D3-IPCTA IPC Traffic Analysis

Analyzing standard inter process communication (IPC) protocols to detect deviations from normal protocol activity.

How it works Inter process communication enables applications or threads to share data. This can involve one or more computers. Monitoring IPC in your environment can reveal abnormal or malicious activity. IPC can occur within a single computer or between multiple computers remotely through network protocols. Thus there are multiple ways to collect and monitor these exchanges between processes. A network protocol analyzer may monitor and parse SMB network traffic to record system activity. A host based monitoring agent may monitor IPC activity contained within a single host to look for deviations from standard usages. Examples • SMB • Zeromq • Java RMI API Considerations • IPC can generate substantial amounts of data, and it may not be feasible to collect all of it. • IPC may occur over loopback interfaces or direct memory access granted by the operating system.