IDENTIFYING MOBILE DEVICE REPUTATIONS

• US 20120174219A1
• Filed: 05/16/2011
• Published: 07/05/2012
• Est. Priority Date: 05/14/2010
• Status: Abandoned Application

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Hernandez, Alejandro Manuel, Judge, Paul, Krasser, Sven, Schneck, Phyllis Adele, Zdziarski, Jonathan Alexander
• Application Number:
  US13/108,671
• Publication Number:
  US 20120174219A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

Methods and systems for operation upon one or more data processors for assigning a reputation to a messaging entity by analyzing the attributes of the entity, correlating the attributes with known attributes to define relationships between entities sharing attributes, and attributing a portion of the reputation of one related entity to the reputation of the other related entity.

Claims

1. A method comprising:

collecting a plurality of data packets associated with one or more traffic streams from a network, the one or more traffic streams comprising communications between a plurality of entities associated with the network including one or more mobile entities;

correlating the data packets to identify a plurality of attributes associated with the plurality of entities coupled to the network, the plurality of entities comprising one or more mobile entities;

analyzing the plurality of attributes to identify relationships among entities based upon the identified attributes exhibiting commonalities between the entities or associated traffic streams; and

attributing at least a portion of a reputation from a known entity to at least an unknown mobile entity based upon identification of a relationship between the known entity and the unknown mobile entity.

2. The method of claim 1, wherein the identified attributes comprise evidentiary attributes and the method further comprises comparing the evidentiary attributes to one or more behavioral attributes, the behavioral attributes being characteristics associated with a known type of activity or entity.

3. The method of claim 1, wherein the relationship between the known entity and the unknown mobile entity is a network relationship.

4. The method of claim 1, wherein the attributes identifying a relationship between the known entity and the unknown mobile entity comprises one or more communications.

5. The method of claim 4, wherein the one or more communications comprise addresses including the known entity and the unknown mobile entity.

6. The method of claim 4, wherein the one or more communications comprise substantially similar communications associated with each of the known entity and the unknown mobile entity.

7. The method of claim 1, wherein the unknown mobile entity is a mobile communications device.

8. The method of claim 1, wherein attributes comprise behaviors exhibited by the entities.

9. The method of claim 1, further comprising determining whether to block a particular stream of the one or more traffic streams based upon the attributed reputation associated with one of the plurality of entities related to the particular stream.

10. The method of claim 1, further comprising:

detecting a high volume of data packets directed to a particular address; and

identifying patterns in the high volume of data packets;

correlating the patterns to known malicious patterns; and

attributing a reputation to the particular address based upon the correlation.

11. The method of claim 1, further comprising distributing attributed reputations to a plurality of reputation servers, each of the reputation servers being operable to route data packets based upon reputation information associated with a sender or a recipient.

12. The method of claim 1, wherein a set of attributes is common to a type of entity having already been defined with a reputation, and wherein that reputation can be attributed to the reputation of the unknown mobile entity.

13. The method of claim 1, further comprising the step of determining the portion of the reputation of the known entity which is to be attributed to the unknown mobile entity based upon the identified relationship.

14. A reputation system, the system comprising:

a data collection module operable to receive a plurality of data packets comprising data streams being transmitted across a network;

a correlation module operable to parse the plurality of data packets and to derive one or more attributes associated with a plurality of network entities, the plurality of network entities comprising at least one mobile entity associated with the data packets;

an analysis module operable to identify relationships between entities based upon the derived attributes exhibited by the plurality of entities or associated data packets; and

wherein the analysis module is further operable to attribute at least a portion of a reputation of a known entity from among the plurality of entities to an unknown mobile entity based upon identification of a relationship between the known entity and the unknown mobile entity.

15. The system of claim 14, wherein the identified attributes comprise evidentiary attributes and the correlation module is further operable to compare the evidentiary attributes to one or more behavioral attributes, the behavioral attributes being characteristics associated with a known type of activity or entity.

16. The system of claim 14, wherein the relationship between the known entity and the unknown mobile entity is a network relationship.

17. The system of claim 14, wherein the attributes associated with a relationship between the known entity and the unknown mobile entity comprises one or more communications.

18. The system of claim 17, wherein the one or more communications comprise addresses including the known entity and the unknown mobile entity.

19. The system of claim 17, wherein the one or more communications comprise substantially similar communications associated with each of the known entity and the unknown mobile entity.

20. The system of claim 14, a filtering module operable to block a particular stream from among the traffic streams based upon the attributed reputation associated with one of the plurality of entities related to the particular stream.

21. The system of claim 14, further comprising:

a detection module operable to detect a high volume of data packets directed to a particular address; and

a pattern identification module operable to identify patterns in the high volume of data packets;

wherein the correlation module is further operable to correlate the patterns to known malicious patterns; and

wherein the reputation module is operable to attribute a reputation to the particular address based upon the correlation.

22. The system of claim 14, further wherein the analysis module is further operable to distribute attributed reputations to a plurality of reputation servers, each of the reputation servers being operable to route data packets based upon reputation information associated with a sender or a recipient.

23. The system of claim 14, wherein a set of attributes is common to a type of entity having already been defined with a reputation, and wherein that reputation can be attributed to the reputation of the unknown mobile entity

24. The system of claim 14, wherein the reputation module is operable to determine which portion of the reputation of the known entity is to be attributed to the unknown mobile entity based upon the identified relationship.

25. The system of claim 14, wherein the data packets are generated in response to an execution of a mobile device application having a respective reputation, and attributing at least a portion of a reputation of a known entity from among the plurality of entities to an unknown mobile entity based upon identification of a relationship between the known entity and the unknown mobile entity comprises attributing a portion of the respective reputation of the mobile device application to the unknown mobile entity.

26. One or more computer readable media having software program code operable to identify relationships among network entities, comprising:

receiving a plurality of data packets, the plurality of data packets comprising one or more traffic streams communicating information on a network;

analyzing the plurality of data packets to identify one or more attributes of a plurality of entities associated with the data packets, the plurality of entities comprising at least one mobile entity;

identifying a relationship between a known entity and the at least one mobile entity based upon the identified attributes exhibited by the entities or an associated traffic stream; and

attributing at least a portion of a reputation from a known entity to an unknown mobile entity based upon identification of a relationship between the known entity and the unknown mobile entity.