US 12,641,103 B2Granted

Detecting bot and C2 activity via web application network traffic

AssigneePalo Alto Networks, Inc.

InventorsChristian Elihu Navarrete Discua, Yanhui Jia, Taojie Wang, Shengming Xu

Life of this patent

Estimating the term…

Loading patent…

Abstract

A service detects bot activity or malicious C2 activity based on data known to be associated with bot and C2 activity for supported web applications and that can be identified from network traffic corresponding to the web application for multiple communication protocols. Such data can include API endpoints known to be associated with C2 activity, malicious users/accounts associated with the web application, and malicious activity patterns. Whether the detection service can detect bot activity that may potentially correspond to C2 activity or malicious C2 activity itself is dependent on whether the obtained network traffic data are decrypted. When network traffic data are encrypted, detection service can detect bot activity by analyzing DNS and SSL/TLS traffic. When network traffic data are decrypted, the detection service can obtain the decrypted network traffic data comprising HTTP traffic and perform further analysis for detection of C2 activity reflected in HTTP traffic.

Claims20

Dependent claims

A method comprising:

obtaining network traffic data captured for a first device;
determining whether the network traffic data are decrypted;
based on determining that the network traffic data are associated with a first web application, evaluating subsets of the network traffic data based on corresponding ones of a plurality of rules defined for detecting at least one of bot activity and malicious command and control (C2) activity carried out via the first web application, wherein each of the plurality of rules corresponds to one of a plurality of communication protocols, and wherein the plurality of rules is determined based, at least in part, on whether the network traffic data are decrypted;
determining whether a first of the network traffic data indicate that the first device is affected by at least one of bot activity and malicious C2 activity carried out via the first web application based on determining whether the subsets of the network traffic data satisfy the corresponding ones of the plurality of rules;
and
based on determining that the first device is affected by the at least one of bot activity and malicious C2 activity, indicating that the first device is affected by the at least one of bot activity and malicious C2 activity carried out via the first web application.

3 more elements

One or more non-transitory machine-readable media having program code stored thereon, the program code comprising instructions to:

obtaining network traffic data captured for a first device;
determine whether network traffic data captured for a first device are decrypted;
based on a determination that the network traffic data correspond to a first web application, evaluate subsets of the network traffic data based on corresponding ones of a plurality of rules defined for detecting at least one of bot activity and malicious command and control (C2) activity carried out via the first web application, wherein each of the plurality of rules corresponds to one of a plurality of communication protocols, and wherein the plurality of rules is determined based, at least in part, on a determination of whether the network traffic data are decrypted;
determine whether a first of the network traffic data indicate that the first device is affected by at least one of bot activity and malicious C2 activity carried out via the first web application based on a determination of whether the subsets of the network traffic data satisfy the corresponding ones of the plurality of rules;
and
based on a determination that the first device is affected by the at least one of bot activity and malicious C2 activity, indicate that the first device is affected by the at least one of bot activity and malicious C2 activity carried out via the first web application.

3 more elements

An apparatus comprising:

a processor;
and
a machine-readable medium having instructions stored thereon that are executed by the processor to cause the apparatus to:
obtain network traffic data captured for a first device for a first web application, wherein the network traffic data correspond to a plurality of communication protocols;
analyze the network traffic data for evidence of bot activity based on first rules defined for detection of bot activity carried out via the first web application and a first set of communication protocols to which the network traffic data correspond;
based on a determination that the network traffic data comprise decrypted network traffic data,
analyze the network traffic data for evidence of malicious command-and-control (C2) activity based on second rules defined for detection of malicious C2 activity carried out via the first web application and a second set of communication protocols to which the network traffic data correspond;
and
indicate that the first device is affected by at least one of bot activity and malicious C2 activity carried out via the first web application based on results of analysis of the network traffic data.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/592,426Filed 29 Feb 2024
Published: US 2025/0280017 A14 Sep 2025
Granted: 26 May 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04L 63/0236
Filtering policies: filtering by address, protocol, port number or service, e.g. IP-address or URL
H04L 63/1408
For detecting or protecting against malicious traffic: by monitoring network traffic
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection