Multi-Dimensional Reputation Scoring

• US 20080175266A1
• Filed: 01/24/2007
• Published: 07/24/2008
• Est. Priority Date: 01/24/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Lange, Tim, Stecher, Martin, Hernandez, Alejandro Manuel, Yang, Weilai, Krasser, Sven, Alperovitch, Dmitri, Schneck, Phyllis Adele, Zdziarski, Jonathan Alexander, Judge, Paul, Tang, Yuchun, Foote-Lennox, Tomo, Greve, Paula, Willis, Lamar Lorenzo, Gould, Jeremy, Trivedi, Aarjav Jyotindra Neeta
• Granted Patent: US 8,214,497 B2
• Time in Patent Office: Days
• US Class Current: 370/465
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

Methods and systems for assigning reputation to communications entities include collecting communications data from distributed agents, aggregating the communications data, analyzing the communications data and identifying relationships between communications entities based upon the communications data.

Claims

1. A computer implemented method operable to assign a reputation to a communications entity associated with a received communication, comprising:

arranging a plurality of agents within a network, the plurality of agents being associated with a security device operable to protect an associated network from communications that violate a policy associated with the associated network;

collecting data associated with entities originating communications, wherein collecting data comprises using the plurality of agents to collect data associated with the communications;

aggregating the collected data;

analyzing the aggregated data to identify attributes respectively associated with entities originating communications;

correlating the attributes to identify relationships between entities;

updating a reputation associated with one or more entities based upon the relationship to one or more other entities identified by correlating the attributes; and

communicating updated reputation information to one or more of the plurality of agents.

2. The method of claim 1, wherein the reputation comprises a reputation vector indicating a reputation of an entity in a plurality of categories, the categories representing types of activity in which the entity or related entities have engaged.

3. The method of claim 2, further comprising using the communicated updated reputation information to determine whether to allow a voice over internet protocol connection or a short message service connection.

4. The method of claim 3, further comprising comparing the reputation information to a policy to determine whether to allow a voice over internet protocol connection or a short message service connection.

5. The method of claim 4, wherein the policy is defined by an administrator of the associated network to which the policy belongs.

6. The method of claim 2, further comprising using the communicated reputation information to determine one or more selected interrogation engines selected from of a plurality of interrogation engines, wherein the selected interrogation engines will interrogate a received communication.

7. The method of claim 6, wherein the one or more selected interrogation engines omit any of the plurality of interrogation engines that test for risks that are not implicated by the reputation vector.

8. The method of claim 2, further comprising using the communicated reputation information to determine which of a plurality of agents to use for interrogation of a received communication.

9. The method of claim 8, wherein a communication associated with an entity that does not comply with policy for the associated network is assigned to an agent with an interrogation queue experiencing the highest interrogation volume.

10. The method of claim 8, wherein a communication associated with an entity that complies with policy for the associated network is assigned to an agent with an interrogation queue experiencing the lowest interrogation volume.

11. The method of claim 2, wherein the reputation comprises one or more of a reputation for originating spain, a reputation for originating image spain, a reputation for originating attacks, a reputation for intrusion, a reputation for originating phishing communications, a geolocation-based reputation, or a reputation for originating bulk mail.

12. The method of claim 2, wherein the plurality of agents include local reputation information, the local reputation information comprising one or more reputations respectively associated with one or more entities.

13. The method of claim 12, further comprising:

aggregating the local reputation information; and

deriving a global reputation vector based upon the aggregation of the local reputation information.

14. The method of claim 13, further comprising:

receiving a reputation query from an agent;

deriving the global reputation vector responsive to the reputation query; and

communicating the global reputation vector to the agent originating the reputation query.

15. The method of claim 14, wherein the local reputation information comprises a plurality of local reputations and confidence values associated with the local reputations, wherein aggregating the local reputation information comprises adjusting each of the local reputations by an associated confidence value and combining the adjusted local reputations to produce a native global reputation vector.

16. The method of claim 15, further comprising applying a transform to the native global reputation vector to produce the global reputation vector.

17. The method of claim 16, wherein the transform comprises a local bias associated with the agent originating the reputation query.

18. The method of claim 17, wherein the local bias is operable to adjust the native global bias based upon preferences associated with the associated network.

19. The method of claim 1, wherein the entities comprise web entities operable to receive hypertext transfer protocol requests and to communicate one or more web pages responsive to the hypertext transfer protocol requests, wherein the reputation associated with the web entities comprises a reputation for communication of non-reputable web pages.

20. A computer implemented method operable to assign a reputation to a communications entity associated with a received communication, comprising:

collecting data associated with entities originating communications, wherein collecting data comprises receiving data from a plurality of agents to collect data associated with the communications;

aggregating the collected data;

analyzing the aggregated data to identify attributes respectively associated with entities originating communications;

correlating the attributes to identify relationships between entities;

updating a reputation associated with one or more entities based upon the relationship to one or more other entities identified by correlating the attributes; and

handling communications based upon the updated reputation information.

21. A distributed system operable to derive and communicate a reputation associated with a communications entity, comprising:

a communications interface operable to communicate with a plurality of agents arranged within a global network, the plurality of agents being operable to derive local reputations associated with entities from which communications are received, wherein the plurality of agents are further operable to collect data associated with received communications;

one or more data aggregation engines operable to aggregate the collected data via the communications interface;

an analyzer operable to analyze the data to identify attributes respectively associated with entities originating the received communications;

a correlation engine operable to correlate the attributes of the entities and to identify relationships between the entities;

a reputation engine operable to identify relationships between the entities and to update reputations associated with one or more entities based upon its relationship to one or more other entities; and

wherein the communications interface is further operable to communicate updated reputation information to devices operating on the global network.

22. The system of claim 21, wherein the reputation comprises a reputation vector indicating a reputation of an entity in a plurality of categories, the categories representing types of activity in which the entity has engaged.

23. The system of claim 22, wherein the devices operating on the global network are operable to use the communicated updated reputation information to determine whether to allow a voice over internet protocol connection or a short message service connection.

24. The system of claim 23, wherein the devices are operable to compare the reputation information to a policy to determine whether to allow a voice over internet protocol connection or a short message service connection.

25. The system of claim 24, wherein the policy is defined by an administrator of the associated network to which the device belongs.

26. The system of claim 22, further comprising a load balancer operable to use the communicated reputation information to determine one or more selected interrogation engines selected from of a plurality of interrogation engines, wherein the one or more selected interrogation engines will interrogate a received communication.

27. The system of claim 26, wherein the one or more selected interrogation engines comprise those of the plurality of interrogation engines that test for risks that are implicated by the reputation vector.

28. The system of claim 22, further comprising a load balancer operable to use the communicated reputation information to determine which of a plurality of agents to use for interrogation of a received communication.

29. The system of claim 28, wherein a communication associated with an entity that does not comply with policy for the associated network is assigned to an agent with an interrogation queue experiencing the highest interrogation volume.

30. The system of claim 28, wherein a communication associated with an entity that complies with policy for the associated network is assigned to an agent with an interrogation queue experiencing the lowest interrogation volume.

31. The system of claim 22, wherein the reputation comprises one or more of a reputation for originating spain, a reputation for originating image spain, a reputation for originating attacks, a reputation for intrusion, a reputation for originating phishing communications, or a reputation for originating bulk mail.

32. The system of claim 22, wherein the plurality of agents include local reputation information, the local reputation information comprising one or more reputations respectively associated with one or more entities.

33. The system of claim 32, further comprising a reputation aggregation engine operable to aggregate local reputation information retrieved from the plurality of agents, and to derive a global reputation vector based upon the aggregation of the local reputation information.

34. The system of claim 33, wherein the communications interface is operable to receive a reputation query from an agent, and the reputation aggregation engine is operable to derive the global reputation vector responsive to the reputation query, whereby the communications interface can communicate the global reputation vector to the agent originating the reputation query.

35. The system of claim 34, wherein the local reputation information comprises a plurality of local, reputations and confidence values associated with the local reputations, wherein reputation aggregation engine is operable to adjust each of the local reputations by an associated confidence value and combining the adjusted local reputations to produce a native global reputation vector.

36. The system of claim 35, wherein the reputation aggregation engine is further operable to apply a transform to the native global reputation vector to produce the global reputation vector.

37. The system of claim 36, wherein the transform comprises a local bias associated with the agent originating the reputation query.

38. The system of claim 37, wherein the local bias is operable to adjust the native global bias based upon preferences associated with the associated network.

39. The system of claim 21, wherein the entities comprise web entities operable to receive hypertext transfer protocol requests and to communicate one or more web pages responsive to the hypertext transfer protocol requests, wherein the reputation associated with the web entities comprises a reputation for communication of non-reputable web pages.

40. A system operable to derive a reputation associated with a communications entity, comprising:

a communications interface operable to receive information from a plurality of agents or a central server within a global network, the plurality of agents being operable to collect data associated with received communications;

one or more data aggregation engines operable to aggregate the received information from the communications interface;

an analyzer operable to analyze the received information to identify attributes respectively associated with entities originating the received communications;

a correlation engine operable to correlate the attributes of the entities and to identify relationships between the entities;

a reputation engine operable to identify relationships between the entities and to update reputations associated with one or more entities based upon its relationship to one or more other entities; and

a traffic control engine operable to determine handling associated with a communication based upon the updated reputations.

41. A system comprising:

a security control interface operable to produce a plurality of security control representations, each of the plurality of security control representations being operable to control a plurality of security settings associated with a protected entity; and

a policy control interface operable to produce a plurality of policy control representations, each of the plurality of policy control representations being operable to control a plurality of policy settings associated with a protected entity;

a filtering module operable to filter one or more communication streams based upon the plurality of security settings and based upon the plurality of policy settings.

42. The system of claim 41, wherein the security control representations comprise a plurality of security slider representations in a plurality of security categories operable to control the security settings associated with the protected entity.

43. The system of claim 42, wherein the plurality of security categories comprise two or more of a virus category, a phishing category, a worms category, or a trojan horse category.

44. The system of claim 43, wherein the plurality of security control representations are each operable to adjust a threshold sensitivity for an associated one of the security settings.

45. The system of claim 44, wherein the threshold sensitivity comprises a level of similarity between communication stream characteristics and characteristics associated with the security categories.

46. The system of claim 42, wherein the policy control representations comprise a plurality of policy slider representations in a plurality of policy categories operable to control the policy settings associated with the protected entity.

47. The system of claim 46, wherein the plurality of policy categories comprise two or more of a spam category, a content category, a spyware category, or a bulk mail category.

48. The system of claim 47, wherein the plurality of policy control representations are each operable to adjust a threshold sensitivity for an associated one of the policy settings.

49. The system of claim 48, wherein the threshold sensitivity comprises a level of similarity between communication stream characteristics and characteristics associated with the policy categories.

50. The system of claim 41, wherein the protected entity is one of a computing device, a communications device, a mobile device, or a network.

51. The system of claim 41, wherein the security control interface and the policy control interface are controlled by an administrator.

52. The system of claim 41, wherein the security control interface and the policy control interface are controlled by an end user.

53. The system of claim 52, wherein the security control interface include a plurality of ranges associated with the plurality of security control representations, the security control settings operable to be adjusted within the range.

54. The system of claim 53, wherein the plurality of ranges are controlled by an administrator.

55. A computer implemented method comprising:

receiving a plurality of ranges from an administrator;

providing a security control interface to a user, the security control interface comprising a plurality of security control representations associated with security controls, each of the security control mechanisms including an associated range from among the plurality of ranges, the associated range defining a minimum and maximum setting associated with the respective security controls;

receiving a plurality of security control settings from the user through the security control interface;

adjusting a plurality of thresholds related to plurality of control settings received from the user, the plurality of thresholds being associated with tolerance for a classification of potential security violation; and

filtering communications streams from a protected entity associated with the user based upon the plurality of thresholds.

56. The method of claim 55, wherein the security control representations comprise a plurality of security slider representations in a plurality of security categories operable to control the security settings associated with the protected entity.

57. The method of claim 56, wherein the plurality of security categories comprise two or more of a virus category, a phishing category, a worms category, a trojan horse category, a spain category, a content category, a spyware category, or a bulk mail category.

58. The method of claim 57, wherein the plurality of security control representations are each operable to adjust a threshold sensitivity for an associated one of the security settings.

59. The method of claim 58, wherein the threshold sensitivity comprises a level of similarity between communication stream characteristics and characteristics associated with the security categories.

60. The method of claim 55, wherein the protected entity is one of a computing device, a communications device, a mobile device, or a network.

61. The method of claim 55, wherein the user comprises an administrator.

62. One or more computer readable media having software program code operable to enable filter adjustments for incoming and outgoing communications streams, comprising:

receiving a plurality of ranges from an administrator;

providing a security control interface to a user, the security control interface comprising a plurality of security control representations associated with a plurality of security control settings, each of the security control mechanisms including an associated range from among the plurality of ranges, the associated range defining a minimum and maximum setting associated with the respective security controls;

receiving input from the user through the security control interface, the input requesting adjustment of the security control settings;

adjusting a plurality of thresholds related to plurality of control settings received from the user, the plurality of thresholds being associated with tolerance for a classification of potential security violation; and

filtering communications streams from a protected entity associated with the user based upon the plurality of thresholds.