Malware beacon detection system

Abstract

A system that detects malware by analyzing message logs to identify message patterns that are periodic with similar-sized messages. These patterns may indicate malware since malware often sends beacon messages to a command-and-control system that are often periodic and of relatively similar length. The system may group message logs by the combination of source and destination and analyze each group for patterns of periodicity and message length uniformity. Entropy may be used to measure the uniformity of message lengths and message intervals, with low (or zero) entropy suggesting malware. Message intervals that repeat after several messages may be detected by testing subsequence sums for uniformity at different possible periods. Additional factors may be used to assess the risk, such as the duration of communication, and threat intelligence on the source or destination. The system may perform automated actions to eliminate or mitigate detected risks, such as blocking further communication.