Cross protocol malware traffic detection using a two-layer ML architecture
AssigneePalo Alto Networks, Inc.
InventorsLei Xu, Taojie Wang, Shengming Xu
Life of this patent
Estimating the term…
Abstract
A system, method, and device for classifying traffic is disclosed. The method includes (i) correlating a plurality of network traffic sessions with same source indicators to obtain correlated network traffic, (ii) classifying the plurality of network traffic sessions based at least in part on a plurality of first-layer classifiers to obtain a set of first-layer classifications, wherein the plurality of first-layer classifiers are respectively associated with a plurality of protocols, and (iii) determining a second-layer classification for the correlated network traffic based at least in part on the set of first-layer classifications.
Claims25
A system for performing a multi-modal automated detection of malicious command and control traffic, comprising:
- one or more processors configured to:
- correlate a plurality of network traffic sessions across a plurality of different network protocols to obtain correlated network traffic wherein the correlation is based at least in part on matching a source IP address and a destination indicator, the destination indicator comprising a destination IP address or a domain name obtained protocol-specifically from one or more of a host name in an HTTP packet, a domain name in a DNS record, or a server name indicator (SNI) in SSL/TLS;
- classify the plurality of network traffic sessions based at least in part on a plurality of first-layer classifiers to obtain a set of first-layer classifications, wherein each of the plurality of first-layer classifiers are respectively associated with a different one of the plurality of different network protocols and configured to generate a first-layer classification comprising an indication of maliciousness for a corresponding session;
- and
- determine a second-layer classification for the correlated network traffic based at least in part on the set of first-layer classifications, wherein the second-layer classification comprises an aggregated indication of whether the correlated network traffic is malicious;
- and
- a memory coupled to the one or more processors and configured to provide the one or more processors with instructions.
A method for performing a multi-modal automated detection of malicious command and control traffic, comprising:
- correlating a plurality of network traffic sessions across a plurality of different network protocols to obtain correlated network traffic wherein the correlation is based at least in part on matching a source IP address and a destination indicator, the destination indicator comprising a destination IP address or a domain name obtained protocol-specifically from one or more of a host name in an HTTP packet, a domain name in a DNS record, or a server name indicator (SNI) in SSL/TLS;
- classifying the plurality of network traffic sessions based at least in part on a plurality of first-layer classifiers to obtain a set of first-layer classifications, wherein each of the plurality of first-layer classifiers are respectively associated with a different one of the plurality of different network protocols and configured to generate a first-layer classification comprising an indication of maliciousness for a corresponding session;
- and
- determining a second-layer classification for the correlated network traffic based at least in part on the set of first-layer classifications, wherein the second-layer classification comprises an aggregated indication of whether the correlated network traffic is malicious.
A computer program product embodied in a non-transitory computer readable medium for performing a multi-modal automated detection of malicious command and control traffic, and the computer program product comprising computer instructions for:
- correlating a plurality of network traffic sessions across a plurality of different network protocols to obtain correlated network traffic wherein the correlation is based at least in part on matching a source IP address and a destination indicator, the destination indicator comprising a destination IP address or a domain name obtained protocol-specifically from one or more of a host name in an HTTP packet, a domain name in a DNS record, or a server name indicator (SNI) in SSL/TLS;
- classifying the plurality of network traffic sessions based at least in part on a plurality of first-layer classifiers to obtain a set of first-layer classifications, wherein each of the plurality of first-layer classifiers are respectively associated with a different one of the plurality of different network protocols and configured to generate a first-layer classification comprising an indication of maliciousness for a corresponding session;
- and
- determining a second-layer classification for the correlated network traffic based at least in part on the set of first-layer classifications, wherein the second-layer classification comprises an aggregated indication of whether the correlated network traffic is malicious.
Dependencies are inferred from the claim text.