# US 2018/0026993 A1 · Differential malware detection using network and endpoint sensors > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0026993 A1 - Document ID: US20180026993A1 - Status: Published application - Kind: A1 - Application number: 15/214,905 - Filed: 2016-07-20 - Published: 2018-01-25 - Earliest claimed: 2016-07-20 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Vincent E. Parla; Andrey Zawadowskiy; Donovan O'Hara - Web page: https://patentgrep.com/patent/US20180026993A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method is disclosed in which a system compares a first set of reports characterizing network traffic flows originating from an endpoint device with a second set of reports characterizing network traffic flows originating from the endpoint device and stored at an external network device to determine whether the first set and second set of reports characterizing network traffic flows originating from an endpoint device are different. In response to determining that the first and second reports characterizing network traffic flows are different, the system identifies the network traffic flows originating from the endpoint device and reported by an external network device, but not reported by the endpoint device, as possibly indicative of malware and forwards the network traffic flows originating from the endpoint device to an analyzer for further processing. Thus, an observed difference between network traffic flows originating from an endpoint device and stored at the endpoint device and network traffic flows originating from the endpoint device and stored on an external network device are compared to detect the presence of malware residing on the endpoint device. ## Claims ### Claim 1 A method comprising: receiving from a host device a first set of one or more reports summarizing network traffic flows originating from the host device; receiving from one or more network devices in communication with the host device at least a second set of one or more reports summarizing network traffic flows originating from the host device; comparing the first set of one or more reports summarizing network traffic flows received from the host device with the at least the second set of one or more reports summarizing network traffic flows received from the one or more network devices; and based on the comparing, determining whether unauthorized software is present on the host device. ### Claim 2 (depends on 1) The method of claim 1, wherein the at least second set of one or more reports summarizing network traffic flows received from the one or more network devices is collected at the one or more network devices. ### Claim 3 (depends on 1) The method of claim 1, wherein comparing the first set of one or more reports summarizing network traffic flows received from the host device with the at least second set of one or more reports summarizing network traffic flows received from the one or more network devices further comprises: determining a difference set of one or more network traffic flows originating from the host device, wherein the difference set of one or more network traffic flows comprises network traffic flows originating from the host device and summarized in the second set of one or more reports received from the one or more network devices but not summarized in the first set of one or more reports received from the host device. ### Claim 4 (depends on 3) The method of claim 3, wherein determining whether unauthorized software is present on the host device further comprises: classifying the difference set of one or more network traffic flows originating from the host device into one or more related groups of at least one network traffic flow based on identifying information; and analyzing the one or more related groups of at least one network traffic flow to determine whether the one or more related groups of at least one network traffic flow originated from unauthorized software located on the host device. ### Claim 5 (depends on 4) The method of claim 4, wherein the identifying information comprises one or more fields in an Internet Protocol (IP) Flow Information Export (“IPFIX”) data packet. ### Claim 6 (depends on 4) The method of claim 4, wherein analyzing the one or more related groups of at least one network traffic flow to determine whether the one or more related groups of at least one network traffic flow originated from unauthorized software located on the host device further comprises transmitting the one or more related groups of at least one network traffic flow to a network-connected entity for further processing. ### Claim 7 (depends on 6) The method of claim 6, wherein the further processing comprises comparing the at least one network traffic flow in the one or more related groups with at least one network traffic flow pattern indicative of unauthorized software. ### Claim 8 (depends on 1) The method of claim 1, wherein the one or more network traffic flows originating from the host device is an Internet Protocol (IP) packet flow. ### Claim 9 (depends on 1) The method of claim 1, wherein the one or more network devices includes a network device that is nearest, in number of hops, to the host device. ### Claim 10 (depends on 1) The method of claim 1, wherein the unauthorized software is malware or rootkit software. ### Claim 11 An apparatus, comprising: a network interface unit that enables network communications; and a processor, coupled to the network interface unit, and configured to: receive from a host device a first set of one or more reports summarizing network traffic flows originating from the host device; receive from one or more network devices in communication with the host device at least a second set of one or more reports summarizing network traffic flows originating from the host device; compare the first set of one or more reports summarizing network traffic flows received from the host device with the at least second set of one or more reports summarizing network traffic flows received from the one or more network devices; and based on the comparing, determine whether unauthorized software is present on the host device. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the at least second set of one or more reports summarizing network traffic flows received from the one or more network devices is collected at the one or more network devices. ### Claim 13 (depends on 11) The apparatus of claim 11, wherein the processor is configured to compare the first set of one or more reports summarizing network traffic flows received from the host device with the at least second set of one or more reports summarizing network traffic flows received from the one or more network devices by: determining a difference set of one or more network traffic flows originating from the host device, wherein the difference set of one or more network traffic flows originating from the host device comprises network traffic flows originating from the host device in the second set of one or more reports summarizing network traffic flows received from the one or more network devices but not in the first set of one or more reports summarizing network traffic flows received from the host device. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the processor is configured to determine whether unauthorized software is present on the host device by: classifying the difference set of one or network traffic flows originating from the host device into one or more related groups of at least one network traffic flow based on identifying information; and analyzing the one or more related groups of at least one network traffic flow to determine whether the one or more related groups of at least one network traffic flow originated from unauthorized software located on the host device. ### Claim 15 (depends on 14) The apparatus of claim 14, wherein the processor is further configured to transmit the one or more related groups of at least one network flow to a network-connected entity for further processing. ### Claim 16 A non-transitory processor readable medium storing instructions that, when executed by a processor, cause the processor to: receive from a host device a first set of one or more reports summarizing network traffic flows originating from the host device; receive from one or more network devices in communication with the host device at least a second set of one or more reports summarizing network traffic flows originating from the host device; compare the first set of one or more reports summarizing network traffic flows received from the host device with the at least second set of one or more reports summarizing network traffic flows received from the one or more network devices; and based on the comparing, determine whether unauthorized software is present on the host device. ### Claim 17 (depends on 16) The non-transitory processor readable medium of claim 16, wherein the at least second set of one or more reports summarizing network traffic flows received from the one or more network devices is collected at the one or more network devices. ### Claim 18 (depends on 16) The non-transitory processor readable medium of claim 16, wherein the instructions operable to compare the first set of one or more reports summarizing network traffic flows received from the host device with the at least second set of one or more reports summarizing network traffic flows received from the one or more network devices comprise instructions operable for: determining a difference set of one or more network traffic flows originating from the host device, wherein the difference set of one or more network traffic flows originating from the host device comprises network traffic flows originating from the host device in the second set of one or more network traffic flows received from the one or more network devices but not in the first set of one or more network traffic flows received from the host device. ### Claim 19 (depends on 18) The non-transitory processor readable medium of claim 18, wherein the instructions operable for determining whether unauthorized software is present on the host device further comprises: classifying the difference set of one or network traffic flows originating from the host device into one or more related groups of at least one network traffic flow based on identifying information; and analyzing the one or more related groups of at least one network traffic flow to determine whether the one or more related groups of at least one network traffic flow originated from unauthorized software located on the host device. ### Claim 20 (depends on 19) The non-transitory processor readable medium of claim 19, further comprising instructions operable to transmit the one or more related groups of at least one network traffic flow to a network-connected entity for further processing.