DETERMINING A REPUTATION THROUGH NETWORK CHARACTERISTICS

• US 20160182538A1
• Filed: 12/23/2014
• Published: 06/23/2016
• Est. Priority Date: 12/23/2014
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Teddy, John D., Venugopalan, Ramnath, Cochin, Cedric, Spurlock, Joel R.
• Granted Patent: US 9,769,186 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

Particular embodiments described herein provide for an electronic device that can be configured to monitor network traffic to and from a device, compare the monitored network traffic to characteristics of the device to determine if the monitored traffic is outside the characteristics of the device, and take remedial action if the monitored traffic is outside the characteristics of the device.

Claims

1. At least one computer-readable medium comprising one or more instructions that when executed by at least one processor, cause the process to:

monitor network traffic to and from a device;

compare the monitored network traffic to characteristics of the device to determine if the monitored traffic is outside the characteristics of the device; and

assign an untrusted reputation to the device if the monitored traffic is outside the characteristics of the device.

2. The at least one computer-readable medium of claim 1, wherein the device characteristics are created from previous network traffic to and from the device.

3. The at least one computer-readable medium of claim 1, wherein the device characteristics are at least partially based on other device characteristics of similar devices.

4. The at least one computer-readable medium of claim 1, wherein the device characteristics are obtained from an original equipment manufacturer.

5. The at least one computer-readable medium of claim 1, further comprising one or more instructions that when executed by the at least one processor, further cause the processor to:

monitor network traffic to and from a plurality of devices on a local network;

compare the monitored network traffic to and from each of the plurality of devices to characteristics of each of the plurality of devices;

determine if the monitored network traffic to and from a specific device is outside characteristics of the specific device; and

initiate remedial action if the monitored traffic is outside the characteristics of the specific device.

6. The at least one computer-readable medium of claim 1, wherein the characteristics at least partially include uploading sensitive data.

7. The at least one computer-readable medium of claim 1, wherein the remedial action includes restricting network access for the device.

8. The at least one computer-readable medium of claim 1, wherein the remedial action includes scanning the device for malware.

9. An apparatus comprising:

behavior reputation module configured to;

monitor network traffic to and from a device;

compare the monitored network traffic to characteristics of the device to determine if the monitored traffic is outside the characteristics of the device; and

assign an untrusted reputation to the device if the monitored traffic is outside the characteristics of the device.

10. The apparatus of claim 9, wherein the device characteristics are created from previous network traffic to and from the device.

11. The apparatus of claim 9, wherein the device characteristics are at least partially based on other device characteristics of similar devices.

12. The apparatus of claim 9, wherein the device characteristics are obtained from an original equipment manufacturer.

13. The apparatus of claim 9, wherein the behavior reputation module is further configured to:

monitor network traffic to and from a plurality of devices on a local network;

compare the monitored network traffic to and from each of the plurality of devices to characteristics of each of the plurality of devices;

determine if the monitored network traffic to and from a specific device is outside characteristics of the specific device; and

initiate remedial action if the monitored traffic is outside the characteristics of the specific device.

14. The apparatus of claim 9, wherein the characteristics at least partially include uploading sensitive data.

15. The apparatus of claim 9, wherein the remedial action includes restricting network access for the device.

16. The apparatus of claim 9, wherein the remedial action includes scanning the device for malware.

17. A method comprising:

monitoring network traffic to and from a device;

comparing the monitored network traffic to characteristics of the device to determine if the monitored traffic is outside the characteristics of the device; and

assigning an untrusted reputation to the device if the monitored traffic is outside the characteristics of the device.

18. The method of claim 17, wherein the device characteristics are created from previous network traffic to and from the device.

19. The method of claim 17, wherein the device characteristics are at least partially based on other device characteristics of similar devices.

20. The method of claim 17, wherein the device characteristics are obtained from an original equipment manufacturer.

21. The method of claim 17, further comprising:

monitoring network traffic to and from a plurality of devices on a local network;

comparing the monitored network traffic to and from each of the plurality of devices to characteristics of each of the plurality of devices;

determining if the monitored network traffic to and from a specific device is outside characteristics of the specific device; and

initiating remedial action if the monitored traffic is outside the characteristics of the specific device.

22. The method of claim 17, wherein the characteristics at least partially include uploading sensitive data.

23. The method of claim 17, wherein the remedial action includes restricting network access for the device.

24. A system for determining a reputation through network characteristics, the system comprising:

a behavior reputation module configured for;

monitoring network traffic to and from a device;

comparing the monitored network traffic to characteristics of the device to determine if the monitored traffic is outside the characteristics of the device; and

assigning an untrusted reputation to the device if the monitored traffic is outside the characteristics of the device.

25. The system of claim 24, wherein the system is further configured for:

monitoring network traffic to and from a plurality of devices on a local network;

comparing the monitored network traffic to and from each of the plurality of devices to characteristics of each of the plurality of devices;

determining if the monitored network traffic to and from a specific device is outside characteristics of the specific device; and

initiating remedial action if the monitored traffic is outside the characteristics of the specific device.