determining one or more requests as suspicious that are provided to a server in a monitored network based on one or more characteristics of the one or more provided requests, wherein correlation information is determined for the one or more suspicious requests;
• employing one or more characteristics of one or more dependent actions performed by the server to provide other correlation information for the one or more dependent actions, wherein the one or more dependent actions are evaluated for association with anomalous activity based on the correlation information and the other correlation information, wherein the anomalous activity comprises, an injection attack based on malformed information included in the one or more suspicious requests that is associated with one or more malformed shell instruction, malformed command instruction, or malformed inter-process communication associated with the one or more dependent actions;
• determining the other malformed information that is included in the one or more dependent actions based on an association with the malformed information that is included in the one or more suspicious request;
• employing one or more characteristics of the one or more suspicious requests to provide one or more correlations associated with the one or more suspicious requests;
• providing the evaluation of the one or more dependent actions for anomalous activity based on the one or more correlations associated with the one or more suspicious requests;
• and
• providing one or more reports that include information associated with the anomalous activity by the server and the one or more other servers in the monitored network.

A system for monitoring network traffic in a network:

• one or more network monitoring computers, comprising:
• a memory that stores at least instructions;
• and
• one or more processors that execute instructions that are configured to cause performance of actions, including:
• determining one or more requests as suspicious that are provided to a server in a monitored network based on one or more characteristics of the one or more provided requests, wherein correlation information is determined for the one or more suspicious requests;
• employing one or more characteristics of one or more dependent actions performed by the server to provide other correlation information for the one or more dependent actions, wherein the one or more dependent actions are evaluated for association with anomalous activity based on the correlation information and the other correlation information, wherein the anomalous activity comprises, an injection attack based on malformed information included in the one or more suspicious requests that is associated with one or more malformed shell instruction, malformed command instruction, or malformed inter-process communication associated with the one or more dependent actions;
• determining the other malformed information that is included in the one or more dependent actions based on an association with the malformed information that is included in the one or more suspicious request;
• employing one or more characteristics of the one or more suspicious requests to provide one or more correlations associated with the one or more suspicious requests;
• providing the evaluation of the one or more dependent actions for anomalous activity based on the one or more correlations associated with the one or more suspicious requests;
• and
• providing one or more reports that include information associated with the anomalous activity by the server and the one or more other servers in the monitored network.