SYSTEM AND METHOD TO COMBINE MULTIPLE REPUTATIONS

• US 20160180084A1
• Filed: 12/23/2014
• Published: 06/23/2016
• Est. Priority Date: 12/23/2014
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Spurlock, Joel R., Teddy, John D.
• Granted Patent: US 10,083,295 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Particular embodiments described herein provide for an electronic device that can be configured to acquire a plurality of reputations related to an object and combine the plurality of reputations to create a total reputation for the object. The object can include a plurality of sub-objects and each of the plurality of reputations can correspond to one of the sub-objects.

Claims

1. At least one computer-readable medium comprising one or more instructions that when executed by at least one processor, cause the at least one processor to:

acquire a plurality of reputations related to an object, wherein the object includes a plurality of sub-objects and each of the plurality of reputations corresponds to one of the plurality of sub-objects; and

combine the plurality of reputations to create a total reputation for the object.

2. The at least one computer-readable medium of claim 1, wherein the object is an electronic device and the sub-objects are processes running on the electronic device and each of the plurality of reputations is a reputation related to one of the processes.

3. The at least one computer-readable medium of claim 1, wherein a Bayesian algorithm is used to combine the plurality of reputations.

4. The at least one computer-readable medium of claim 1, wherein each of the plurality of reputations includes a reputation confidence and a reputation weight.

5. The at least one computer-readable medium of claim 1, further comprising one or more instructions that when executed by the at least one processor, further cause the at least one processor to:

allow general remediation for a malicious reputation when an allow repair flag is set for a sub-object related to the malicious reputation.

6. The at least one computer-readable medium of claim 1, wherein at least one of the plurality of reputations for a sub-object was determined by combining multiple reputations for the sub-object.

7. The at least one computer-readable medium of claim 1, wherein the object is an electronic device and the total reputation for the object is communicated to a second electronic device.

8. The at least one computer-readable medium of claim 7, further comprising one or more instructions that when executed by the at least one processor, further cause the at least one processor to:

acquire, at the second electronic device, a plurality of reputations related to a plurality of objects connected to a network, wherein the object is included in the plurality of objects; and

combine the plurality of reputations to create a total reputation for the network.

9. An apparatus comprising:

reputation module configured to;

acquire a plurality of reputations related to an object, wherein the object includes a plurality of sub-objects and each of the plurality of reputations corresponds to one of the plurality of sub-objects; and

combine the plurality of reputations to create a total reputation for the object.

10. The apparatus of claim 9, wherein the object is an electronic device and the sub-objects are processes running on the electronic device and each of the plurality of reputations is a reputation related to one of the processes.

11. The apparatus of claim 9, wherein a Bayesian algorithm is used to combine the plurality of reputations.

12. The apparatus of claim 9, wherein each of the plurality of reputations includes a reputation confidence and a reputation weight.

13. The apparatus of claim 9, wherein the reputation module is further configured to:

allow general remediation for a malicious reputation when an allow repair flag is set for a sub-object related to the malicious reputation.

14. The apparatus of claim 9, wherein at least one of the plurality of reputations for a sub-object was determined by combining multiple reputations for the sub-object.

15. The apparatus of claim 9, wherein the object is an electronic device and the total reputation for the object is communicated to a second electronic device.

16. The apparatus of claim 15, wherein reputation module configured to:

acquire, at the second electronic device, a plurality of reputations related to a plurality of objects connected to a network, wherein the object is included in the plurality of objects; and

combine the plurality of reputations to create a total reputation for the network.

17. A method comprising:

acquiring a plurality of reputations related to an object, wherein the object includes a plurality of sub-objects and each of the plurality of reputations corresponds to one of the plurality of sub-objects; and

combining the plurality of reputations to create a total reputation for the object.

18. The method of claim 17, wherein the object is an electronic device and the sub-objects are processes running on the electronic device and each of the plurality of reputations is a reputation related to one of the processes.

19. The method of claim 17, wherein a Bayesian algorithm is used to combine the plurality of reputations.

20. The method of claim 17, wherein each of the plurality of reputations includes a reputation confidence and a reputation weight.

21. The method of claim 17, wherein at least one of the plurality of reputations for a sub-object was determined by combining multiple reputations for the sub-object.

22. The method of claim 17, wherein the object is an electronic device and the total reputation for the object is communicated to a second electronic device.

23. The method of claim 17, further comprising:

acquiring, at the second electronic device, a plurality of reputations related to a plurality of objects connected to a network, wherein the object is included in the plurality of objects; and

combining the plurality of reputations to create a total reputation for the network.

24. A system for combining multiple reputations, the system comprising:

a reputation module configured for;

acquiring a plurality of reputations related to an object, wherein the object includes a plurality of sub-objects and each of the plurality of reputations corresponds to one of the plurality of sub-objects; and

combining the plurality of reputations to create a total reputation for the object.

25. The system of claim 24, wherein a Bayesian algorithm is used to combine the plurality of reputations.