Unsupervised detection of malware in persistent web traffic

Persistent network communication can be found in many instances of malware. In this paper, we analyse the possibility of leveraging low variability of persistent malware communication for its detection. We propose a new method for capturing statistical fingerprints of connections and employ outlier detection to identify the malicious ones. Emphasis is put on using minimal information possible to make our method very lightweight and easy to deploy. Anomaly detection is commonly used in network security, yet to our best knowledge, there are not many works focusing on the persistent communication itself, without making further assumptions about its purpose.

1. Introduction

Bots differ from other types of malware by having a command and control (C&C) channel through which the botmaster controls the bot. The C&C channel can be implemented by using different network paradigms (p2p networks, central or fluxing servers, etc.) and protocols (custom, HTTP, plain TCP or UDP, etc.), but there has to be a communication path between C&C server and bots. The channel is maintained through the life of the bot, and once it is lost, the control over the bot is lost, too. This definition implies that the channel needs to be persistent in the sense that the bot receives the commands repeatedly in time. However, bots are not the only type of malware which produces persistent communication. Malware can repeatedly check connection to the Internet, perform click fraud, or download advertisements all of which can manifest as a persistent connection.