Web Reputation Scoring

• US 20070130350A1
• Filed: 01/24/2007
• Published: 06/07/2007
• Est. Priority Date: 03/08/2002
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Krasser, Sven, Alperovitch, Dmitri, Judge, Paul, Tang, Yuchun, Foote-Lennox, Tomo, Greve, Paula, Lange, Tim, Schneck, Phyllis, Stecher, Martin, Zdziarski, Jonathan
• Granted Patent: US 8,561,167 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

Methods and systems for operation upon one or more data processors for assigning reputation to web-based entities based upon previously collected data.

Claims

1. A computer implemented method operable to assign a reputation to a web-based entity associated with a hypertext transfer protocol communication, comprising:

receiving a hypertext transfer protocol communication at an edge protection device;

identifying an entity associated with the received hypertext transfer protocol communication;

querying reputation engine for a reputation indicator associated with the entity;

receiving the reputation indicator from the reputation engine;

taking an action with respect to the hypertext transfer protocol communication based upon the received reputation indicator associated with the entity.

2. The method of claim 1, wherein the entity is a web entity comprising a destination universal resource locator, domain or IP address.

3. The method of claim 1, wherein the reputation of the entity is based upon previous communications received from the entity and public or private network information available about the entity comprising ownership or hosting information.

4. The method of claim 3, wherein the previous communications comprise one or more of an electronic message, hypertext transfer protocol communication, an instant message, a file transfer protocol communication, simple object access protocol messages, real-time transport protocol packages, a short message service communication, multimedia message service communication, or a voice over internet protocol communication.

5. The method of claim 1, wherein the action is to discard the communication and notify an enterprise network user associated with the hypertext transfer protocol communication.

6. The method of claim 1, wherein the entity is associated with a plurality of different types of network communications comprising at least hypertext transfer protocol type of communications and at least one of electronic mail communications, file transfer protocol communications, instant messaging communications, gopher communications, short messaging service communications or voice over internet protocol communications.

7. The method of claim 1, wherein the reputation engine determines the reputation indicator based upon an aggregation of reputable criteria associated with the entity and non-reputable criteria associated with the entity.

8. The method of claim 7, wherein the reputation indicator is a vector which indicates reputation based upon a plurality of different criteria.

9. The method of claim 8, further comprising examining the reputation vector to determine whether a policy associated with an enterprise network protected by the edge protection device allows communication with the entity based upon its reputation vector.

10. The method of claim 1, wherein the reputation engine is operable to provide a plurality of network security devices with one or more lists of reputations, the one or more lists of reputations comprising reputation information associated with a universe of entities that have associated reputations.

11. The method of claim 1, wherein the reputation engine is a reputation server operable to provide a plurality of edge protection devices with reputation information.

12. The method of claim 11, wherein the reputation engine is operable to store a global reputation indicator and to bias the global reputation indicator with a local bias prior to outputting the reputation indicator.

13. The method of claim 1, wherein the reputation indicator comprises a reputation vector, the reputation vector comprising a multi-dimensional classification of the entity.

14. The method of claim 13, wherein the multi-dimensional classification comprises classification of the message in two or more of a porn category, a news category, a computer category, a secure category, a phishing category, a spyware category, a virus category, or an attack category.

15. The method of claim 13, wherein the reputation indicator further comprises a confidence associated with each of the multi-dimensional classifications of the entity.

16. The method of claim 1, further comprising detecting randomization of a universal resource locator.

17. The method of claim 16, wherein the randomization of a universal resource locator is determined by generating a hash of the universal resource locator and comparing the hash to previously identified non-reputable universal resource locators.

18. The method of claim 16, wherein the randomization of a universal resource locator is determined by fingerprinting a plurality of portions of the universal resource locator and comparing the hash to previously identified non-reputable universal resource locators.

19. A web reputation system on an edge protection device operable to receive a web communication and to assign a reputation to an entity associated with the communication, the system comprising:

a communications interface operable to receive a web communication;

a communication analyzer operable to analyze the web communication to determine an entity associated with the web communication;

a reputation engine operable to provide a reputation associated with the entity based upon previously collected data associated with the entity;

a decision engine operable to receive the reputation indicator from the reputation engine and to determine whether the web communication is to be communicated to a recipient.

20. The system of claim 19, wherein the reputation of the entity is based upon previous communications received from the entity.

21. The system of claim 20, wherein the previous communications comprise one or more of an electronic message, hypertext transfer protocol communication, an instant message, a file transfer protocol communication, simple object access protocol messages, real-time transport protocol packages, a short message service communication, or a voice over internet protocol communication.

22. The system of claim 19, wherein the decision engine is operable to notify an enterprise network user associated with the hypertext transfer protocol communication in the event that the communication is not transmitted to the recipient.

23. The system of claim 19, wherein the entity is associated with a plurality of different types of network communications comprising at least hypertext transfer protocol type of communications and at least one of an electronic mail communication, a file transfer protocol communication, an instant messaging communication, a gopher communication, a short messaging service communication or a voice over internet protocol communication.

24. The system of claim 19, wherein the reputation engine determines the reputation indicator based upon an aggregation of reputable criteria associated with the entity and non-reputable criteria associated with the entity.

25. The system of claim 24, wherein the reputation indicator is a vector which indicates reputation based upon a plurality of different criteria.

26. The system of claim 25, further comprising examining the reputation vector to determine whether a policy associated with an enterprise network protected by the edge protection device allows communication with the entity based upon its reputation vector.

27. The system of claim 19, wherein the reputation engine is a reputation server operable to provide a plurality of edge protection devices with reputation information.

28. The system of claim 27, wherein the reputation engine is operable to store a global reputation indicator and to bias the global reputation indicator with a local bias prior to outputting the reputation indicator.

29. The system of claim 19, further comprising an interrogation engine operable to perform a plurality of tests on the communication and to determine a profile associated with the web communication.

30. The system of claim 29, wherein the decision engine is operable to determine whether to forward the web communication based upon the profile associated with the web communication.

31. The system of claim 30, wherein the reputation engine is operable to use the profile to update reputation information associated with the entity.

32. The system of claim of claim 19, wherein the reputation comprises a reputation vector, the reputation vector comprising a multi-dimensional classification of the entity.

33. The system of claim 32, wherein the multi-dimensional classification comprises classification of the message in two or more of a porn category, a news category, a computer category, a secure category, a phishing category, a spyware category, a virus category, or an attack category.

34. The system of claim 32, wherein the reputation further comprises a confidence associated with each of the multi-dimensional classifications of the entity.

35. The system of claim 19, further comprising detecting randomization of a universal resource locator.

36. The method of claim 35, wherein the randomization of a universal resource locator is determined by generating a hash of the universal resource locator and comparing the hash to previously identified non-reputable universal resource locators.

37. The method of claim 35, wherein the randomization of a universal resource locator is determined by fingerprinting a plurality of portions of the universal resource locator and comparing the hash to previously identified non-reputable universal resource locators.

38. One or more computer readable media having software program code operable to assign a reputation to a messaging entity associated with a received communication, comprising:

receiving a hypertext transfer protocol communication at an edge protection device;

identifying an entity associated with the received hypertext transfer protocol communication;

querying reputation engine for a reputation indicator associated with the entity;

receiving the reputation indicator from the reputation engine;

taking an action with respect to the hypertext transfer protocol communication based upon the received reputation indicator associated with the entity.