Social threat scoring

• US 9,027,134 B2
• Filed: 07/29/2014
• Issued: 05/05/2015
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: ZeroFOX, Inc. (ZeroFox Holdings, Inc.)
• Original Assignee: ZeroFOX, Inc. (ZeroFox Holdings, Inc.)
• Inventors: Foster, James C., Blair, Evan, Cullison, Christopher B., Francis, Robert
• Primary Examiner(s): Lipman, Jacob
• Application Number:
  US14/445,203
• Publication Number:
  US 20140337972A1
• Time in Patent Office: 280 Days
• Field of Search: 726/22
• US Class Current: 726/22
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles

Abstract

A method includes identifying data on a social network that is associated with a social entity, and determining one or more characteristics of the identified data. A reference to the identified data is generated for each of the one or more characteristics. Each generated reference is compared to one or more known references, and a risk score for a social entity is determined based on each of the comparisons. A confidence score for the risk score is determined.

Claims

1. A method comprising:

scanning data that is maintained on multiple social networks, wherein scanning comprises identifying, by one or more processors, data that is associated with a social entity;

determining one or more characteristics of the identified data;

generating, for each of the one or more characteristics, a reference to the identified data that indicates the characteristic;

algorithmically comparing one or more generated references to one or more known references, wherein the one or more known references are references to characteristics of identified data that have been assigned a level of risk, and wherein the one or more generated references that are compared to the one or more known references are dynamically selected from a group of generated references;

determining, based on the algorithmic comparisons, a risk score for a social entity; and

determining, based on a statistical algorithm, a confidence score for the risk score, wherein the confidence score indicates the reliability of the determined risk score.

2. The method of claim 1 further comprising:

comparing the determined confidence score against a confidence threshold;

determining, based on the comparison of the determined confidence score against the confidence threshold, the confidence score is below the confidence threshold;

scanning data that is maintained on multiple social networks, wherein scanning comprises identifying, by one or more processors, additional data that is associated with the social entity;

determining one or more additional characteristics of the additional identified data;

generating, for each of the one or more additional characteristics, a reference to the identified data that indicates the characteristic;

algorithmically comparing one or more generated references to one or more known references, wherein the one or more known references are references to characteristics of identified data that have been assigned a level of risk, and wherein the one or more generated references that are compared to the one or more known references are dynamically selected from a group of generated references;

determining, based on the algorithmic comparisons, a risk score for a social entity; and

determining, based on the statistical algorithm, a second confidence score for the second risk score, wherein the confidence score indicates the reliability of the determined second risk score.

3. The method of claim 1, wherein the one or more known references against which a generated reference is compared correlate to the generated reference.

4. The method of claim 1 wherein the risk score evaluates one or more security risks selected from the group consisting of impersonation, distribution of malware, phishing, and social engineering.

5. The method of claim 1, further comprising:

generating, based on the determined confidence score, a normalized risk score for the social entity.

6. The method of claim 5, further comprising:

comparing the normalized risk score for the social entity to a risk threshold;

determining that the normalized risk score exceeds the risk threshold; and

responsive to determining that the normalized risk score exceeds the risk threshold, initiating a security action.

7. The method of claim 6, wherein the security action comprises alerting a user to a risk posed by the social entity.

8. The method of claim 7, wherein alerting the user to the risk posed by the social entity comprises generating a web-based alert for the user, wherein the web-based alert includes the normalized risk score.

9. A system comprising:

one or more processing devices; and

one or more non-transitory computer-readable media coupled to the one or more processing devices having instructions stored thereon which, when executed by the one or more processing devices, cause the one or more processing devices to perform operations comprising;

scanning data that is maintained on multiple social networks, wherein scanning comprises identifying, by one or more processors, data that is associated with a social entity;

determining one or more characteristics of the identified data;

generating, for each of the one or more characteristics, a reference to the identified data that indicates the characteristic;

algorithmically comparing one or more generated references to one or more known references, wherein the one or more known references are references to characteristics of identified data that have been assigned a level of risk, and wherein the one or more generated references that are compared to the one or more known references are dynamically selected from a group of generated references;

determining, based on the algorithmic comparisons, a risk score for a social entity; and

determining, based on a statistical algorithm, a confidence score for the risk score, wherein the confidence score indicates the reliability of the determined risk score.

10. The system of claim 9 further comprising:

comparing the determined confidence score against a confidence threshold;

determining, based on the comparison of the determined confidence score against the confidence threshold, the confidence score is below the confidence threshold;

scanning data that is maintained on multiple social networks, wherein scanning comprises identifying, by one or more processors, additional data that is associated with the social entity;

determining one or more additional characteristics of the additional identified data;

generating, for each of the one or more additional characteristics, a reference to the identified data that indicates the characteristic;

algorithmically comparing one or more generated references to one or more known references, wherein the one or more known references are references to characteristics of identified data that have been assigned a level of risk, and wherein the one or more generated references that are compared to the one or more known references are dynamically selected from a group of generated references;

determining, based on the algorithmic comparisons, a risk score for a social entity; and

determining, based on the statistical algorithm, a second confidence score for the second risk score, wherein the confidence score indicates the reliability of the determined second risk score.

11. The system of claim 9, wherein the one or more known references against which a generated reference is compared correlate to the generated reference.

12. The system of claim 9, further comprising:

generating, based on the determined confidence score, a normalized risk score for the social entity.

13. The system of claim 12, further comprising:

comparing the normalized risk score for the social entity to a risk threshold;

determining that the normalized risk score exceeds the risk threshold; and

responsive to determining that the normalized risk score exceeds the risk threshold, initiating a security action.

14. The system of claim 13, wherein the security action comprises alerting a user to a risk posed by the social entity.

15. The system of claim 14, wherein alerting the user to the risk posed by the social entity comprises generating a web-based alert for the user, wherein the web-based alert includes the normalized risk score.

16. A non-transitory computer-readable storage device encoded with a computer program, the program comprising instructions that when executed by a data processing apparatus cause the data processing apparatus to perform operations comprising:

scanning data that is maintained on multiple social networks, wherein scanning comprises identifying, by one or more processors, data that is associated with a social entity;

determining one or more characteristics of the identified data;

generating, for each of the one or more characteristics, a reference to the identified data that indicates the characteristic;

algorithmically comparing one or more generated references to one or more known references, wherein the one or more known references are references to characteristics of identified data that have been assigned a level of risk, and wherein the one or more generated references that are compared to the one or more known references are dynamically selected from a group of generated references;

determining, based on the algorithmic comparisons, a risk score for a social entity; and

determining, based on a statistical algorithm, a confidence score for the risk score, wherein the confidence score indicates the reliability of the determined risk score.

17. The medium of claim 16 further comprising:

comparing the determined confidence score against a confidence threshold;

determining, based on the comparison of the determined confidence score against the confidence threshold, the confidence score is below the confidence threshold;

scanning data that is maintained on multiple social networks, wherein scanning comprises identifying, by one or more processors, additional data that is associated with the social entity;

determining one or more additional characteristics of the additional identified data;

generating, for each of the one or more additional characteristics, a reference to the identified data that indicates the characteristic;

algorithmically comparing one or more generated references to one or more known references, wherein the one or more known references are references to characteristics of identified data that have been assigned a level of risk, and wherein the one or more generated references that are compared to the one or more known references are dynamically selected from a group of generated references;

determining, based on the algorithmic comparisons, a risk score for a social entity; and

determining, based on the statistical algorithm, a second confidence score for the second risk score, wherein the confidence score indicates the reliability of the determined second risk score.

18. The medium of claim 16, further comprising:

generating, based on the determined confidence score, a normalized risk score for the social entity.

19. The medium of claim 16, further comprising:

comparing the normalized risk score for the social entity to a risk threshold;

determining that the normalized risk score exceeds the risk threshold; and

responsive to determining that the normalized risk score exceeds the risk threshold, initiating a security action.

20. The medium of claim 19, wherein the security action comprises alerting a user to a risk posed by the social entity.

21. The medium of claim 20, wherein alerting the user to the risk posed by the social entity comprises generating a web-based alert for the user, wherein the web-based alert includes the normalized risk score.