Method and system for detecting and reducing botnet activity
AssigneeIntel Corporation
InventorsJaideep Chandrashekar, Eve M. Schooler, Nina Taft, Frederic Giroire
Life of this patent
Estimating the term…
Abstract
A method and system for detecting and reducing botnet activity includes tracking the number of connections to a destination address over predetermined periods of time. A persistence value is assigned to the destination address based on the number of time periods during which the destination address was connected. The persistence value is compared to a threshold value and an alert is generated if the persistence value is greater than the threshold value. Known safe destinations may be entered into a whitelist.
Claims20
A method comprising:
- receiving a request to communicate with a remote computer identified by a destination address;
- comparing the destination address of the remote computer to a list of known safe destination addresses stored on a computing device;
- updating a first persistence value associated with the destination address if the destination address does not match an entry in the list of known safe destinations, the first persistence value being indicative of the regularity at which the computing device communicates with the remote computer identified by the destination address;
- comparing the updated first persistence value to a predetermined threshold value;
- and
- generating an alert on the computing device if the updated first persistence value is greater than the threshold value.
A machine readable medium comprising a plurality of instructions, that in response to being executed, result in a computing device:
- comparing a destination address identifying a remote computer to a list of known safe destination addresses stored on a computing device;
- determining a length of a first time period and a length of a second time period, the first time period including a plurality of the second time periods,
- updating a persistence value associated with the destination address if the destination address does not match an entry in the list of known safe destinations, the persistence value being equal to a ratio of the number of second time periods during which the computing device connected to the destination address at least once over the total number of second time periods of the first time period;
- and
- generating an alert if the updated persistence value is greater than a threshold value.
A computing device comprising:
- a processor;
- and
- a memory device having stored therein a plurality of instructions, which when executed by the processor, cause the processor to:
- compare a destination address of a remote computer to a list of known safe destination addresses stored on a computing device;
- update a persistence value associated with the destination address if the destination address does not match an entry in the list of known safe destinations, the persistence value being indicative of the regularity at which the computing device communicates with the remote computer identified by the destination address;
- and
- generate an alert if the updated persistence value is greater than a predetermined threshold value.
Dependencies are inferred from the claim text.