NETWORK RATING

• US 20090125980A1
• Filed: 11/09/2007
• Published: 05/14/2009
• Est. Priority Date: 11/09/2007
• Status: Abandoned Application

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Krasser, Sven, Alperovitch, Dmitri, Schneck, Phyllis Adele, Judge, Paul
• Application Number:
  US11/937,908
• Publication Number:
  US 20090125980A1
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 63/126 the source of the received data

Abstract

Methods and systems for operation upon one or more data processors for assigning a reputation to a messaging entity by analyzing the attributes of the entity, correlating the attributes with known attributes to define relationships between entities sharing attributes, and attributing a portion of the reputation of one related entity to the reputation of the other related entity.

Claims

1. A computer implemented method, comprising:

receiving a connection request for a first network entity from a second network entity;

retrieving a reputation associated with the second network entity from a reputation server, the reputation server being operable to derive a reputation associated with the second network entity based upon data associated with the second network entity;

comparing a reputation associated with the second network entity to a reputation associated with the first network entity; and

determining whether to approve a connection between the first network entity and the second network entity based upon the comparison.

2. The method of claim 1, wherein the reputation of the first network entity and the reputation of the second network entity comprise current reputations associated with the first and second network entities.

3. The method of claim 1, wherein the reputation of the first network entity and the reputation of the second network entity comprise reputations changes associated with the first and second network entities over a period of time.

4. The method of claim 1, wherein the reputation of the first network entity and the reputation of the second network entity comprise reputation for being infected with malware.

5. The method of claim 1, wherein the reputation of the first network entity and the reputation of the second network entity comprise reputation for communication patterns associated with the first network entity and the second network entity, respectively.

6. The method of claim 5, wherein the communication patterns comprise traffic volume, traffic content, traffic correlation, traffic classification and categorization, and malware traffic.

7. The method of claim 1, wherein the reputations of the first network entity and the second network entity are based upon a plurality of reputations of other network entities associated with the first or second network entities.

8. The method of claim 1, wherein the method is performed by an independent entity from the first network entity and the second network entity.

9. The method of claim 1, wherein the connection request comprises a partnership between the first network entity and the second network entity.

10. The method of claim 1, wherein the reputations of the first network entity and the second network entity comprise a first and second reputation score, respectively, wherein the connection is approved based upon the second reputation score being higher than the first reputation score.

11. A connection control system comprising:

a communication interface operable to receive connection requests between a first entity and a second entity;

a reputation module operable to provide a reputation associated with the first entity and the second entity based upon communications associated with each of the entities;

a comparison module operable to compare the reputation of the first entity with the reputation of the second entity;

wherein the communication interface is operable to communicate a response to the connection request based upon the comparison between the reputation of the first entity and the reputation of the second entity.

12. The system of claim 11, wherein the reputation of the first entity and the reputation of the second entity comprise current reputations associated with the first and second entities, respectively.

13. The system of claim 11, wherein the reputation of the first entity and the reputation of the second entity comprise changes in reputations respectively associated with the first and second entities over a period of time.

14. The system of claim 11, wherein the reputation of the first entity and the reputation of the second entity comprise reputation for being infected with malware.

15. The system of claim 11, wherein the reputation of the first entity and the reputation of the second entity comprise reputation for communication patterns associated with the first entity and the second entity, respectively.

16. The system of claim 11, wherein the reputations of the first entity and the second entity are based upon a plurality of reputations of other entities associated with the first or second entities.

17. The system of claim 11, wherein the connection request comprises a partnership agreement between the first entity and the second entity.

18. The system of claim 11, wherein the reputations of the first entity and the second entity comprise a first and second reputation score, respectively.

19. The system of claim 18, wherein the comparison module is operable to approve a connection based upon the second reputation score being higher than the first reputation score.

20. The system of claim 18, wherein the comparison module is operable to approve a connection based upon the first reputation score and the second reputation score being within a threshold range of one another.

21. A connection control method, comprising:

identifying a first network entity;

identifying communications associated with the first network entity;

applying a plurality of tests to the communications, the plurality of tests being operable to identify characteristics associated with the communications;

identifying one or more relationships between the first network entity and a known entity based upon the analysis;

assigning a first reputation score to the first network entity based upon the one or more relationships and based upon results of the plurality of tests;

determining whether to connect to a second network entity based upon the first reputation score.

22. The method of claim 21, further comprising determining whether to approve the connection further based upon a second reputation score associated with the second network entity.

23. A connection control method, comprising:

identifying a first reputation score, the first reputation score being based upon identified network activity associated with the first entity;

identifying a second reputation score, the second reputation score being based upon identified network activity associate with the second entity;

comparing the first reputation score with the second reputation score; and

determining whether to enable a connection to the second entity.

24. The method of claim 23, wherein determining whether approve a connection to the second entity comprises determining whether to request a connection to the second entity.

25. The method of claim 23, further comprising receiving a connection request from the first entity, wherein determining whether to approve a connection to the second entity comprises determining whether to accept a connection request from the first entity.