Learned profiles for malicious encrypted network traffic identification

Abstract

A method for identifying malicious encrypted network traffic associated with a malware software component communicating via a network, the method comprising: defining, for the malware, a portion of network traffic including a plurality of contiguous bytes occurring at a predefined offset in a network communication of the malware; extracting the defined portion of network traffic for each of a plurality of disparate network connections for the malware; evaluating a metric for each byte in each extracted portion; representing each extracted portion in a matrix data structure as an image of pixels wherein each pixel corresponds to a byte of the extracted portion; training a neural network based on the images for the extracted portions such that subsequent network traffic can be classified bythe neural network to identify malicious network traffic associated with the malware based on an image generated to represent the defined portion of the subsequent network traffic.

Description

Technical field [0001] The invention relates to the detection of malicious network transmissions. Specifically, the present invention relates to improved malicious network traffic detection. Background technique [0002] Malicious software (also known as computer malicious code or malicious program) is software intended to harm one or more computer systems directly or indirectly. Such harm can be manifested as: the destruction or prevention of the operation of the entire or part of the computer system; access to private, sensitive, secure and / or confidential data, software and / or computing facility resources; or implementation of illegal, Illegal or deceptive behavior. Malicious programs specifically include: computer viruses, worms, botnets, Trojan horses, spyware, adware, hacker programs, keyloggers, dialers, malicious browser extensions or plug-ins, and rogue security software. [0003] The spread of malicious programs can occur in many ways. Malicious programs can be delive...

AI Technical Summary

Problems solved by technology

[0010] Bestuzhev highlights that malicious programs can be sent in encrypted form, causing existing automatic malware detection systems to work incorrectly ((Bestuzhev, 2010, www.securelist.com / en / blog / 208193235 / Steganography_or_encryption_in_bankers, retrieved February 2014)

Such encrypted malware would also be undetectable by the methods of Olivain et al., which rely on the delivery of unscrambled (unencrypted) traffic for detection

Images