Real-time network updates for malicious content

• US 8,522,347 B2
• Filed: 03/16/2010
• Issued: 08/27/2013
• Est. Priority Date: 03/16/2009
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Yanovsky, Boris, Eikenberry, Scott D., Bhimaraju, Gayatri, Racham, Bhuvan, Bilogorskiy, Nick
• Primary Examiner(s): Colin, Carl
• Assistant Examiner(s): Siddiqi, Mohammad A
• Application Number:
  US12/661,470
• Publication Number:
  US 20110016527A1
• Time in Patent Office: 1,260 Days
• Field of Search: 726/23, 726/22, 709/206
• US Class Current: 726/23
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A global response network collects, analyzes, and distributes “cross-vector” threat-related information between security systems to allow for an intelligent, collaborative, and comprehensive real-time response.

Claims

1. A method for establishing the reputation of message components, the method comprising:

disassembling an electronic mail message into constituent components at a security appliance coupled to an end-user computing device that processes electronic mail;

identifying a reputation for each of the constituent components, the identified reputation based on aggregated data specific to the constituent component and received from a data center;

processing one or more of the constituent components at the security appliance using a hash process to create a thumbprint of the one or more constituent components; and

transmitting the thumbprints from the security appliance to the data center for subsequent processing and distribution to other security appliances, wherein each of the transmitted thumbprints has a corresponding reputation.

2. The method of claim 1, wherein the corresponding reputation for one or more of the transmitted thumbprints is good.

3. The method of claim 1, wherein the corresponding reputation for one or more of the transmitted thumbprints is bad.

4. The method of claim 1, wherein the hash process is non-reversible.

5. The method of claim 1, wherein the transmitted thumbprints are transmitted over an encoded HTTPS connection.

6. The method of claim 1, wherein at least one of the votes is from a desktop application executing at a computing device coupled to the security appliance.

7. The method of claim 1, wherein at least one of the votes is from an enterprise server.

8. The method of claim 1, wherein the corresponding reputation for one or more of the transmitted thumbprints is an anonymously assigned reputation.

9. The method of claim 1, further comprising receiving updated thumbprints from the data center, the updated thumbprints compiled from a plurality of other security appliances on a global communications network.

10. The method of claim 9, further comprising using the updated thumbprints compiled from a plurality of other security appliances on the global communications network to filter electronic mail messages including constituent components associated with a thumbprint from having a particular reputation from entering a secure network.

11. A system for establishing the reputation of message components, the system comprising:

a security appliance coupled to an end-user computing device that processes electronic mail, the security appliance comprising;

a processor for executing instructions stored in memory, wherein execution of the instructions by the processor;

disassembles an electronic mail message into constituent components,

identifies a reputation for each of the constituent components, the identified reputation based on aggregated data specific to the constituent component and received from a data center,

processes one or more of the constituent components using a hash process to create a thumbprint of the one or more constituent components; and

a communications interface for transmitting the thumbprints to a data center for subsequent processing and distribution to other security appliances, wherein each of the transmitted thumbprints has a corresponding reputation.

12. The system of claim 11, wherein the transmitted thumbprints are transmitted over an encoded HTTPS connection.

13. The system of claim 11, wherein the communications interface receives at least one of the votes from a desktop application executing at a computing device coupled to the security appliance.

14. The system of claim 11, wherein the communications interface receives at least one of the votes from an enterprise server.

15. The system of claim 11, wherein the corresponding reputation for one or more of the transmitted thumbprints is an anonymously assigned reputation.

16. The system of claim 11, wherein the communications interface further receives updated thumbprints from the data center, the updated thumbprints compiled from a plurality of other security appliances on a global communications network.

17. The system of claim 12, wherein further execution of instructions by the processor uses the updated thumbprints compiled from a plurality of other security appliances on the global communications network to filter electronic mail messages including constituent components associated with a thumbprint from having a particular reputation from entering a secure network.

18. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor to perform a method for establishing the reputation of message components, the method comprising:

disassembling an electronic mail message into constituent components at a security appliance coupled to an end-user computing device that processes electronic mail;

identifying a reputation for each of the constituent components, the identified reputation based on aggregated data specific to the constituent component and received from a data center;

processing one or more of the constituent components at the security appliance using a hash process to create a thumbprint of the one or more constituent components; and

transmitting the thumbprints from the security appliance to the data center for subsequent processing and distribution to other security appliances, wherein each of the transmitted thumbprints has a corresponding reputation.