Using indications of compromise for reputation based network security
First Claim
Patent Images
1. A method comprising:
- collecting a plurality of indications of compromise from an endpoint, each one of the indications of compromise based upon one or more actions taken by one or more processes executing on the endpoint, and at least one of the plurality of indications of compromise including a category of one or more objects related to the one or more actions and a description of one or more objects related to the one or more actions;
identifying a low-reputation behavior based upon a quantity of other endpoints that have seen the plurality of indications of compromise and a context for the one or more actions on the endpoint;
creating a coloring rule for the low-reputation behavior based upon an occurrence of the plurality of indications of compromise;
receiving the coloring rule at a security facility on the endpoint; and
applying the coloring rule with the security facility to color low reputation objects.
4 Assignments
0 Petitions
Accused Products
Abstract
Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted/untrusted processes or corporate/private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility.
31 Citations
20 Claims
-
1. A method comprising:
-
collecting a plurality of indications of compromise from an endpoint, each one of the indications of compromise based upon one or more actions taken by one or more processes executing on the endpoint, and at least one of the plurality of indications of compromise including a category of one or more objects related to the one or more actions and a description of one or more objects related to the one or more actions; identifying a low-reputation behavior based upon a quantity of other endpoints that have seen the plurality of indications of compromise and a context for the one or more actions on the endpoint; creating a coloring rule for the low-reputation behavior based upon an occurrence of the plurality of indications of compromise; receiving the coloring rule at a security facility on the endpoint; and applying the coloring rule with the security facility to color low reputation objects. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A method comprising:
-
collecting a plurality of indications of compromise from an endpoint, each indication of compromise based upon one or more actions taken by one or more processes executing on the endpoint, and at least one of the plurality of indications of compromise including a category of one or more objects related to the one or more actions and a description of one or more objects related to the one or more actions; identifying a low-reputation behavior based upon a quantity of other endpoints that have seen the plurality of indications of compromise and a context for the one or more actions on the endpoint; creating a coloring rule for the low-reputation behavior based upon an occurrence of the plurality of indications of compromise; and when the plurality of indications of compromise are detected on the endpoint, taking an action based upon the coloring rule. - View Dependent Claims (9, 10, 11, 12, 13)
-
-
14. A computer program product comprising a non-transitory computer readable medium having stored thereon computer executable code that, when executing on one or more computing devices, cause the one or more computing devices to perform the steps of:
-
collecting a plurality of indications of compromise from an endpoint, each one of the indications of compromise based upon one or more actions taken by one or more processes executing on the endpoint, and at least one of the plurality of indications of compromise including a category of one or more objects related to the one or more actions and a description of the one or more objects related to the one or more actions; identifying a low-reputation behavior based upon a quantity of other endpoints that have seen the plurality of indications of compromise and a context for the one or more actions on the endpoint; creating a coloring rule for the low-reputation behavior based upon an occurrence of the plurality of indications of compromise; receiving the coloring rule at a security facility on the endpoint; and applying the coloring rule with the security facility to color low reputation objects. - View Dependent Claims (15, 16, 17, 18, 19, 20)
-
Specification
-
- Resources
Litigation Campaign Assessment
Thank you for your request. You will receive a custom alert email when the Litigation Campaign Assessment is available.
×
-
Current AssigneeSophos Limited (Sophos Group Ltd.)
-
Original AssigneeSophos Limited (Sophos Group Ltd.)
-
InventorsRay, Kenneth D., Reed, Simon Neil, Harris, Mark D., Watkiss, Neil Robert Tyndale, Thomas, Andrew J., Cook, Robert W., Samosseiko, Dmitri
-
Primary Examiner(s)Li, Meng
-
Application NumberUS15/969,713Publication NumberTime in Patent Office307 DaysField of SearchUS Class CurrentCPC Class CodesG06F 16/285 Clustering or classificationH04L 63/0263 Rule managementH04L 63/1408 by monitoring network traff...H04L 63/20 for managing network securi...
