Correlation and analysis of entity attributes

• US 7,949,716 B2
• Filed: 01/24/2007
• Issued: 05/24/2011
• Est. Priority Date: 01/24/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Tang, Yuchun, Hernandez, Alejandro Manuel, Krasser, Sven, Alperovitch, Dmitri, Schneck, Phyllis Adele, Zdziarski, Jonathan Alexander, Judge, Paul
• Primary Examiner(s): JEAN GILLES, JUDE
• Application Number:
  US11/626,462
• Publication Number:
  US 20080177691A1
• Time in Patent Office: 1,581 Days
• Field of Search: 709/229, 709/219, 709/217, 370/467, 370/252
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Methods and systems for operation upon one or more data processors for assigning a reputation to a messaging entity by analyzing the attributes of the entity, correlating the attributes with known attributes to define relationships between entities sharing attributes, and attributing a portion of the reputation of one related entity to the reputation of the other related entity.

Claims

1. A computer implemented method operable to assign a reputation to a messaging entity associated with a received communication, the method comprising:

receiving a communication from a first entity;

deriving, using one or more processors, one or more attributes of the first entity based upon the received communication;

analyzing the attributes of the first entity;

retrieving, from computer memory, known attribute information for a plurality of known entities;

correlating, using the one or more processors, the derived attributes of the first entity to the known attribute information;

defining, using the one or more processors, a relationship between the first entity and one or more other entities selected from the plurality of known entities based upon the first entity and the one or more other entities sharing at least one common attribute or common patterns of attributes; and

attributing, using the one or more processors, a portion of a first reputation associated with one of the first or the one or more other entities to a second reputation associated the other of the first or the one or more other entities based upon the defined relationship and said at least one common attribute or common patterns of attributes.

2. The method of claim 1, wherein the attributes comprise evidentiary attributes used to identify association between entities.

3. The method of claim 2, further comprising determining whether the evidentiary attributes associated with an entity correspond to known attributes comprising a behavioral profile defined by a set of behavioral attributes, the determination being made by comparing the evidentiary attributes to the set of behavioral attributes.

4. The method of claim 3, wherein a behavioral profile for a spammer defines an entity that has a reputation for sending unwanted communications.

5. The method of claim 3, wherein the behavioral profile defines an entity that has a reputation for sending fraudulent communications.

6. The method of claim 3, wherein the behavioral profile defines an entity that has a reputation for sending legitimate messages.

7. The method of claim 3, wherein the behavioral profile defines an entity that has a reputation for hacking into networks.

8. The method of claim 3, wherein the behavioral profile defines an entity that has a reputation for intrusion into proprietary networks.

9. The method of claim 3, wherein the behavioral profile defines an entity that has a reputation for sending bulk mail.

10. The method of claim 3, wherein the behavioral profile defines an entity that has a reputation for sending malicious communications including viruses.

11. The method of claim 3, wherein the behavioral profile defines an entity that has a reputation for forging legitimate websites.

12. The method of claim 3, wherein a set of attributes is common to a type of entity having already been defined with a reputation, and wherein that reputation can be given to or considered in the creation of the reputation of the first entity.

13. The method of claim 1, further comprising the step of determining how any relationships between the first entity and the one or more other entities affects the reputation associated with one or more of the first entity or the one or more other entities.

14. The method of claim 1, wherein analyzing the attributes associated with the first entity comprises deriving Wends based upon parameters including one or more of geopolitical events, date, company type, critical infrastructure sector, location of the first entity, the time of day, or holidays.

31. The method of claim 1, wherein the first entity is the source of the communication.

15. A reputation system operable to receive a communication directed to a network and to assign a reputation to the communication, the system comprising:

a communications interface operable to receive communications entering a network from a first entity;

a communication analyzer operable to derive one or more attributes associated with the received communication including the first entity associated with the origination of the message;

a correlation module operable to retrieve known attribute information from a system data store and to compare the derived attributes from the received communication with known attribute information to identify a relationship between the first entity and one or more other entities, the correlation module being further operable to identify new attribute information and incorporate new attribute information into the system data store and communication analyzer;

wherein the system data store is operable to store known attribute information associated with a plurality of entities comprising the one or more entities from which a reputation system has previously received messages; and

a reputation assignment module operable to use the identified relationship to attribute at least a portion of a first reputation associated with one of the first or the one or more other entities with a second reputation associated with the other of the first or the one or more other entities.

16. The system of claim 15, wherein the attributes comprise evidentiary attributes used to identify relationships between entities.

17. The system of claim 16, wherein the reputation module is further operable to compare the evidentiary attributes of the first entity with a set of behavioral attributes associated with any of a plurality of behavioral profiles, a selected behavioral profile among the plurality of behavioral profiles defining at least one type of entity to which the first entity shares some characteristics.

18. The system of claim 17, wherein the behavioral profiles define one or more of a set of behavioral profiles including a spammer, a scammer, a legitimate sender, a bulk mailer, a hacker, a virus source, an intruder, a malicious source, or an innocuous source.

19. The system of claim 15, wherein the reputation assignment module is operable to determine what portion of the reputation of a first or one or more other entities to assign to the reputation of the other of the first or one or more other entities based upon the identified relationship.

20. The system of claim 15, wherein the reputation assignment module is operable to determine what portion of the reputation of a first or one or more other entities to assign to the reputation of the other of the first or one or more other entities based upon the attributes which the first entity shares with the one or more other entities.

21. The system of claim 15, wherein the known attribute information is derived from collection of communications at a plurality of edge protection devices, the edge protection devices protecting a plurality of different networks.

22. The system of claim 15, wherein the received communication is any of an electronic mail message, a hypertext transfer protocol communication, an instant message, a file transfer protocol communication, a short message service communication, a universal resource locator request, or a voice over internet protocol communication.

23. The system of claim 15, further comprises communication interrogation module operable to determine whether the communication is a legitimate communication by running a plurality of tests on the communication.

24. The system of claim 23, wherein results associated with the plurality of tests are embodied in a vector which is compared against illegitimate vectors associated with unwanted messages to determine whether the communication is legitimate.

25. The system of claim 24, wherein the vector is also compared against legitimate vectors associated with known legitimate messages to determine whether the communication is legitimate.

26. The system of claim 25, wherein illegitimate vectors and legitimate vectors are combined to determine a single result, the single result identifying one or more behavioral profiles associated with an entity.

27. The system of claim 15, further comprising a forwarding module operable to forward the communication to a recipient associated with the communication.

28. The system of claim 27, wherein the forwarding module is configured to quarantine the communication if a reputation associated with the first entity is non-reputable.

29. The system of claim 15, wherein the reputation of various entities is derived from both the probability that a communication from an originating entity is reputable as well as the probability that a communication from the originating entity is non-reputable.

30. One or more non-transitory computer readable storage media encoded with software program code operable to assign a reputation to a messaging entity associated with a received communication, the software code operable to cause one or more machine to perform operations comprising:

analyzing a communication to derive one or more attributes of a first entity associated with the communication;

retrieving known attribute information for a plurality of known entities;

comparing the attributes of the first entity to the known attribute information;

identifying a relationship between the first entity and a second entity selected from the plurality of known entities based upon the first entity and the second entity sharing one or more common attributes; and

attributing at least a portion of a first reputation associated with one of the first or second entity to a second reputation associated the other of the first or second entity based upon the identified relationship and the common attribute.