System, method, and computer program product for updating an algorithm

• US 8,849,734 B2
• Filed: 06/29/2010
• Issued: 09/30/2014
• Est. Priority Date: 06/29/2010
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Fredericksen, Robin Eric, Keir, Robin Malcolm
• Primary Examiner(s): Gaffin, Jeffrey A
• Assistant Examiner(s): Smith, Paulinho E
• Application Number:
  US12/826,606
• Publication Number:
  US 20130246320A1
• Time in Patent Office: 1,554 Days
• Field of Search: None
• US Class Current: 706/14
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system, method, and computer program product are provided for updating an algorithm. In use, feedback data associated with an identification of an object is received. Additionally, one or more algorithms are updated, based on the feedback data. Further, the updated algorithms are distributed.

Claims

1. A tangible non-transitory computer readable medium for revising one or more object identification algorithms, comprising:

computer code for receiving, at a global data repository via the Internet from a fact and truth collection module, feedback data associated with an identification of an object of a user system operating as part of an Intranet that includes a plurality of user systems, wherein said object includes one of;

an operating system, a computer system, and an application, and the feedback data is anonymized before being provided to the global data repository;

computer code for updating the one or more object identification algorithms for identifying an operating system inside the Intranet by training the one or more object identification algorithms based on the feedback data; and

computer code for distributing the one or more updated object identification algorithms to the plurality of user systems;

wherein one user system in the Intranet delays identifying the object and waits for the one or more updated object identification algorithms if the one user system fails to identify the object.

2. The non-transitory computer readable medium of claim 1, wherein the feedback data includes one or more facts that have been collected that are associated with the object.

3. The non-transitory computer readable medium of claim 1, wherein the feedback data includes one or more algorithms that are used to attempt to identify the object, utilizing the one or more facts.

4. The non-transitory computer readable medium of claim 1, wherein the feedback data includes one or more verified data elements.

5. The non-transitory computer readable medium of claim 1, wherein the feedback data includes an identifier of the object that is determined by the one or more object identification algorithms.

6. The non-transitory computer readable medium of claim 1, wherein the computer program product is operable such that the feedback data is received automatically.

7. The non-transitory computer readable medium of claim 1, wherein the one or more algorithms are updated by creating one or more new object identification algorithms and the one or more new object identification algorithms are distributed to the user systems as the one or more updated object identification algorithms.

8. The non-transitory computer readable medium of claim 1, wherein the one or more object identification algorithms are updated by refining the one or more object identification algorithms.

9. The non-transitory computer readable medium of claim 1, wherein the computer program product is operable such that the updated object identification algorithms replace one or more old object identification algorithms at a user system.

10. The non-transitory computer readable medium of claim 1, wherein the one or more object identification algorithms include a linear classifier.

11. The non-transitory computer readable medium of claim 1, wherein the computer program product is operable such that a data set is updated utilizing the feedback data, and one or more new object identification algorithms are defined using the updated data set.

12. The non-transitory computer readable medium of claim 1, wherein the one or more object identification algorithms include a decision tree algorithm.

13. The non-transitory computer readable medium of claim 1, wherein the one or more object identification algorithms include a Bayesian network algorithm.

14. The non-transitory computer readable medium of claim 12, wherein the computer program product is operable such that the one or more updated object identification algorithms are sent to all customers of a particular service.

18. The non-transitory computer readable medium of claim 1, wherein:

the object is an operating system operating inside the Intranet;

the feedback data comprises at least one of;

transmission control protocol (TCP) stack fingerprints, Internet Protocol (IP) stack fingerprints, open ports, TCP service banners, available services, credential access and an identification of the operating system based on any of the above using the object identification algorithm of the one or more algorithms.

15. A method for revising one or more object identification algorithms, comprising:

receiving, at a global data repository via the Internet from a fact and truth collection module, feedback data associated with an identification of an object of a user system operating as part of an Intranet that includes a plurality of user systems, wherein said object includes one of;

an operating system, a computer system, or an application, and the feedback data is anonymized before being provided to the global data repository;

updating the one or more object identification algorithms for identifying an operating system inside the Intranet by training the one or more object identification algorithms based on the feedback data; and

distributing the one or more updated algorithms to the plurality of user systems;

wherein one user system in the Intranet delays identifying the object and waits for the one or more updated object identification algorithms if the one user system fails to identify the object.

16. A system for revising one or more object identification algorithms, comprising:

a processor configured for;

receiving, at a global data repository via the Internet from a fact and truth collection module, feedback data associated with an identification of an object of a user system operating as part of an Intranet that includes a plurality of user systems, wherein said object includes one of;

an operating system, a computer system, and an application, and the feedback data is anonymized before being provided to the global data repository,

updating the one or more object identification algorithms for identifying an operating system inside the Intranet by training the one or more object identification algorithms based on the feedback data, and

distributing the one or more updated algorithms to the plurality of user systems;

wherein one user system in the Intranet delays identifying the object and waits for the one or more updated object identification algorithms if the one user system fails to identify the object.

17. The system of claim 16, wherein the processor is coupled to memory via a bus.