Using Confidence About User Intent In A Reputation System

• US 20110040825A1
• Filed: 08/13/2009
• Published: 02/17/2011
• Est. Priority Date: 08/13/2009
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Antonov, Vadim, Zaveri, Ameet, Bogorad, Walter, Nachenberg, Carey, Ramzan, Zulfikar
• Granted Patent: US 9,081,958 B2
• Time in Patent Office: Days
• US Class Current: 709/203
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Reputations of objects are determined by a reputation system using reports from clients identifying the objects. Confidence metrics for the clients are generated using information determined from the reports. Confidence metrics indicate the amounts of confidence in the veracity of the reports. Reputation scores of objects are calculated using the reports from the clients and the confidence metrics for the clients. Confidence metrics and reputation scores are stored in correlation with identifiers for the objects. An object'"'"'s reputation score is provided to a client in response to a request.

Claims

1. A method of using a computer to determine a reputation of an object in a reputation system, comprising:

receiving reports from clients in the reputation system, the reports identifying an object detected at the clients;

determining information about the clients from the reports;

generating confidence metrics for the clients responsive to the determined information about the clients, the confidence metrics indicating amounts of confidence in the veracity of the reports received from the clients;

calculating a reputation score of the object responsive at least in part to the reports from the clients and the confidence metrics for the clients; and

storing the reputation score of the object.

2. The method of claim 1, wherein a report from a client includes a request for the reputation score of the object and further comprising:

providing the reputation score of the object to the client.

3. The method of claim 1, wherein the determined information about the clients includes an age of a client in the reputation system, and wherein a confidence metric for the client is based at least in part on the age of the client.

4. The method of claim 1, wherein the determined information about the clients includes a geographic location of a client in the reputation system, and wherein a confidence metric for the client is based at least in part on the geographic location of the client.

5. The method of claim 1, wherein the determined information about the clients includes a frequency of reports submitted by a client, and wherein a confidence metric for the client is based at least in part on the frequency of reports submitted by the client.

6. The method of claim 1, wherein calculating the reputation scores of the object comprises:

determining a prevalence of the object on the client in the reputation system based on the reports; and

calculating the reputation score of the object responsive at least in part to the prevalence of the object and the confidence metrics of the clients on which the object was detected.

7. The method of claim 1, wherein calculating the reputation score of the object comprises:

using a confidence metric threshold to identify clients having low confidence metrics;

determining a ratio of clients having low confidence metrics that submitted reports identifying the object to all clients that submitted reports identifying the object; and

calculating the reputation score of the object responsive at least in part to the determined ratio.

8. The method of claim 1, wherein calculating the reputation score of the object comprises:

using a confidence metric threshold to identify clients having high confidence metrics;

determining a ratio of clients having high confidence metrics that submitted reports identifying the object to all clients that submitted reports identifying the object; and

calculating the reputation score of the object responsive at least in part to the determined ratio.

9. The method of claim 1, wherein calculating the reputation score of the object comprises:

using a statistical machine learning algorithm to calculate the reputation score of the object.

10. A computer-readable storage medium storing executable computer program instructions for determining a reputation of an object in a reputation system, the computer program instructions comprising instructions for:

receiving reports from clients in the reputation system, the reports identifying an object detected at the clients;

determining information about the clients from the reports;

generating confidence metrics for the clients responsive to the determined information about the clients, the confidence metrics indicating amounts of confidence in the veracity of the reports received from the clients;

calculating a reputation score of the object responsive at least in part to the reports from the clients and the confidence metrics for the clients; and

storing the reputation score of the object.

11. The computer-readable storage medium of claim 10, wherein a report from a client includes a request for the reputation score of the object and the computer program instructions further comprise:

providing the reputation score of the object to the client.

12. The computer-readable storage medium of claim 10, wherein calculating the reputation score of the object comprises:

determining a prevalence of the object on the clients in the reputation system based on the reports; and

calculating the reputation score of the object responsive at least in part to the prevalence of the object and the confidence metrics of the clients on which the object was detected.

13. The computer-readable storage medium of claim 10, wherein calculating the reputation score of the object comprises:

using a confidence metric threshold to identify clients having low confidence metrics;

determining a ratio of clients having low confidence metrics that submitted reports identifying the object to all clients that submitted reports identifying the object; and

calculating the reputation score of the object responsive at least in part to the determined ratio.

14. The computer-readable storage medium of claim 10, wherein calculating the reputation score of the object comprises:

using a confidence metric threshold to identify clients having high confidence metrics;

determining a ratio of clients having high confidence metrics that submitted reports identifying the object to all clients that submitted reports identifying the object; and

calculating the reputation score of the object responsive at least in part to the determined ratio.

15. computer-readable storage medium of claim 10, wherein calculating the reputation score of the object comprises:

using a statistical machine learning algorithm to calculate the reputation score of the object.

16. A computer system for determining a reputation of an object in a reputation system, the computer system comprising:

a computer-readable storage medium storing executable computer program instructions, the computer program instructions comprising instructions for;

receiving reports from clients in the reputation system, the reports identifying an object detected at the clients;

determining information about the clients from the reports;

generating confidence metrics for the clients responsive to the determined information about the clients, the confidence metrics indicating amounts of confidence in the veracity of the reports received from the clients;

calculating a reputation score of the object responsive at least in part to the reports from the clients and the confidence metrics for the clients; and

storing the reputation score of the object;

a processor for executing the computer program instructions.

17. The computer system of claim 16, wherein a report from a client includes a request for the reputation score of the object and the computer program instructions further comprise:

providing the reputation score of the object to the client.

18. The computer system of claim 16, wherein calculating the reputation score of the object comprises:

determining a prevalence of the object on the clients in the reputation system based on the reports; and

calculating the reputation score of the object responsive at least in part to the prevalence of the object and the confidence metrics of the clients on which the object was detected.

19. The computer system of claim 16, wherein calculating the reputation score of the object comprises:

using a confidence metric threshold to identify clients having low confidence metrics;

determining a ratio of clients having low confidence metrics that submitted reports identifying the object to all clients that submitted reports identifying the object; and

calculating the reputation score of the object responsive at least in part to the determined ratio.

20. The computer system of claim 16, wherein calculating the reputation score of the object comprises:

using a confidence metric threshold to identify clients having high confidence metrics;

determining a ratio of clients having high confidence metrics that submitted reports identifying the object to all clients that submitted reports identifying the object; and

calculating the reputation score of the object responsive at least in part to the determined ratio.