Malicious C&C channel to fixed IP detection using ping packets

An apparatus for protecting a computer system against malicious command and control (C&C) channels to fixed Internet Protocol (IP) addresses, the apparatus comprising:

• a network interface controller (NIC);
• and
• at least one hardware processor configured:
• to collect information extracted from data traffic transmitted between multiple local nodes on a private data network and public IP addresses outside the private data network;
• to identify ping packets in the data traffic transmitted from one or more of the local nodes to a subset of the public IP addresses;
• to detect in the collected information a suspicious pattern of outgoing data packets transmitted from at least one of the local nodes and addressed to a given public IP address;
• to check whether the given public IP address belongs to the identified subset;
• and
• to initiate a protective action with respect to the suspicious pattern upon ascertaining that the given public IP address does not belong to the identified subset.

A computer software product for protecting a computing system against malicious command and control (C&C) channels to fixed Internet Protocol (IP) addresses, the product comprising a non-transitory computer-readable medium storing program instructions, when read by a computer, cause the computer:

• to collect information extracted from data traffic transmitted between multiple local nodes on a private data network and public IP addresses outside the private data network;
• to identify ping packets in the data traffic transmitted from one or more of the local nodes to a subset of the public IP addresses;
• to detect in the collected information a suspicious pattern of outgoing data packets transmitted from at least one of the local nodes and addressed to a given public IP address;
• to check whether the given public IP address belongs to the identified subset;
• and
• to initiate a protective action with respect to the suspicious pattern upon ascertaining that the given public IP address does not belong to the identified subset.