Abstract:
A method for detecting malicious programs within a computer network includes monitoring at least one first packet of data communicated over the network, analyzing the at least one first packet of data to detect the presence of a malicious program, generating a signature of the at least one first packet of data when a malicious program is detected, monitoring at least one second packet of data communicated over the network and detecting evidence of the malicious program in the at least one second packet of data utilizing the generated signature.

Description:
REFERENCE TO RELATED APPLICATIONS  
       [0001]     This application is based on and claims the benefit of Provisional Application Ser. No. 60/572,684 filed May 20, 2004, the entire contents of which are herein incorporated by reference. 
     
    
     BACKGROUND  
       [0002]     1. Technical Field  
         [0003]     The present disclosure relates to intrusion detection and, more specifically, to intrusion detection with automatic signature generation.  
         [0004]     2. Description of the Related Art  
         [0005]     In today&#39;s highly computer dependant environment, computer security is a major concern. The security of computer networks is routinely threatened by computer viruses, Trojan horses, worms and the like. Once computer networks are infected with these malicious programs, the malicious programs may have the ability to damage expensive computer hardware, destroy valuable data, tie up limited computing resources or compromise the security of sensitive information.  
         [0006]     Worms can be particularly catastrophic forms of malicious programs. Worms can infect a computer network and quickly commandeer network resources to aid in the worm&#39;s further propagation. After a worm has infected computers and computer networks a destructive payload can then be delivered. Destructive payloads can have many harmful consequences, for example, valuable hardware and/or data can be destroyed, sensitive information can be compromised and network security measures can be circumvented.  
         [0007]     As a result of quick propagation, new worms can travel fast and quickly become a threat to computers and computer networks around the world.  
         [0008]     To guard against the risk of malicious programs such as worms, businesses may often employ antivirus programs, intrusion detection systems and intrusion protection systems. Antivirus programs are computer programs that can scan computer systems to detect malicious computer code embedded within infected computer files. Malicious code can then be removed from infected files, the infected files may be quarantined or the infected file may be deleted from the computer system. Intrusion detection systems and intrusion protection systems (IDSs) are systems that can be implemented on a computer network that monitor the computer network to detect anomalous traffic that can be indicative of a potential problem, for example a worm infection. IDSs may be either active or passive. Active IDSs may take affirmative measures to remedy a potential infection when found while passive IDSs may be used to alert a network administrator of the potential problem.  
         [0009]     IDSs often attempt to identify the presence of network infection by analyzing packets of data that are communicated over the network. Packets are generally examined and compared with signatures of known malicious programs. When a signature matches a packet, the packet may be indicative of a malicious program infection.  
         [0010]     IDSs that rely on signatures for the detection of malicious programs must regularly receive and install updated signatures corresponding newly discovered malicious programs. If no signature has been received and installed for a particular malicious program, the IDS might not be able to identify the malicious program.  
         [0011]     Modern malicious programs such as worms are able to spread very quickly from computer network to computer network throughout the world. Unfortunately, they can spread so quickly that they can infect many networks before a signature for detecting the malicious program can be developed, distributed and installed.  
         [0012]     An IDS is needed that can detect the presence of previously unknown malicious programs and automatically generate an effective signature that can be used by the IDS to protect the network against the malicious program.  
       SUMMARY  
       [0013]     A method for detecting malicious programs within a computer network includes monitoring at least one first packet of data communicated over the network, analyzing the at least one first packet of data to detect the presence of a malicious program, generating a signature of the at least one first packet of data when a malicious program is detected, monitoring at least one second packet of data communicated over the network and detecting evidence of the malicious program in the at least one second packet of data utilizing the generated signature.  
         [0014]     A system for detecting malicious programs within a computer network includes a first-packet-monitoring unit for monitoring at least one first packet of data communicated over the network, an analyzing unit for analyzing the at least one first packet of data to detect the presence of a malicious program, a generating unit for generating a signature of the at least one first packet of data when a malicious program is detected, a second-packet-monitoring unit for monitoring at least one second packet of data communicated over the network and a detecting unit for detecting evidence of the malicious program in the at least one second packet of data utilizing the generated signature.  
         [0015]     A computer system includes a processor and a computer recording medium including computer executable code executable by the processor for detecting malicious programs within a computer network. The computer executable code includes code for monitoring at least one first packet of data communicated over the network, code for analyzing the at least one first packet of data to detect the presence of a malicious program, code for generating a signature of the at least one first packet of data when a malicious program is detected, code for monitoring at least one second packet of data communicated over the network and code for detecting evidence of the malicious program in the at least one second packet of data utilizing the generated signature.  
         [0016]     A computer recording medium includes computer executable code executable by a processor for detecting malicious programs within a computer network. The computer executable code includes code for monitoring at least one first packet of data communicated over the network, code for analyzing the at least one first packet of data to detect the presence of a malicious program, code for generating a signature of the at least one first packet of data when a malicious program is detected, code for monitoring at least one second packet of data communicated over the network and code for detecting evidence of the malicious program in the at least one second packet of data utilizing the generated signature.  
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0017]     A more complete appreciation of the present disclosure and many of the attendant advantages thereof will be readily obtained as the same becomes better understood by reference to the following detailed description when considered in connection with the accompanying drawings, wherein:  
         [0018]      FIG. 1  illustrates an example of an active IDS according to an embodiment of the present disclosure;  
         [0019]      FIG. 2  illustrates an example of a passive IDS according to an embodiments of the present disclosure;  
         [0020]      FIG. 3  illustrates the operation of an Agent for an active IDS according to an embodiment of the present disclosure;  
         [0021]      FIG. 4  illustrates the operation of an Agent for a passive IDS according to an embodiment of the present disclosure;  
         [0022]      FIG. 5  illustrates the operation of a Master according to an embodiment of the present disclosure;  
         [0023]      FIG. 6  illustrates the operation of a packet database  502  according to an embodiment of the present disclosure; and  
         [0024]      FIG. 7  illustrates an example of a computer system capable of implementing the method and apparatus of the present disclosure. 
     
    
     DETAILED DESCRIPTION  
       [0025]     In describing the preferred embodiments of the present disclosure illustrated in the drawings, specific terminology is employed for sake of clarity. However, the present disclosure is not intended to be limited to the specific terminology so selected, and it is to be understood that each specific element includes all technical equivalents which operate in a similar manner.  
         [0026]     The present disclosure enables an IDS to detect new and unknown malicious programs. According to embodiments of the present disclosure, the detection of new and unknown malicious programs can be facilitated by the automatic generation and implementation of new definitions.  
         [0027]     IDSs according to embodiments of the present disclosure may be either passive or active. An active IDS according to an embodiment of the present disclosure is able to detect a new and unknown malicious program and prevent that malicious program from propagating from one subnet of the computer network to another subnet and/or prevent that malicious program from propagating beyond the computer network, for example, to another computer network.  
         [0028]     Subnets are generally isolated segments of the computer network. Subnets are often connected to the backbone of the computer network through a network connecting device, for example a router, switch and/or hub.  
         [0029]     A passive IDS according to an embodiment of the present disclosure is able to detect a new and unknown malicious program and allow network administrators to become aware of the malicious program. Because passive IDSs according to some embodiments of the present disclosure generally do not attempt to directly block the propagation of malicious programs, packets can remain free to travel between subnets without first having to pass through an IDS control device.  
         [0030]      FIG. 1  illustrates an example of active IDSs according to an embodiment of the present disclosure. In this example, a plurality of network devices  101 - 105  form a first subnet. These network devices can be any devices that are connected to the network, for example, network devices can be computers connected to the network. A first Agent  116  connects the first subnet to the network backbone  119 . According to an embodiment of the present disclosure, an Agent is a unit that monitors the exchange of packets between the subnet and the network and communicates with the Master  120 . While there may be multiple Agents  116 - 118 , a single Master  120  is all that is generally required. Agents  116 - 118  may be dedicated network devices and/or Agents  116 - 118  may be computer programs executed on a network device, for example a computer connected to the network. According to an embodiment of the present disclosure, Agents  116 - 118  are placed in such a way that communication between the subnets and the rest of the computer network are through the Agents  116 - 118 .  
         [0031]     According to an embodiment of the present disclosure, Agents  116 - 118  act as firewalls to prevent certain packets from being passed across the Agent and thereby prevent those packets from being delivered to the destination addresses of those packets A second Agent  117  connects a second subnet formed by a plurality of network devices  106 - 110  to the network backbone  119  and a third Agent  118  connects a third subnet formed by a plurality of network devices  111 - 115  to the network backbone  119 .  
         [0032]     Agents  116 - 118  monitor packets that are communicated across the respective subnets and report packet information to the Master  120 . The Master  120  may be located anywhere within the computer network, for example, within one of the subnets, or may be located outside of the computer network, for example, on a remote server connected over the internet through a virtual private network (VPN).  
         [0033]     According to some embodiments of the present disclosure, Agents  116 - 118  may send sample packets to the Master  120 . Sample packets can be copies of packets that have traveled across the Agent  116 - 118 , for example, from the corresponding subnet to the backbone  119 . Sample packets may be selected at set intervals, for example, every 100 th  packet may be sent or a packet can be sent every second. Sample packets may be sent at random, for example, every packet may be given a 1 in 100 chance of being sent as a sample packet.  
         [0034]     The Master  120  analyzes the sample packets and may look for indications of a malicious program infection. For example, the Master  120  may analyze sample packets and watch for a proliferation of similar packets. Because malicious programs often generate many copies of themselves in an attempt to propagate, a large proliferation of similar packets may indicate the presence of a malicious program infection.  
         [0035]     When proliferation of similar packets is detected by the Master  120 , the Master  120  can generate a signature for the proliferating packets. A signature can represent certain characteristics by which a packet can be identified. For example, a signature may be a hash value of the packet. A hash value is generally a number that can be used to identify a packet. The hash value is generally determined by performing a mathematical algorithm on the data that makes up the packet in question. There are many algorithms for calculating a packet&#39;s hash value that are known in the art. Among these are the MD 5  and SHA algorithms. While there are theoretically many different possible packets that can all produce the same hash value, the chances of two different files having the same hash value are infinitesimal.  
         [0036]     The signature may then be sent to the Agents  116 - 118 . According to some embodiments of the present disclosure, Agents  116 - 118  can then block the proliferation of packets matching the signature sent to it by the Master  120  by preventing those packets from being delivered to the destination addresses of those packets. This can be accomplished, for example, by the Agent  116 - 118  analyzing every packet that attempts to be communicated between the subnet and the rest of the network before the packet may proceed across the Agent  116 - 118  and calculating the hash values for those packets to see if the hash values matches a signature hash value that has been sent to the Agent  116 - 118  by the Master  120 . Because calculating the hash value of every packet might be time consuming, Agents  116 - 118  need not calculate hash values of packets unless a signature has been sent to the Agent  116 - 118  from the Master  120 . Packets that match the signature may then be prevented from being transmitted across the Agent  116 - 118 . Agents  116 - 118  can also log the proliferation of packets matching the signature sent to it by the Master  120 .  
         [0037]     By logging the proliferation of packets corresponding to malicious programs, network administrators can be made aware of the threatened spread of the malicious program.  
         [0038]     By blocking the proliferation of packets corresponding to malicious programs, the spread of the malicious program from one subnet to another and/or from one computer network to another may be prevented. Additionally, blocking the proliferation of packets corresponding to malicious programs can prevent packets corresponding to malicious programs from flooding onto the backbone  119  and potentially consuming large allotments of backbone  119  bandwidth potentially resulting in a slowdown of the entire network.  
         [0039]      FIG. 2  illustrates an example of passive IDSs according to an embodiment of the present disclosure (passive embodiments of the present disclosure). In this example, a plurality of network devices  201 - 205  form a first subnet. A first router  216  connects the first subnet to the network backbone  219 . According to passive embodiments of the present disclosure, any network device may connect the subnets to the backbone  219 , alternatively, an Agent  220 - 222  may connect subnets to the network backbone  219  as is done in active embodiments of the present disclosure. According to passive embodiments of the present disclosure, Agents  220 - 222  monitor the exchange of packets throughout the subnet and communicate with the Master  223 . While there may be multiple Agents  220 - 222 , a single Master  223  is all that is generally required. Agents  220 - 222  may be dedicated network devices and/or Agents  220 - 222  may be computer programs executed on a network device, for example a computer connected to the network. Agents  220 - 222  may be placed at any locations within the subnet.  
         [0040]     A second router  217  connects a second subnet formed by a plurality of network devices  206 - 210  to the network backbone  219  and a third router  218  connects a third subnet formed by a plurality of network devices  211 - 215  to the network backbone  219 .  
         [0041]     Agents  220 - 222  may be able to monitor packets that are communicated across the respective subnets and report packet information to the Master  223 . The Master  223  may be located anywhere within the computer network, for example, within one of the subnets, or may be located outside of the computer network, for example, on a remote server connected over the internet through a virtual private network (VPN).  
         [0042]     According to some passive embodiments of the present disclosure, Agents  220 - 222  may send sample packets to the Master  223 .  
         [0043]     The Master  223  analyzes the sample packets and may look for indications of a malicious program infection. When proliferation of similar packets is detected by the Master  223 , the Master  223  can generate a signature for the proliferating packets. The signature may then be sent to the Agents  220 - 222 . According to passive embodiments of the present disclosure, Agents  220 - 222  can log the proliferation of packets matching the signature sent to it by the Master  223 .  
         [0044]     By logging the proliferation of packets corresponding to malicious programs, network administrators can identify and take steps to correct the spread of the malicious program.  
         [0045]      FIG. 3  illustrates the operation of an Agent  116 - 118  for an active IDS according to embodiments of the present disclosure.  
         [0046]     Packets enter the Agent  116 - 118  through the signature matching unit  301 . New signatures enter the Agent  116 - 118  through the signatures database  302 . If there are signatures located within the signature database  302  then the signature matching unit  301  compares the incoming packet with the signatures within the signature database  301 . If the packet matches a signature, then the match may be logged in the log database  305 . Packets that match may be prevented from being output. If the packet does not match, or there are no signatures in the signature database  302 , the packet enters the random selection unit  303 . If the packet is selected to be a sample packet, the packet may be sent to the Master  120 . Regardless of whether the packet is selected to be a sample packet, the packet may be output. Where the Agent  116 - 118  is examining packets sent from the subnet to the rest of the network, the packets may be input from the subnet to the signature matching unit  301  and output from the random packet selection unit  303  to the rest of the network. Where the Agent  116 - 118  is examining packets sent from the rest of the network to the subnet, the packets may be input from the rest of the network to the signature matching unit  301  and output from the random packet selection unit  303  to the subnet.  
         [0047]     According to another active embodiment of the present disclosure, additional signatures may be supplied to the signature database  302  from external sources, for example, from signature updates created and distributed by the IDS vender. For these embodiments, it is possible to more easily protect networks against known malicious programs.  
         [0048]      FIG. 4  illustrates the operation of an Agent  220 - 222  for a passive IDS according to embodiments of the present disclosure.  
         [0049]     According to some passive embodiments, packets that enter the Agent  220 - 222  are allowed to pass out of the Agent  220 - 222  and on to their designated recipient address. A copy of each packet that passes through the Agent  220 - 222  may be sent to the signature matching unit  401 . New signatures enter the Agent  220 - 222  through the signatures database  402 . If there are signatures located within the signature database  402  then the signature matching unit  401  can compare the incoming packet with the signatures within the signature database  402 . If the packet matches a signature, then the match may be logged in the log database  405 . If the packet does not match, or there are no signatures in the signature database  402 , the packet may enter the random selection unit  403 . If the packet is selected to be a sample packet, the packet may be sent to the Master  223 .  
         [0050]     According to another passive embodiment of the present disclosure, additional signatures may be supplied to the signature database  402  from external sources, for example, from signature updates created and distributed by the IDS vender.  
         [0051]      FIG. 5  illustrates the operation of a Master  120 ,  223  according to embodiments of the present disclosure. Selected sample packets may be received from the Agents  116 - 118 ,  220 - 222 . The source address of the packet may be added to the agent address database  501 . This allows the Master  120 ,  223  to keep track of the Agents  116 - 118 ,  220 - 222  that send packets to the Master  120 ,  223  so that in the event signatures may be created by the Master  120 ,  223 , these signatures can be sent back to the Agents  116 - 118 ,  223 - 222  that send packets to the Master  120 ,  223 . Alternatively, the agent address database  501  may be preprogrammed to include the addresses of all agents  116 - 118 ,  220 - 222  that are to receive signatures. In such cases, it might not be useful for the addresses of incoming packets to be recorded in the agent address database  501 . The packet may then be sent to a packet database  502 . The packet database  502  allows the worm detection intelligence  503  to examine multiple packets at the same time to determine the presence of a malicious program. The worm detection intelligence  503 , for example, uses factors such as the frequency of the receipt of common packets to determine if a malicious program is propagating. A database of exception signatures  504  may be provided to supply the worm detection intelligence  503  with a list of scenarios that are known not to be caused by malicious program infection even though the scenarios might otherwise exhibit characteristics indicative of malicious program infection. For example, the exception database  504  might inform the worm detection intelligence  503  that a particular mass email is not indicative of a malicious program even though the mass email results in the transmission of common packets. The exception signature database  504  can also be used by the network administrator to inform the Master  120 ,  223  of any mistakes made by the worm detection intelligence  503  so those mistakes need not be repeated. If the worm detection intelligence  503  determines that there is an infection from a malicious program, and the scenario is not listed in the exception signature database  504 , then a packet believed to be the result of the malicious program infection may then be sent to the signature generator  505 . The signature generator  505  may generate a signature that can be used to detect the packets created as a result of the malicious program and sends the signature to all Agents  116 - 118 ,  220 - 222  using the addresses listed in the Agent address database  501 .  
         [0052]     The present disclosure is not limited to the analysis of whole packets. For example, packets sent to the Master  120 ,  223  may be broken into units of data smaller than one packet (a sub-packet). These sub-packets may then be individually stored in the packet database  502 . The worm detection intelligence  503  would then examine the sub-packets for signs of an infection from a malicious program. For example, the frequency of similar sub-packets can be tracked. Analysis of sub-packets can aid in the identification of malicious programs that generate data smaller than a full packet and in cases where the malicious program attempts to disguise itself by changing forms as it propagates (polymorphic malicious programs).  
         [0053]      FIG. 6  illustrates the operation of a packet database  502  according to embodiments of the present invention.  
         [0054]     When a packet arrives to the Master  120 ,  223  from an Agent  116 - 118 ,  220 - 222 , the packet may be sent to a data hasher  601 . The data hasher  601  may compute a hash value for the sent packet. The hash value may then be entered into an array of hash values  602  that keeps track of the number of packets that have been observed for each observed hash value within a set length of time. For example, each hash value in the array  603  may be associated with a list of times that the hash value was observed  604 - 606 . As new instances of a particular hash value are observed, the new time of observation may be added to the beginning of the list. Instances deemed too remote in time may be removed from the list. For example, instances observed more than 5 minutes ago may be removed from the list. By keeping track of the number of instances within a particular length of time, the packet database  502  can calculate the frequency of observation of a particular packet, and this information can be used by the worm detection intelligence  503  to help determine the presence of a malicious program infection.  
         [0055]      FIG. 7  depicts an example of a computer system which may implement the method and system of the present disclosure. The system and method of the present disclosure may be implemented in the form of a software application running on a computer system, for example, a mainframe, personal computer (PC), handheld computer, server, etc. The software application may be stored on a recording media locally accessible by the computer system and accessible via a hard wired or wireless connection to a network, for example, a local area network, or the Internet.  
         [0056]     The computer system referred to generally as system  700  may include, for example, a central processing unit (CPU)  702 , random access memory (RAM)  704 , a printer interface  706 , a display unit  708 , a local area network (LAN) data transmission controller  710 , a LAN interface  712 , a network controller  714 , an internal buss  716 , and one or more input devices  718 , for example, a keyboard, mouse etc. As shown, the system  700  may be connected to a data storage device, for example, a hard disk,  720  via a link  722 .