Malware and exploit campaign detection system and method

Abstract

A malware and exploit campaign detection system and method are provided that cannot be detected by the malware or exploit campaign. The system may provide threat feed data to the vendors that produce in-line network security and end point protection (anti virus) technologies. The system may also be used as a testing platform for 3rd party products. Due to the massive footprint of the system's cloud infrastructure and disparate network connections and geo-location obfuscation techniques, NSS can locate and monitor malware across the globe and provide detailed threat analysis for each specific region, as they often support and host different malware / cybercrime campaigns.

Description

PRIORITY CLAIMS / RELATED APPLICATIONS[0001]This application claims priority under 35 USC 120 and is a continuation in part of U.S. patent application Ser. No. 14 / 482,696, filed Sep. 10, 2014 and titled “MALWARE AND EXPLOIT CAMPAIGN DETECTION SYSTEM AND METHOD” that in turn claims priority under 35 USC 120 and the benefit under 35 USC 119(e) to U.S. Provisional Patent Application Ser. No. 61 / 876,704 filed Sep. 11, 2013 and entitled “Malware And Exploit Campaign Detection System And Method”, the entirety of both of which are incorporated herein by reference.BACKGROUND[0002]Intrinsically modern drive-by-exploitation and malware campaigns are growing in sophistication related to obfuscation, deployment, and execution in an effort to avoid detection and analysis by security researchers, and modern security systems and software. Anti-virus (AV) systems, such as endpoint protection platforms (EPPs), as well as breach detection services (BDS) employ virtual “sandboxes” or “honey nets” that o...

AI Technical Summary

Benefits of technology

[0006]In one implementation, BaitNET is the conglomerate of a number of software applications, processes, and innovations as outlined herein which afford BaitNET the ability to shim into the operating system and the virtual machine architecture (both guest and host) enabling BaitNET to obfuscate the fact that the machine itself is a virtual / unmanned computer. The system utilizes a multitude of virtual private networks (VPNs) allowing a near-unlimited number of unique Internet IP addresses from all across the world to be used. These disparate IP addresses afford two primary advantages to BaitNET. One, in order to force re-infection, as many malware system will not “drop” (deploy) malware to the same IP address more than once, it is necessary to have BaitNET obfuscate its Internet presence. Two, many malware campaigns limit their targets by geo-location, which is often tracked via IP Address. E.g., Malware-infected servers often limit themselves to only infecting one (1) computer from any given masked IP address, and may limit the country of origin of the IP addresses that they will infect. BaitNET utilizes VPNs throughout the world to mimic dispersed geo-location and map out malware campaigns in different regions. Other techniques, while not proprietary to BaitNET, may also be used to emulate potential target qualification data points such as varying the language pack and keyboard language configuration on the host operating system.

[0009]Due to the transparency of BaitNET to the exploit and any malware it drops, BaitNET is able to perform live analysis that that can track threat actors and fully enumerate their capabilities (i.e. which exploit kits they are using, which specific exploits are employed, which applications are being targeted, and full details of the exploits themselves). BaitNET therefore produces accurate predictions of which applications are being targeted in current campaigns by threat actors, providing predictive threat analysis AHEAD of any breach.

[0013]BaitNET provides a malware and exploit campaign detection system and method that cannot be detected by the malware or exploit campaign. The system may provide threat feed data to the vendors that produce in-line network security and endpoint protection technologies. The system may also be used as a testing platform for 3rd party products. Due to the massive footprint of the system's cloud infrastructure and disparate network connections and geolocation obfuscation techniques, NSS can locate and monitor malware across the globe and provide detailed threat analysis for each specific region, as they often support and host different malware / cybercrime campaigns.

Problems solved by technology

Two, many malware campaigns limit their targets by geo-location, which is often tracked via IP Address. E.g., Malware-infected servers often limit themselves to only infecting one (1) computer from any given masked IP address, and may limit the country of origin of the IP addresses that they will infect.

Images