Aggregation of Reputation Data

• US 20070130351A1
• Filed: 01/24/2007
• Published: 06/07/2007
• Est. Priority Date: 06/02/2005
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Krasser, Sven, Alperovitch, Dmitri, Judge, Paul, Schneck, Phyllis, Hernandez, Alejandro
• Granted Patent: US 7,937,480 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

Methods and systems for operation upon one or more data processors for aggregating reputation data from dispersed reputation engines and deriving global reputation information for use in handling received communications.

Claims

1. A reputation system, the system comprising:

a centralized reputation engine operable to receive feedback from a plurality of local reputation engines, the plurality of local reputation engines being operable to determine local reputations based upon one or more entities and respectively associated the local reputation engines;

an aggregation engine operable to derive a global reputation for a queried entity based upon an aggregation of the plurality of local reputations; and

wherein the centralized reputation engine is operable to provide the global reputation of the queried entity to one or more of the local reputation engines responsive to receiving a reputation query from said one or more of the local reputation engines.

2. The system of claim 1, wherein the aggregation engine is operable to store confidence values associated with a respective local reputation engine, the aggregation engine being further operable to aggregate the plurality of local reputations using the confidence values associated with each of the plurality of local reputations through its respective local reputation engine.

3. The system of claim 2, wherein the local reputation system is a subsystem to the centralized reputation system, and performs the reputation scoring on a local scale based upon the communications received by the local reputation engine, and the centralized reputation engine performs reputation scoring based upon communications received by the centralized reputation engine and reputation information received from the local reputation engines.

4. The system of claim 2, wherein the local reputations are weighted based on their respective confidence values prior to aggregation of the local reputations.

5. The system of claim 4, wherein the confidence values are tuned based upon feedback received from the plurality of local reputation engines.

6. The system of claim 1, wherein the local reputations and global reputations are vectors which identify the characteristics of the respective entities to which they are associated.

7. The system of claim 6, wherein the characteristics comprise one or more of a spamming characteristic, a phishing characteristic, a bulk mailing characteristic, a virus source characteristic, a legitimate communication characteristic, an intrusion characteristic, an attack characteristic, a spyware characteristic, or a geolocation characteristic.

8. The system of claim 1, wherein the local reputations are based upon an aggregation of reputable and non-reputable criteria.

9. The system of claim 1, wherein the centralized reputation system is operable to apply a local reputation bias to the global reputation based on the local reputation engine that originated the reputation query.

10. The system of claim 9, wherein the local reputation bias is based upon input received from the local reputation engine that originated the reputation query.

11. The system of claim 9, wherein the local reputation bias is based upon feedback received from the local reputation engine that originated the reputation query.

12. The system of claim 9, wherein the local reputation bias is operable to amplify certain criteria for reputation while moderating other criteria for reputation based upon the local reputation bias.

13. The system of claim 1, wherein a local reputation engine is operable to apply a local reputation bias to the global reputation prior to applying the global reputation to a communication received from the queried entity.

14. The system of claim 1, wherein the local reputation engine originates the reputation query responsive to receiving a communication associated with an external entity with respect to a protected enterprise network associated with the local reputation engine.

15. The system of claim 14, wherein the local reputation engine originates the reputation query responsive to a local reputation associated with the external entity being indeterminate.

16. The system of claim 1, wherein the centralized reputation engine is further operable to aggregate reputation for a plurality of identities associated with one or more of the plurality of entities.

17. The system of claim 16, wherein the centralized reputation engine is further operable to correlate attributes associated with different identities to identify relationships between the identities, and to assign a portion of the reputation associated with one entity to the reputation of another entity where a relationship have been identified between entities.

18. A method of producing a global reputation, comprising the steps of:

receiving a reputation query from a requesting local reputation engine;

retrieving a plurality of local reputations the local reputations being respectively associated with a plurality of local reputation engines;

aggregating the plurality of local reputations;

deriving a global reputation from the aggregation of the local reputations; and

responding to the reputation query with the global reputation.

19. The method of claim 18, further comprising retrieving confidence values associated with the local reputation engines, the deriving step using the confidence values to derive the global reputation.

20. The method of claim 19, wherein the deriving step further comprises weighting the local reputations using their respective confidence values and combining the weighted reputations to generate the global reputation.

21. The method of claim 20, further comprising tuning the confidence values based upon feedback from the plurality of local reputation engines.

22. The method of claim 18, wherein the local reputations and global reputations are vectors which identify the characteristics of the respective entities to which they are associated.

23. The method of claim 22, wherein the characteristics comprise one or more of a spamming characteristic, a phishing characteristic, a bulk mailing characteristic, a malware source characteristic, or a legitimate mail characteristic.

24. The method of claim 18, wherein the local reputations are based upon an aggregation of reputable and non-reputable criteria.

25. The method of claim 18, further comprising applying a local reputation bias to the aggregation of local reputations to produce the global reputation vector, the local reputation bias being based upon the requesting local reputation engine.

26. The method of claim 25, wherein the local reputation bias is based upon input received from the requesting local reputation engine.

27. The method of claim 25, wherein the local reputation bias is based upon feedback received from the requesting local reputation engine.

28. The method of claim 25, further comprising amplifying certain criteria for reputation based upon the local reputation bias and moderating other criteria for reputation based upon the local reputation bias.

29. The method of claim 18, wherein the requesting local reputation engine originates the reputation query responsive to receiving a communication associated with an external entity with respect to a protected enterprise network associated with the requesting local reputation engine.

30. The method of claim 29, wherein the requesting local reputation engine originates the reputation query responsive to a local reputation associated with the external entity being indeterminate.

31. The method of claim 18, wherein deriving the global reputation is further based upon public and private information not available to any of the plurality of local reputation engines.

32. One or more computer readable media having software program code operable perform steps to aggregate a plurality of local reputation vectors to produce a global reputation vector, the steps comprising:

receiving a reputation query from a requesting local reputation engine;

retrieving a plurality of local reputations the local reputations being respectively associated with a plurality of local reputation engines;

aggregating the plurality of local reputations;

deriving a global reputation from the aggregation of the local reputations; and

responding to the reputation query with the global reputation.

33. The computer readable media of claim 32, wherein deriving the global reputation is further based upon public or private information available only to a central server.

34. The computer readable media of claim 32, further comprising software program code operable to aggregate reputation for a plurality of identities associated with one or more of the plurality of entities.

35. A reputation system, the system comprising:

a communications interface operable to receive global reputation information from a central server, the central server being operable to determine global reputations based upon feedback received from one or more local reputation engines, the global reputation being respectively associated with one or more entities;

a reputation engine operable to bias the global reputation received from the central server based upon defined local preferences; and

wherein the centralized reputation engine is operable to provide the global reputation of the queried entity to the communications interface responsive to receiving a reputation query from said communications interface.

36. A reputation system, the system comprising:

a communications interface operable to receive distributed reputation information from one or more distributed reputation engines, the distributed reputation engines being operable to examine communications and derive a reputation associated with one or more entities originating the communications;

a reputation module operable to aggregate the distributed reputation information, and to derive a global reputation based upon the aggregation of the distributed reputation information, the reputation module being further operable to derive a local reputation information based upon communications received by the reputation module; and

a traffic control module operable to determine handling associated with communications based upon the global reputation and the local reputation.