US 2018/0026993 A1 · DIFFERENTIAL MALWARE DETECTION USING NETWORK AND ENDPOINT SENSORS

Abstract

A method is disclosed in which a system compares a first set of reports characterizing network traffic flows originating from an endpoint device with a second set of reports characterizing network traffic flows originating from the endpoint device and stored at an external network device to determine whether the first set and second set of reports characterizing network traffic flows originating from an endpoint device are different. In response to determining that the first and second reports characterizing network traffic flows are different, the system identifies the network traffic flows originating from the endpoint device and reported by an external network device, but not reported by the endpoint device, as possibly indicative of malware and forwards the network traffic flows originating from the endpoint device to an analyzer for further processing. Thus, an observed difference between network traffic flows originating from an endpoint device and stored at the endpoint device and network traffic flows originating from the endpoint device and stored on an external network device are compared to detect the presence of malware residing on the endpoint device.

Claims20

Dependent claims

A method comprising:

receiving from a host device a first set of one or more reports summarizing network traffic flows originating from the host device;
receiving from one or more network devices in communication with the host device at least a second set of one or more reports summarizing network traffic flows originating from the host device;
comparing the first set of one or more reports summarizing network traffic flows received from the host device with the at least the second set of one or more reports summarizing network traffic flows received from the one or more network devices;
and
based on the comparing, determining whether unauthorized software is present on the host device.

2 more elements

An apparatus, comprising:

a network interface unit that enables network communications;
and
a processor, coupled to the network interface unit, and configured to:
receive from a host device a first set of one or more reports summarizing network traffic flows originating from the host device;
receive from one or more network devices in communication with the host device at least a second set of one or more reports summarizing network traffic flows originating from the host device;
compare the first set of one or more reports summarizing network traffic flows received from the host device with the at least second set of one or more reports summarizing network traffic flows received from the one or more network devices;
and
based on the comparing, determine whether unauthorized software is present on the host device.

5 more elements

A non-transitory processor readable medium storing instructions that, when executed by a processor, cause the processor to:

receive from a host device a first set of one or more reports summarizing network traffic flows originating from the host device;
receive from one or more network devices in communication with the host device at least a second set of one or more reports summarizing network traffic flows originating from the host device;
compare the first set of one or more reports summarizing network traffic flows received from the host device with the at least second set of one or more reports summarizing network traffic flows received from the one or more network devices;
and
based on the comparing, determine whether unauthorized software is present on the host device.

2 more elements

Dependencies are inferred from the claim text.

Differential malware detection using network and endpoint sensors

Life of this patent

Differential malware detection using network and endpoint sensors

Life of this patent

Abstract

Claims20