REPUTATION BASED LOAD BALANCING

• US 20100306846A1
• Filed: 08/16/2010
• Published: 12/02/2010
• Est. Priority Date: 01/24/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Krasser, Sven, Alperovitch, Dmitri, Judge, Paul, Willis, Lamar Lorenzo
• Granted Patent: US 8,578,051 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06Q 30/0633 Lists, e.g. purchase orders, compilation or processing
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Methods and systems for operation upon one or more data processors for efficiently processing communications based upon reputation of an entity associated with the communication.

Claims

1. Software stored in a computer readable media and comprising instructions executable by one or more computer servers that cause the one or more computer servers to perform operations comprising:

receive incoming and outgoing communications for a computer network;

determine an external entity associated with a communication;

derive a reputation vector for the external entity, the reputation vector comprising an aggregation of reputation information indicating the reputation of the external entity, the information including data related to reputable and non-reputable criteria in a plurality of categories comprising different types of communications; and

select, based on the reputation vector, a subset of tests to perform on the communication, each of the tests in the subset of tests being selected from a plurality of tests, each of the plurality of tests being a respective test that is selected for a communication when a reputation vector for the external entity associated with the communication indicates a non-reputable activity displayed by the external entity.

2. The software of claim 1, wherein the instructions cause the one or more computer servers to perform only the tests in the selected subset of tests on the communication.

3. The software of claim 2, wherein the tests comprise one or more of virus test, worm test, Trojan horse test, and phishing test.

4. Software stored in a computer readable media and comprising instructions executable by one or more computer servers that cause the one or more computer servers to perform operations comprising:

receive incoming and outgoing communications for a computer network;

determine external entities associated with the communications;

for each communication, derive a reputation vector for the external entity associated with the communication, the reputation vector comprising an aggregation of reputation information indicating the reputation of the external entity, the information including data related to reputable and non-reputable criteria in a plurality of categories comprising different types of communications;

for each communication, prioritize the communication based on the reputation vector associated with the communication, the prioritizing assigning a high priority to communications where the external entity is a reputable entity, and assigning a low priority to communications where the external entity is a non-reputable entity; and

perform a plurality of tests on the communications, each of the tests being performed for the communications according to the priorities of the communications so that an impact on a quality of service for reputable entities is minimized at the expense of a quality of service for non-reputable entities.

5. The software of claim 4, wherein the tests comprise one or more of virus test, worm test, Trojan horse test, and phishing test.

6. The software of claim 4, wherein the instructions cause the one or more server computers to prioritize the communication based on the reputation vector associated with the communication by assigning the communication to respective test queues for each test, each test queue having a queue length based on the prioritization, with a longest queue length for lowest prioritization, and a shortest queue length for a highest prioritization.

7. A computer implemented method performed by one or more computer servers, comprising:

receiving incoming and outgoing communications for a computer network;

determining external entities associated with the communications;

for each communication, deriving a reputation vector for the external entity associated with the communication, the reputation vector comprising an aggregation of reputation information indicating the reputation of the external entity, the information including data related to reputable and non-reputable criteria in a plurality of categories comprising different types of communications;

for each communication, prioritizing the communication based on the reputation vector associated with the communication, the prioritizing assigning a high priority to communications where the external entity is a reputable entity, and assigning a low priority to communications where the external entity is a non-reputable entity; and

performing a plurality of tests on the communications, each of the tests being performed for the communications according to the priorities of the communications so that an impact on a quality of service for reputable entities is minimized at the expense of a quality of service for non-reputable entities.

8. The method of claim 7, wherein the tests comprise one or more of virus test, worm test, Trojan horse test, and phishing test.

9. The method of claim 8, wherein prioritizing the communication based on the reputation vector associated with the communication comprises assigning the communication to respective test queues for each test, each test queue having a queue length based on the prioritization, with a longest queue length for lowest prioritization, and a shortest queue length for a highest prioritization.

10. A computer implemented method performed by one or more computer servers, comprising:

receiving incoming and outgoing communications for a computer network;

determining an external entity associated with a communication;

deriving a reputation vector for the external entity, the reputation vector comprising an aggregation of reputation information indicating the reputation of the external entity, the information including data related to reputable and non-reputable criteria in a plurality of categories comprising different types of communications; and

selecting, based on the reputation vector, a subset of tests to perform on the communication, each of the tests in the subset of tests being selected from a plurality of tests, each of the plurality of tests being a respective test that is selected for a communication when a reputation vector for the external entity associated with the communication indicates a non-reputable activity displayed by the external entity.

11. The method of claim 10, further comprising performing only the tests in the selected subset of tests on the communication.

12. The method of claim 11, wherein the tests comprise one or more of virus test, worm test, Trojan horse test, and phishing test.

13. A system, comprising

one or more computer servers;

and

computer readable media storing software program code executable by the one or more computer servers and upon such execution cause the one or more computer servers to perform operations comprising;

receiving incoming and outgoing communications for a computer network;

determining an external entity associated with a communication;

deriving a reputation vector for the external entity, the reputation vector comprising an aggregation of reputation information indicating the reputation of the external entity, the information including data related to reputable and non-reputable criteria in a plurality of categories comprising different types of communications; and

selecting, based on the reputation vector, a subset of tests to perform on the communication, each of the tests in the subset of tests being selected from a plurality of tests, each of the plurality of tests being a respective test that is selected for a communication when a reputation vector for the external entity associated with the communication indicates a non-reputable activity displayed by the external entity.

14. A system, comprising

one or more computer servers;

and

computer readable media storing software program code executable by the one or more computer servers and upon such execution cause the one or more computer servers to perform operations comprising;

receiving incoming and outgoing communications for a computer network;

determining external entities associated with the communications;

for each communication, deriving a reputation vector for the external entity associated with the communication, the reputation vector comprising an aggregation of reputation information indicating the reputation of the external entity, the information including data related to reputable and non-reputable criteria in a plurality of categories comprising different types of communications;

for each communication, prioritizing the communication based on the reputation vector associated with the communication, the prioritizing assigning a high priority to communications where the external entity is a reputable entity, and assigning a low priority to communications where the external entity is a non-reputable entity; and

performing a plurality of tests on the communications, each of the tests being performed for the communications according to the priorities of the communications so that an impact on a quality of service for reputable entities is minimized at the expense of a quality of service for non-reputable entities.