Determining a reputation of data using a data visa

• US 10,462,156 B2
• Filed: 09/24/2014
• Issued: 10/29/2019
• Est. Priority Date: 09/24/2014
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Schneider, Michael, Gartside, Paul, Oxley, David, Peypoch, Ramon
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US14/494,723
• Publication Number:
  US 20160087999A1
• Time in Patent Office: 1,861 Days
• Field of Search: 726 1, 726 11, 726 22
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Particular embodiments described herein provide for an electronic device that can be configured to receive data in a data flow, extract a data visa from the data flow, wherein the data visa is related to the data, and determine a reputation of the data from the data visa. The data visa can include reputation determination information obtained by previous network elements in the data flow. In addition, the electronic device can update the data visa, and communicate the updated data visa and data to a next network element in the data flow.

Claims

1. At least one computer-readable medium comprising one or more instructions that, when executed by at least one processor, perform a method comprising:

receiving data in a data flow;

extracting a data visa from the data flow, wherein the data visa travels with the data through the data flow and includes reputation determination information from at least one previous hop network element in the data flow;

bypassing a security filter based on the reputation determination information;

determining a reputation of the data based on the data and the reputation determination information, wherein the reputation of the data is determined from meta data included in the data visa, and the meta data includes a title or role of a user, a geo-location of the user, or a historic data use profile of the user;

storing the reputation of the data in the data visa; and

communicating the data visa and the data to a next network element in the data flow.

2. The at least one computer-readable medium of claim 1, wherein the data visa includes information related to the data flow including an origin, a destination, and chain of the data flow.

3. The at least one computer-readable medium of claim 1, the method further comprising:

synchronizing the data visa with previous known data visas to validate the data visa.

4. The at least one computer-readable medium of claim 1, the method further comprising:

determining, for the data visa, a context indicating whether a server that communicated the data has an operating system is vulnerable.

5. The at least one computer-readable medium of claim 1, wherein the data visa includes reputation determination information obtained by a plurality of previous hop network elements in the data flow.

6. The at least one computer-readable medium of claim 1, the method further comprising:

removing the data from the data flow based on the determined reputation of the data from the data visa.

7. The at least one computer-readable medium of claim 1, the method further comprising:

validating the data visa.

8. The at least one computer-readable medium of claim 1, the method further comprising:

determining the next network element in the data flow;

updating the data visa to include information related to the next network element; and

redetermining a new reputation of the data from the updated data visa.

9. An apparatus comprising:

a processor; and

a data reputation module configured to cause the processor to

extract a data visa from a data flow, wherein the data visa travels with data in the data flow through the data flow and includes reputation determination information from at least one previous hop network element in the data flow;

bypass a security filter based on the reputation determination information;

determine a reputation of the data based on the data and the reputation determination information, wherein the reputation of the data is determined from meta data included in the data visa, and the meta data includes a title or role of a user, a geo-location of the user, or a historic data use profile of the user;

store the reputation of the data in the data visa; and

communicate the data visa and the data to a next network element in the data flow.

10. The apparatus of claim 9, wherein the data reputation module is further configured to:

remove the data from the data flow based on the determined reputation of the data from the data visa.

11. The apparatus of claim 9, wherein the data visa is validated.

12. The apparatus of claim 9, wherein attributes of the data visa are correlated with known attributes of known data visas.

13. The apparatus of claim 9, wherein the data reputation module is further configured to:

determine the next network element in the data flow;

update the data visa to include information related to the next network element; and

redetermine a new reputation of the data from the updated data visa.

14. A method comprising:

receiving data in a data flow;

extracting a data visa from the data flow, wherein the data visa travels with the data through the data flow and includes reputation determination information from at least one previous hop network element in the data flow;

bypassing a security filter based on the reputation determination information;

determining a reputation of the data based on the data and the reputation determination information, wherein the reputation of the data is determined from meta data included in the data visa, and the meta data includes a title or role of a user, a geo-location of the user, or a historic data use profile of the user;

storing the reputation of the data in the data visa; and

communicating the data visa and the data to a next network element in the data flow.

15. The method of claim 14, wherein the data visa includes reputation determination information obtained by a plurality of previous hop network elements in the data flow.

16. The method of claim 14, further comprising:

removing the data from the data flow based on the determined reputation of the data from the data visa.

17. The method of claim 14, wherein the data visa is validated.

18. The method of claim 14, further comprising:

determining the next network element in the data flow;

updating the data visa to include information related to the next network element; and

redetermining a new reputation of the data from the updated data visa.

19. A system for determining a reputation of data, the system comprising:

a processor;

memory that includes one or more instructions; and

a data reputation module to execute the one or more instructions, the data reputation module configured for

receiving the data in a data flow;

extracting a data visa from the data flow, wherein the data visa travels with the data through the data flow, wherein the data visa includes reputation determination information from at least one previous hop network element in the data flow;

bypassing a security filter based on the reputation determination information;

determining a reputation of the data based on the data and the reputation determination information, wherein the reputation of the data is determined from meta data included in the data visa, and the meta data includes a title or role of a user, a geo-location of the user, or a historic data use profile of the user;

storing the reputation of the data in the data visa; and

communicating the data visa and the data to a next network element in the data flow.

20. The system of claim 19, wherein the meta data includes the title or role of the user, the geo-location of the user, and the historic data use profile of the user.

21. The system of claim 19, wherein the data reputation module rates the data before performing a data content scanning defined by data loss prevention (DLP) or virus scanning.

22. The system of claim 19, wherein the system encrypts the data or puts a passcode lock on the data prior to the communicating.