Device and method for detecting command and control channel
AssigneeNaru Security, Inc.
InventorHyukjoon KIM
Life of this patent
Estimating the term…
Abstract
A device for detecting a command and control channel includes: a session log collector for collecting log information of sessions generated between at least one communication device of the first network and at least one communication device of the second network; an analyzer for generating test data for respective sessions based on the log information, and calculating a test data distribution based on test data of the sessions; and a determiner for extracting a test data value corresponding to an abnormal distribution from the test data distribution based on an abnormal distribution determination standard, and estimating sessions relating to the extracted test data value as a command and control channel.
Claims16
A device for detecting a command and control channel as a device for detecting a command and control channel connected between a communication device of a first network and an attacker device of a second network, comprising:
- a session log collector for collecting log information of sessions generated between at least one communication device of the first network and at least one communication device of the second network;
- an analyzer for generating test data for respective sessions based on the log information, and calculating a test data distribution based on test data of the sessions;
- and
- a determiner for extracting a test data value corresponding to an abnormal distribution from the test data distribution based on an abnormal distribution determination standard, and estimating sessions relating to the extracted test data value as a command and control channel.
A method for detecting a command and control channel as a method for a command and control channel detecting device to detect a command and control channel connected between a communication device of a first network and an attacker device of a second network, comprising:
- generating test data for respective sessions based on log information of sessions generated between at least one communication device of the first network and at least one communication device of the second network;
- calculating a test data distribution based on test data of the sessions;
- extracting a test data value corresponding to an abnormal distribution from the test data distribution based on an abnormal distribution determination standard;
- and
- estimating sessions relating to the extracted test data value as a command and control channel.
A method for detecting a command and control channel as a method for a command and control channel detecting device to detect a command and control channel connected between a first communication device and a second communication device, comprising:
- allowing the first communication device to access the second communication device and collect log information of generated sessions;
- generating test data for respective sessions based on the log information;
- acquiring a test data distribution relating to a number of sessions for respective test data based on the test data of the sessions;
- determining whether there is a test data value with a number of sessions that is greater than a predetermined standard in the test data distribution;
- and
- estimating the second communication device as an attacker device when a test data value with a number of sessions that is greater than a predetermined standard is found.
Dependencies are inferred from the claim text.