Real-time network updates for malicious content

• US 9,077,671 B2
• Filed: 08/14/2013
• Issued: 07/07/2015
• Est. Priority Date: 06/16/2005
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Dell Software, Inc. (Dell Technologies Inc.)
• Inventors: Yanovsky, Boris, Eikenberry, Scott D., Racham, Bhuvan, Bilogorskiy, Nick, Bhimaraju, Gayatri
• Primary Examiner(s): Siddiqi, Mohammad A
• Application Number:
  US13/967,210
• Publication Number:
  US 20130332552A1
• Time in Patent Office: 692 Days
• Field of Search: 709/206, 726/3, 726/12, 726/22, 726/25
• US Class Current: 1/1
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A global response network collects, analyzes, and distributes “cross-vector” threat-related information between security systems to allow for an intelligent, collaborative, and comprehensive real-time response.

Claims

1. A method for establishing the reputation of message components, the method comprising:

receiving a first update of aggregated reputation information of one or more constituent components from a data center by a security appliance;

receiving an electronic message by the security appliance;

disassembling the electronic message into the one or more constituent components at a by the security appliance;

identifying a reputation for each of the one or more constituent components by the security appliance, wherein at least one of the reputations identified is a bad reputation and corresponds to a vector that identifies one or more ports through which the electronic message might breach a network perimeter, information received over a first port includes a reference to information accessed over a second port, and the information accessed over the second port is associated with the vector that corresponds to the one or more constituent components with the at least one bad reputation;

transmitting the data regarding the identified reputation for each of the one or more constituent components from the security appliance to the data center, wherein the data center receives data regarding the one or more constituent components from a plurality of other security appliances and tabulates a second update to the aggregated reputation information of the one or more constituent components in part by vetting the identified reputation data against the data received from the plurality of other security appliances; and

receiving the second update to the aggregated reputation information from the data center by the security appliance.

2. The method of claim 1, wherein the reputation for each of the one or more constituent components are identified using the aggregated reputation information received from the data center.

3. The method of claim 1, wherein the reputation for each of the one or more constituent components are identified using at least one of an IP address, a URL, a file attachment, or an embedded image.

4. The method of claim 1, wherein the identified reputation data are vetted against the data received from the plurality of other security appliances using votes from the security apparatus against votes from the plurality of other security apparatus.

5. The method of claim 1, wherein updates to the aggregated reputation information are received periodically by the security appliance from the data center.

6. The method of claim 1, wherein the security appliance transmits the identified reputation information periodically to the data center.

7. The method of claim 1, wherein the data center polls the security appliance for the identified reputation information.

8. The method of claim 1, wherein the security appliance transmits the identified reputation information as a real time feed to the data center.

9. The method of claim 1, wherein the security appliance is a computing device operated by an end user.

10. The method of claim 5, wherein at least one of the plurality of periodic updates to the aggregated reputation information received includes information provided by a network administrator.

11. A non-transitory computer storage medium having embodied thereon a program executable by a processor to perform a method for establishing the reputation of message components, the method comprising:

receiving a first update of aggregated reputation information of one or more constituent components from a data center by a security appliance;

receiving an electronic message by the security appliance;

disassembling the electronic message into the one or more constituent components by the security appliance;

identifying a reputation for each of the one or more constituent components by the security appliance, wherein at least one of the reputations identified is a bad reputation and corresponds to a vector that identifies one or more ports through which the electronic message might breach a network perimeter, information received over a first port includes a reference to information accessed over a second port, and the information accessed over the second port is associated with the vector that corresponds to the one or more constituent components with the at least one bad reputation;

transmitting the data regarding the identified reputation for each of the one or more constituent components from the security appliance to the data center, wherein the data center receives data regarding the one or more constituent components from a plurality of other security appliances, and tabulates a second update to the aggregated reputation information of the one or more constituent components in part by vetting the identified reputation data against the data received from the plurality of other security appliances; and

receiving the second update to the aggregated reputation information from the data center by the security appliance.

12. The non-transitory computer readable storage medium of claim 11, wherein the reputation for each of the one or more constituent components are identified using the aggregated reputation information received from the data center.

13. The non-transitory computer readable storage medium of claim 11, wherein the reputation for each of the one or more constituent components are identified using at least one of an IP address, a URL, a file attachment, or an embedded image.

14. The non-transitory computer readable storage medium of claim 11, wherein the identified reputation data are vetted against the data received from the plurality of other security appliances using votes from the security apparatus against votes from the plurality of other security apparatus.

15. The non-transitory computer readable storage medium of claim 11, wherein updates to the aggregated reputation information are received periodically by the security appliance from the data center.

16. The non-transitory computer readable storage medium of claim 11, wherein the security appliance transmits the identified reputation information periodically to the data center.

17. The non-transitory computer readable storage medium of claim 11, wherein the data center polls the security appliance for the identified reputation information.

18. The non-transitory computer readable storage medium of claim 11, wherein the security appliance transmits the identified reputation information as a real time feed to the data center.

19. The non-transitory computer readable storage medium of claim 11, wherein the security appliance is a computing device operated by an end user.

20. The non-transitory computer readable storage medium of claim 15, wherein at least one of the plurality of periodic updates to the aggregated reputation information received includes information provided by a network administrator.