Image visualization based method to detect cobaltstrike beacon HTTP C2 communications
AssigneePalo Alto Networks, Inc.
InventorsAjaya Neupane, Yu Fu, Mei Wang, Anand Oswal
Life of this patent
Estimating the term…
Abstract
A system, method, and device for detecting Command and Control (C2) traffic is disclosed. The method includes (i) converting a monitored traffic sample to an image representation, (ii) querying a classifier based at least in part on the image representation to obtain a traffic classification, (iii) automatically detecting C2 traffic based at least in part on the traffic classification, and (iv) handling the network traffic based at least in part on the traffic classification.
Claims24
A system for detecting Command and Control (C2) traffic, comprising:
- one or more processors configured to:
- convert a monitored traffic sample to an image representation;
- query a classifier based at least in part on the image representation to obtain a traffic classification;
- automatically detect C2 traffic based at least in part on the traffic classification;
- and
- handle network traffic based at least in part on the traffic classification;
- and
- a memory coupled to the one or more processors and configured to provide the one or more processors with instructions.
A method for detecting Command and Control (C2) traffic, comprising:
- converting, by one or more processors, a monitored traffic sample to an image representation;
- querying a classifier based at least in part on the image representation to obtain a traffic classification;
- automatically detecting C2 traffic based at least in part on the traffic classification;
- and
- handling network traffic based at least in part on the traffic classification.
A computer program product embodied in a non-transitory computer readable medium for detecting Command and Control (C2) traffic, and the computer program product comprising computer instructions for:
- converting, by one or more processors, a monitored traffic sample to an image representation;
- querying a classifier based at least in part on the image representation to obtain a traffic classification;
- automatically detecting C2 traffic based at least in part on the traffic classification;
- and
- handling network traffic based at least in part on the traffic classification.
Dependencies are inferred from the claim text.