Cloud Traffic Classifier for Malicious C2 Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting and blocking malicious command and control (C2) traffic between cloud resources and malware on an infected host is challenging due to the impracticality of traditional blocking methods like DNS or IP-address blocking, as organizations rely on sanctioned cloud services, necessitating a system to differentiate between benign and malicious cloud traffic without excessive false positives or negatives.
Innovation Solution
A network security system (NSS) intercepts and analyzes cloud traffic using a classifier to identify C2 traffic by extracting features such as beaconing behavior, anomalous entities, and authentication patterns, classifying traffic as malicious, and blocking further communication to malicious resources while permitting benign traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional blocking methods like DNS or IP-address blocking are used to block malicious C2 traffic, then malicious traffic blocking effectiveness is improved, but false positives increase and legitimate cloud services are disrupted
Solution Approach 1:
The patent segments cloud traffic into multiple feature dimensions (beaconing behavior, anomalous entities, authentication patterns, data transfer characteristics) and evaluates each segment independently through a trained classifier. This segmentation allows the system to identify malicious traffic based on specific suspicious patterns without blocking entire cloud services, thereby reducing false positives while maintaining blocking effectiveness.
Solution Approach 2:
The patent changes the detection parameters from traditional broad-based DNS/IP blocking to multiple specific traffic features including beaconing intervals, entity anomaly scores, authentication failure rates, and data transfer patterns. The trained classifier dynamically adjusts parameter thresholds to distinguish malicious from legitimate traffic, reducing false positives while maintaining high detection accuracy.
2Object-affected harmful factors
If a classifier-based system is implemented to differentiate malicious from benign cloud traffic, then false positives are reduced, but system complexity increases
Solution Approach 1:
The patent implements preliminary action by pre-training the classifier offline using labeled datasets of malicious and benign cloud traffic. The training process extracts and analyzes multiple traffic features to build a robust classification model before deployment. This preliminary training reduces online computational complexity while maintaining high accuracy in distinguishing malicious from legitimate traffic.
Solution Approach 2:
The patent uses copying by creating synthetic training data that replicates various attack patterns and legitimate traffic scenarios. These copied examples are used to train the classifier, enabling it to recognize patterns without requiring extensive real-world malicious traffic samples, thereby simplifying the system while improving detection capability.
3Measurement precision
If multiple traffic features are analyzed to improve detection accuracy, then detection precision is improved, but processing time increases
Solution Approach 1:
The patent applies partial action by selectively analyzing the most discriminative traffic features for each connection based on preliminary heuristics. Rather than fully processing all possible features for every packet, the system identifies and focuses on key features (such as beaconing intervals or authentication patterns) that provide the highest detection value, reducing processing time while maintaining high detection accuracy.
Data Source
AI summary
The technology disclosed relates to a method, system, and non-transitory computer-readable media that trains a cloud traffic classifier to classify cross-application communications as malicious command and control (C2) traffic or benign cloud traffic. The training uses blocks of malicious Hypertext Transfer Protocol (HTTP) transactions targeted at a plurality of cloud applications by a plurality of clients prequalified as malicious command and control (C2) cloud traffic, and also blocks of benign HTTP transactions targeted at the plurality of cloud applications by the plurality of clients prequalified as benign cloud traffic. A cloud traffic classifier is trained on the cross-application malicious training example set and on the cross-application benign training example set by processing the blocks of the malicious and benign HTTP transactions as inputs, and generating outputs that classify the training examples as respectively malicious C2 cloud traffic or benign cloud traffic.