Bind shell attack detection

A method, comprising:

• collecting data packets transmitted between multiple entities over a network;
• grouping the packets at least according to their source and destination entities and their times, into connections to which the packets belong;
• identifying pairs of the connections having identical source and destination entities and times that are together within a specified time window, wherein each given pair of connections comprises first and second connections;
• generating sets of features from header information in the packets of the identified pairs of the connections, each set of features for a given pair comprising first features of the first connection in the given pair and second features of the second connection in the given pair;
• evaluating, by a processor, the features in the pairs in order to detect at least one pair of the connections whose first and second features differ, thereby indicating a bind shell attack;
• and
• generating an alert for the bind shell attack,
• wherein evaluating the features comprises determining a baseline of the features, and comparing the features in the pairs of connections to the baseline of the features.

A computer software product, the product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:

• to collect data packets transmitted between multiple entities over a network;
• to group the packets at least according to their source and destination entities and their times, into connections to which the packets belong;
• to identify pairs of the connections having identical source and destination entities and times that are together within a specified time window, wherein each given pair of connections comprises first and second connections;
• to generate sets of features comprising port numbers from header information in the packets of the identified pairs of the connections, each set of features for a given pair comprising first features of the first connection in the given pair and second features of the second connection in the given pair;
• to evaluate by a processor, the features in the pairs, including the port numbers, in order to detect at least one pair of the connections whose first and second features differ, thereby indicating a bind shell attack;
• and
• to generate an alert for the bind shell attack.

A method, comprising:

• collecting data packets transmitted between multiple entities over a network;
• grouping the packets at least according to their source and destination entities and their times, into connections to which the packets belong;
• identifying pairs of the connections having identical source and destination entities and times that are together within a specified time window, wherein each given pair of connections comprises first and second connections;
• identifying respective start and end times of the first and second connections in the identified pairs;
• comparing, by a processor, the end time of the first connection in a given pair to the start time of the second connection in the given pair in order to detect a bind shell attack;
• and
• generating an alert for the bind shell attack.

A method, comprising:

• collecting data packets transmitted between multiple entities over a network;
• grouping the packets at least according to their source and destination entities and their times, into connections to which the packets belong;
• identifying pairs of the connections having identical source and destination entities and times that are together within a specified time window, wherein each given pair of connections comprises first and second connections;
• generating sets of features from respective reverse volumes in the identified pairs of the connections;
• evaluating, by a processor, the features in the pairs in order to detect a given pair of connections indicating a bind shell attack;
• and
• generating an alert for the bind shell attack.