Persistent malware is a common type of malware that installs itself on a device and is thus able to perform actions whenever the device is on. So called bots (participating in botnets) can be classified as persistent malware that utilize a network and are widely held as one of the most serious threats on the Internet today. In general usage, the term “bot” refers to a computer infected with malware that allows the attacker to remotely control the computer to perform tasks on the behalf of the attacker, such as sending spam, stealing information, or launching attacks against other computers. A botnet is a collection of such bots under common control. Many techniques already exist for detecting malware infections on computers and other devices with similar capabilities, such as phones, tablets, etc. Existing host-based techniques include signature scanning for infected and manipulated files and behavioural monitoring for unusual and/or suspect processes on the device. Similarly, common network-based techniques rely on detecting signatures of attacks or malware communications or abnormal or suspect communication patterns, likely related to malware infections. Most techniques depend on capture and manual analysis of malware samples to create detection rules for that specific malware.
Existing malware detection techniques to date known by the inventors are imperfect in terms of detection performance and their capabilities depend on where they are deployed, e.g., on the host or in the network. Since there is a constant arms-race between malware writers and the security industry trying to defend the users, there is constantly a need for new techniques to improve detection of threats such as persistent network-using malware.