Detecting malware communication on an infected computing device

摘要

Rules describing attributes of malicious data requests, commonly generated by malware, are determined and stored. For example, a behavior server executes different types of malware and analyzes the data requests produced by the malware to identify attributes common to different malicious data requests. The rules describing malicious data request attributes are stored and subsequent data requests are compared to the stored rules to identify malicious data requests. If a data request has one or more attributes in common with attributes of malicious data requests, the data request is blocked. This allows attributes of a data request to be used to prevent malware executing on a client device from communicating with a malicious server.

主权项

1. A gateway to couple a client device to a data source, the gateway comprising:
a behavior store including a rule identifying attributes associated with malicious data requests, the attributes including a User Agent field; and a detection module to, upon receipt of a response to a data request previously received by the gateway, determine whether the data request is a malicious request by comparing a request attribute of the data request to the attributes associated with the malicious data requests, the detection module to, responsive to the identification of the malicious request, prevent transmission of the response to the malicious request, at least one of the behavior store and the detection module is implemented by hardware.