Monitoring for reverse-connection network activity to detect a remote-administration tool
AssigneeEMC IP Holding Company LLC
InventorAndreas Wittenstein
Life of this patent
Estimating the term…
Abstract
Techniques are disclosed for detecting malicious remote-administration tool (RAT) software by detecting reverse-connection communication activity. Communications are monitored over one or more persistent connections, such as TCP (Transmission Control Protocol) connections. Each monitored connection is between an initiator device and a follower device, and the initiator device is identified as the device that sent an initial packet to the follower device in order to open the connection. The disclosed techniques detect reverse-connection activity on the connection by detecting that communications over the connection are actually driven by the follower device, indicating that a malicious RAT is using the connection.
Claims22
A method of protecting a network from advanced persistent threats by detecting malicious remote-administration-tools, comprising executing, on at least one processor of a network monitor device located within the network, the steps of:
- monitoring, by the network monitor device, communications over a persistent connection traversing at least a portion of the network, the connection operable to carry packets between an initiator device and a follower device, the initiator device having sent a first packet to the follower device to open the connection, wherein the monitoring of the communications over the connection includes capturing each packet communicated between the initiator device and the follower device subsequent to the connection being opened;
- detecting, by the network monitor device, reverse-connection activity on the connection in response to the monitoring of the communications over the connection by, at least in part, detecting, responsive to packet data contained in each packet communicated between the initiator device and the follower device subsequent to the connection being opened, that the communications over the connection are driven by the follower device, wherein detecting reverse-connection activity on the connection indicates that the follower device is a client component of a malicious remote-administration-tool and that the initiator device is a server component of the malicious remote-administration-tool;
- and
- generating, by the network monitor device in response to detecting the reverse-connection activity on the connection, an output indicating that the malicious remote-administration-tool is using the connection.
A network monitor device for protecting a network from advanced persistent threats by detecting malicious remote-administration-tools, comprising:
- memory;
- and
- processing circuitry coupled to the memory, the memory storing program code which, when executed by the processing circuitry, causes the processing circuitry to:
- monitor communications over a persistent connection traversing at least a portion of the network, the connection operable to carry packets between an initiator device and a follower device, the initiator device having sent a first packet to the follower device to open the connection, wherein the network monitor monitors the communications over the connection at least in part by capturing each packet communicated between the initiator device and the follower device subsequent to the connection being opened;
- detect reverse-connection activity on the connection in response to the monitored communications over the connection by, at least in part, detecting, responsive to packet data contained in each packet communicated between the initiator device and the follower device subsequent to the connection being opened, that the communications over the connection are driven by the follower device, wherein detecting reverse-connection activity on the connection indicates that the follower device is a client component of a malicious remote-administration-tool and that the initiator device is a server component of the malicious remote-administration-tool;
- and
- generate, in response to detecting the reverse-connection activity on the connection, an output indicating that the malicious remote-administration-tool is using the connection.
A computer program product having a non-transitory computer readable medium which stores a set of instructions operable to protect a network from advanced persistent threats by detecting malicious remote-administration-tools, the set of instructions, when carried out by processing circuitry of a network monitor device located within the network, causing the processing circuitry to:
- monitor communications over a persistent connection traversing at least a portion of the network, the connection operable to carry packets between an initiator device and a follower device, the initiator device having sent a first packet to the follower device to open the connection, wherein the communications over the connection are monitored at least in part by capturing each packet communicated between the initiator device and the follower device subsequent to the connection being opened;
- detect reverse-connection activity on the connection in response to the monitored communications over the connection by, at least in part, detecting, responsive to packet data contained in each packet communicated between the initiator device and the follower device subsequent to the connection being opened, that the communications over the connection are driven by the follower device, wherein detecting reverse-connection activity on the connection indicates that the follower device is a client component of a malicious remote-administration-tool and that the initiator device is a server component of the malicious remote-administration-tool;
- and
- generate, in response to detecting the reverse-connection activity on the connection, an output indicating that the malicious remote-administration-tool is using the connection.
Dependencies are inferred from the claim text.