Computer security threat data collection and aggregation with user privacy protection

• US 8,239,668 B1
• Filed: 04/15/2009
• Issued: 08/07/2012
• Est. Priority Date: 04/15/2009
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Chen, Yi-Fen, Liu, Shuosen Robert
• Primary Examiner(s): Orgad, Edan
• Assistant Examiner(s): Kabir, Jahangir
• Application Number:
  US12/424,419
• Time in Patent Office: 1,210 Days
• Field of Search: 713/150, 726/11, 726/12, 726 22- 24, 706/45
• US Class Current: 713/150
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An endpoint computer in an enterprise network is configured to detect computer security threat events, such as presence of a computer virus. Upon detection of a threat event, the endpoint computer generates computer security threat data for the threat event. The threat data may include user identifiable data that can be used to identify a user in the enterprise network. The endpoint computer encrypts the user identifiable data prior to sending the threat data to a smart protection network or to an enterprise server where threat data from various enterprise networks are collected for analysis. The endpoint computer may also encrypt an identifier for the threat data and provide the encrypted identifier to the smart protection network and to an enterprise server in the enterprise network. The enterprise server may use the encrypted identifier to retrieve the threat data from the smart protection network to generate user-specific reports.

Claims

1. A system for collecting computer security threat data, the system comprising:

a first computer in a first computer network, the first computer detects a first computer security threat event and generates first computer security threat data for the first computer security threat event, the first computer security threat data comprising first user identifiable data that can be used to identify a first user in the first computer network, the first computer encrypts the first user identifiable data prior to sending the first computer security threat data to a protection server;

a second computer in a second computer network separate from the first computer network, the second computer detects a second computer security threat event and generates second computer security threat data for the second computer security threat event, the second computer security threat data comprising second user identifiable data that can be used to identify a second user in the second computer network, the second computer encrypts the second user identifiable data prior to sending the second computer security threat data to a protection server; and

the protection server computer receives and aggregates the first and second computer security threat data to identify a common computer security threat in both the first and second computer networks, the protection server computer not belonging to either the first or second computer network and cannot decrypt the encrypted first user identifiable data and the second user identifiable data.

2. The system of claim 1 wherein the common computer security threat comprises a computer virus.

3. The system of claim 1 wherein the first user identifiable data comprise a name of the first user.

4. The system of claim 1 wherein the first computer associates an identifier to the first computer security threat data, encrypts the identifier, and to send the encrypted identifier along with the encrypted first user identifiable data to the protection server.

5. The system of claim 4 wherein the identifier comprises a globally unique identifier (GUID).

6. The system of claim 4 further comprising:

an enterprise server computer in the first computer network; and

wherein the first computer sends the encrypted identifier to the enterprise server.

7. The system of claim 6 wherein the enterprise server computer retrieves the first computer security threat data from the protection server by providing the encrypted identifier to the protection server.