Security vendor Damballa has reported a significant increase in malware using P2P communications, which is difficult...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
for enterprises to spot using typical network detection methods. Could you provide some network detection techniques that are effective against malicious P2P traffic?
There has been a significant increase in malware using P2P communications, but at the same time there has also been an increase in the overall number of network applications that are using P2P communications. This increase in P2P malware could be attributed to difficulties with firewalls, bandwidth concerns for central nodes or distrust of centralized communications. Many applications have opted to use P2P communications for host-to-host communications after the other host is identified via a central node, fast-flux domain name, broadcast or scanning. Due to the increased popularity in this, malware has inevitably evolved to also utilize these techniques.
P2P communications technology has been around since at least 1998. It was first used by Skype for voice calls, but Skype also relied on supernodes to find other peers. Connecting to a supernode, fast-flux domain or scanning can make the malware easier to analyze from the network perspective because endpoints don't typically contact a large number of external systems, which helps identify the malicious network activity.
Effective network detection techniques against malicious P2P traffic have been around since network appliances were introduced to combat malware. These include network traffic shapers like Packeteer, antimalware network appliances like Actiance andnext-generation firewalls like Palo Alto. Most of the network tools have fingerprinted the network signatures of the network or use anomaly detection to identify connections that look suspicious.
Ask the Expert!
Want to ask Nick Lewis a question about enterprise threats? Submit your questions now via email! (All questions are anonymous.)
Dig Deeper on Malware, Viruses, Trojans and Spyware
Related Q&A from Nick Lewis
IP devices like multifunction printers and faxes may be an attack vector. Expert Nick Lewis explains the vulnerabilities, and how to secure them ...continue reading
AceDeceiver is a Trojan that can install itself on iOS devices without any certificates. Expert Nick Lewis explains how it works, and how enterprises...continue reading
USB Thief, a new type of stealth malware, leaves no trace on air-gapped targets. Expert Nick Lewis explains how the malware works and how enterprises...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.