Detecting Malicious C&C Channels via Ping Packet Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security systems struggle to effectively detect malicious command and control (C&C) channels to fixed Internet Protocol (IP) addresses, which are often used by malware to communicate with attackers.
Innovation Solution
A method that involves collecting data traffic information between local nodes on a private network and public IP addresses, detecting Domain Name System (DNS) resolutions and transmissions, comparing these to identify unsolved transmissions, and initiating protective actions for suspicious communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security systems use basic anti-virus software and intrusion detection systems, then basic security coverage is provided, but detection capability for malicious C&C channels to fixed IP addresses remains insufficient
Solution Approach 1:
The system performs preliminary DNS resolution detection before allowing network transmissions. By checking whether a local node has previously resolved a domain name to the target public IP address, the system can identify suspicious direct connections to fixed IPs that bypass normal DNS resolution, enabling early detection of potential C&C channels before full communication occurs
Solution Approach 2:
The system introduces DNS resolution verification as an intermediary step between local nodes and public IP addresses. This intermediary mechanism checks the legitimacy of the connection by verifying whether the IP address was obtained through proper DNS resolution, thereby mediating the detection of malicious direct connections without blocking legitimate traffic
2Reliability
If the system blocks all transmissions to public IP addresses not resolved through DNS, then malicious C&C channels are detected, but legitimate network traffic may be incorrectly blocked
Solution Approach 1:
The system applies different detection criteria to different types of network traffic. By examining the specific characteristics of each transmission (such as whether it uses ICMP ping, the pattern of connections, and the context of the communication), the system can distinguish between legitimate traffic that happens to connect to fixed IPs and actual malicious C&C channels, applying selective blocking rather than blanket prevention
Solution Approach 2:
The system continuously monitors network traffic patterns and uses this feedback to refine its detection accuracy. By analyzing the behavior of local nodes over time and comparing it against known legitimate communication patterns, the system can adjust its blocking decisions to reduce false positives while maintaining high detection accuracy for actual threats
Data Source
AI summary
A method for protecting a computer system against malicious channels to fixed Internet Protocol (IP) addresses. The method includes collecting, by a processor, information extracted from data traffic transmitted between multiple local nodes on a private data network and public IP addresses outside the private data network. Ping packets are identified in the data traffic transmitted from one or more of the local nodes to a subset of the public IP addresses. A suspicious pattern of outgoing data packets transmitted from at least one of the local nodes and addressed to a given public IP address is detected in the collected information. The given public IP address is checked as to whether it belongs to the identified subset. A protective action is initiated with respect to the suspicious pattern upon ascertaining that the given public IP address does not belong to the identified subset.