System and method to combine multiple reputations

• US 10,083,295 B2
• Filed: 12/23/2014
• Issued: 09/25/2018
• Est. Priority Date: 12/23/2014
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Spurlock, Joel R., Teddy, John D.
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US14/581,965
• Publication Number:
  US 20160180084A1
• Time in Patent Office: 1,372 Days
• Field of Search: 726 23
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Particular embodiments described herein provide for an electronic device that can be configured to acquire a plurality of reputations related to an object and combine the plurality of reputations to create a total reputation for the object. The object can include a plurality of sub-objects and each of the plurality of reputations can correspond to one of the sub-objects.

Claims

1. At least one non-transitory computer-readable medium comprising one or more instructions that when executed by at least one processor, cause the at least one processor to:

acquire a plurality of reputations related to an object, wherein the plurality of reputations includes at least one backend reputation, at least one service provider reputation, and at least one external reputation, wherein the object includes a plurality of sub-objects and each of the plurality of reputations corresponds to one of the plurality of sub-objects, and wherein the object is an electronic device and the sub-objects are processes running on the electronic device and each of the plurality of reputations is a reputation related to one of the processes;

determine whether any other source can generate a reputation for the object;

combine the plurality of reputations and the reputation generated by the any other source to create a total reputation for the object, wherein each of the plurality of reputations includes a reputation confidence and a reputation weight; and

determine whether the object can be trusted based on the total reputation.

2. The at least one non-transitory computer-readable medium of claim 1, wherein a Bayesian algorithm is used to combine the plurality of reputations.

3. The at least one non-transitory computer-readable medium of claim 1, further comprising one or more instructions that when executed by the at least one processor, further cause the at least one processor to:

allow general remediation for a malicious reputation when an allow repair flag is set for a sub-object related to the malicious reputation.

4. The at least one non-transitory computer-readable medium of claim 1, wherein at least one of the plurality of reputations for a sub-object was determined by combining multiple reputations for the sub-object.

5. The at least one non-transitory computer-readable medium of claim 1, wherein the total reputation for the object is communicated to a second electronic device.

6. The at least one non-transitory computer-readable medium of claim 5, further comprising one or more instructions that when executed by the at least one processor, further cause the at least one processor to:

acquire, at the second electronic device, a plurality of reputations related to a plurality of objects connected to a network, wherein the object is included in the plurality of objects; and

combine the plurality of reputations to create a total reputation for the network.

7. An apparatus comprising:

memory;

a hardware processor; and

a reputation module configured to;

acquire a plurality of reputations related to an object, wherein the plurality of reputations includes at least one backend reputation, at least one service provider reputation, and at least one external reputation, wherein the object includes a plurality of sub-objects and each of the plurality of reputations corresponds to one of the plurality of sub-objects, and wherein the object is an electronic device and the sub-objects are processes running on the electronic device and each of the plurality of reputations is a reputation related to one of the processes;

determine whether any other source can generate a reputation for the object;

combine the plurality of reputations and the reputation generated by the any other source to create a total reputation for the object, wherein each of the plurality of reputations includes a reputation confidence and a reputation weight; and

determine whether the object can be trusted based on the total reputation.

8. The apparatus of claim 7, wherein a Bayesian algorithm is used to combine the plurality of reputations.

9. The apparatus of claim 7, wherein the reputation module is further configured to:

allow general remediation for a malicious reputation when an allow repair flag is set for a sub-object related to the malicious reputation.

10. The apparatus of claim 7, wherein at least one of the plurality of reputations for a sub-object was determined by combining multiple reputations for the sub-object.

11. The apparatus of claim 7, wherein the total reputation for the object is communicated to a second electronic device.

12. The apparatus of claim 11, wherein reputation module configured to:

acquire, at the second electronic device, a plurality of reputations related to a plurality of objects connected to a network, wherein the object is included in the plurality of objects; and

combine the plurality of reputations to create a total reputation for the network.

13. A method comprising:

acquiring a plurality of reputations related to an object, wherein the plurality of reputations includes at least one backend reputation, at least one service provider reputation, and at least one external reputation, wherein the object includes a plurality of sub-objects and each of the plurality of reputations corresponds to one of the plurality of sub-objects, and wherein the object is an electronic device and the sub-objects are processes running on the electronic device and each of the plurality of reputations is a reputation related to one of the processes;

determining whether any other source can generate a reputation for the object;

combining the plurality of reputations and the reputation generated by the any other source to create a total reputation for the object, wherein each of the plurality of reputations includes a reputation confidence and a reputation weight; and

determining whether the object can be trusted based on the total reputation.

14. The method of claim 13, wherein a Bayesian algorithm is used to combine the plurality of reputations.

15. The method of claim 13, wherein at least one of the plurality of reputations for a sub-object was determined by combining multiple reputations for the sub-object.

16. The method of claim 13, wherein the total reputation for the object is communicated to a second electronic device.

17. The method of claim 13, further comprising:

acquiring, at the second electronic device, a plurality of reputations related to a plurality of objects connected to a network, wherein the object is included in the plurality of objects; and

combining the plurality of reputations to create a total reputation for the network.

18. A system for combining multiple reputations, the system comprising:

memory;

a hardware processor; and

a reputation module configured for;

acquiring a plurality of reputations related to an object, wherein the plurality of reputations includes at least one backend reputation, at least one service provider reputation, and at least one external reputation, wherein the object includes a plurality of sub-objects and each of the plurality of reputations corresponds to one of the plurality of sub-objects, and wherein the object is an electronic device and the sub-objects are processes running on the electronic device and each of the plurality of reputations is a reputation related to one of the processes;

determining whether any other source can generate a reputation for the object;

combining the plurality of reputations and the reputation generated by the any other source to create a total reputation for the object, wherein each of the plurality of reputations includes a reputation confidence and a reputation weight; and

determining whether the object can be trusted based on the total reputation.

19. The system of claim 18, wherein a Bayesian algorithm is used to combine the plurality of reputations.