Cloud C2 Traffic Detection Using Behavioral Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting and blocking malicious command and control (C2) traffic between cloud resources and malware on an infected host is challenging due to the difficulty in distinguishing it from benign traffic without causing excessive false-positives or false-negatives, especially when traditional remedies like DNS or IP blocking are impractical for cloud service providers.
Innovation Solution
A network security system (NSS) intercepts and analyzes cloud traffic using a classifier to identify C2 traffic by extracting features such as beaconing behavior, anomalous entities, and authentication patterns, and blocks malicious traffic while allowing benign traffic to pass through.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional DNS or IP blocking is used to block malicious C2 traffic, then malicious traffic is blocked, but it causes excessive false-positives and false-negatives because cloud service providers cannot be blocked
Solution Approach 1:
The patent changes the detection parameters from static DNS/IP addresses to dynamic behavioral parameters including beaconing intervals, message size variations, traffic timing patterns, and protocol anomalies. This allows differentiation between malicious C2 traffic and legitimate cloud service traffic without blocking entire cloud providers
Solution Approach 2:
The patent introduces a cloud access security broker (CASB) as an intermediary that sits between the organization's network and cloud service providers. The CASB analyzes traffic patterns and applies blocking rules selectively to malicious communications while allowing legitimate cloud traffic to pass through unchanged
2Reliability
If cloud traffic is blocked to prevent C2 communication, then malicious traffic is stopped, but legitimate cloud service operations are disrupted
Solution Approach 1:
The patent applies different quality treatments to different portions of cloud traffic. Benign traffic receives normal processing and is allowed through, while traffic exhibiting malicious characteristics (beaconing patterns, anomalous timing, suspicious protocols) is subjected to inspection and blocking. This localized approach ensures security without disrupting overall cloud service productivity
3Measurement precision
If machine learning classifiers are used to detect C2 traffic, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent segments the traffic analysis system into distinct functional modules: a cloud access security broker for initial filtering, a machine learning classifier for pattern recognition, and a rule-based engine for protocol analysis. Each module handles specific aspects of traffic inspection, reducing overall system complexity while maintaining high detection accuracy
Data Source
AI summary
The technology disclosed relates to a method, system, and non-transitory computer-readable media that detects malicious communication between a command and control (C2) cloud resource on a cloud application and malware on an infected host, using a network security system. The network security system reroutes the cloud traffic to the network security system. The incoming requests of the cloud traffic are directed to a cloud application in the plurality of cloud applications, and wherein the cloud application has a plurality of resources. The network security system analyzes the incoming requests, determines that the incoming requests are targeted at one or more malicious resources in the plurality of resources. Also, the network security system prevents transmission of the incoming requests to the malicious resources, by making the malicious resources unavailable for receiving future incoming requests, while keeping other resources in the plurality of resources available for receiving the future incoming requests.