Malicious encrypted network traffic identification using fourier transform

Abstract

A method for identifying malicious encrypted network traffic communicated via a network between a first and second computer system, the method comprising: monitoring network traffic over the network to detect a network connection as a new network connection; identifying characteristics of the network connection to determine a protocol of the network connection; retrieving a definition of a portionof network traffic for a network connection based on the determined protocol; evaluating Fourier transform coefficient values for each of a plurality of bytes in a portion of network traffic of the new network connection based on the retrieved definition; and comparing the evaluated coefficient values with a dictionary of one or more reference sets of coefficients, each of the one or more reference sets of coefficients being associated with a portion of network traffic of a malicious encrypted network connection, so as to determine if malicious encrypted network traffic is communicated over the network connection.

Description

technical field [0001] The present invention relates to the detection of malicious network transmissions. In particular, the present invention relates to improved detection of malicious network traffic. Background technique [0002] Malware (also known as malicious computer code or malicious programs) is software intended to cause normal direct or indirect harm to one or more computer systems. Such harm may manifest itself as: disrupting or preventing the operation of all or part of a computer system; accessing private, sensitive, secure, and / or confidential data, software, and / or computing facility resources; or committing illegal, Illegal or Deceptive Practices. Malicious programs specifically include: computer viruses, worms, botnets, Trojan horses, spyware, adware, hacking programs, keyloggers, dialers, malicious browser extensions or plug-ins, and rogue security software. [0003] Malicious program proliferation can occur in many ways. Malicious programs can be deli...

AI Technical Summary

Problems solved by technology

[0010] Bestuzhev highlights that malicious programs can be sent in encrypted form, causing existing automatic malware detection systems to work incorrectly ((Bestuzhev, 2010, www.securelist.com / en / blog / 208193235 / Steganography_or_encryption_in_bankers, retrieved February 2014)

Such encrypted malware would also be undetectable by the methods of Olivain et al., which rely on the delivery of unscrambled (unencrypted) traffic for detection

Images