US 2017/0013000 A1 · PROFILING FOR MALICIOUS ENCRYPTED NETWORK TRAFFIC IDENTIFICATION

Abstract

A malicious encrypted traffic detector connected to a computer network method for identifying malicious encrypted network traffic communicated via a computer network, the method comprising: a storage storing a plurality of network traffic window definitions, each window defining a different subset of network traffic for a network connection; an analyzer adapted to identify characteristics of a network connection to determine a protocol of a network connection; a network traffic recorder adapted to record a subset of network traffic corresponding to a window of network traffic; an entropy estimator adapted to evaluate an estimated measure of entropy for a portion of network traffic of a network connection recorded by the network traffic recorder; and a window selector adapted to identify and store a window as a portion of a network connection for which an estimated measure of entropy is most similar for a plurality of network connections, the identified window being stored in association with an identifier of a protocol determined by the analyzer and in association with an identifier of a malicious software component establishing the network connections for communication of malicious encrypted network traffic.

Claims29

Dependent claims

A method for identifying malicious encrypted network traffic communicated via a computer network, the method comprising:

defining a plurality of windows of network traffic, each window defining a different subset of network traffic for a network connection;
identifying characteristics of at least two network connections established by a malicious software component, the network connections being configured to communicate encrypted traffic, the characteristics determining a protocol of the network connections;
recording, for each established network connection, a subset of network traffic corresponding to each of the plurality of windows of network traffic;
evaluating, for each recorded subset of network traffic, an estimated measure of entropy for the set;
identifying a window for which an estimated measure of entropy is most similar for all network connections;
and
storing, in a data store, the identified window as a portion of a network connection in association with an identifier of the protocol and in association with an identifier of the malicious software component for use in identifying malicious encrypted network traffic communicated via the computer network.

4 more elements

A malicious encrypted traffic detector connected to a computer network method for identifying malicious encrypted network traffic communicated via a computer network, the method comprising:

a storage storing a plurality of network traffic window definitions, each window defining a different subset of network traffic for a network connection;
an analyzer identifying characteristics of a network connection to determine a protocol of a network connection;
a network traffic recorder recording a subset of network traffic corresponding to a window of network traffic;
an entropy estimator evaluating an estimated measure of entropy for a portion of network traffic of a network connection recorded by the network traffic recorder;
and
a window selector identifying and storing a window as a portion of a network connection for which an estimated measure of entropy is most similar for a plurality of network connections, the identified window being stored in association with an identifier of a protocol determined by the analyzer and in association with an identifier of a malicious software component establishing the network connections for communication of malicious encrypted network traffic.

3 more elements

Dependencies are inferred from the claim text.

Profiling for malicious encrypted network traffic identification

Life of this patent

Profiling for malicious encrypted network traffic identification

Life of this patent

Abstract

Claims29