System and method for dynamic network resource categorization re-assignment

• US 9,160,680 B1
• Filed: 11/18/2014
• Issued: 10/13/2015
• Est. Priority Date: 11/18/2014
• Status: Active Grant

• Current Assignee: Lab A.O. Kaspersky
• Original Assignee: Kaspersky Lab ZAO
• Inventors: Skvortsov, Vladimir A., Kolotinsky, Evgeny B.
• Primary Examiner(s): Whipple, Brian P
• Application Number:
  US14/546,822
• Time in Patent Office: 329 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 47/781 Centralised allocation of resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

System and method for categorizing a plurality of network resources. Collected properties of a network resource are analyzed to determine applicability of various predefined categories to that network resource. At least one category from among the predefined categories is assigned to that network resource according to a determination of applicability of the at least one category to the network resource. A resource-specific time interval for re-categorizing each one of the network resources is dynamically adjusted based on a plurality of previous categorization results for that network resource, such that different network resources will be associated with correspondingly different re-categorization intervals.

Claims

1. A system for categorizing a plurality of network resources, the system comprising:

a computing platform interfaced with a computer network, the computing platform including computing hardware of at least one processor, data storage, and input/output facilities, and an operating system implemented on the computing hardware; and

instructions that, when executed on the computing platform, cause the computing platform to implement;

a categorization engine configured to analyze collected properties of a network resource to determine applicability of various predefined categories to that network resource and to assign at least one category from among the predefined categories to that network resource according to a determination of applicability of the at least one category to the network resource; and

a categorization interval adjustment engine operatively coupled to the categorization engine and configured to dynamically adjust a resource-specific time interval for causing the categorization engine to re-categorize each one of the network resources based on a plurality of previous categorization results for that network resource, wherein different network resources are associated with correspondingly different re-categorization intervals.

2. The system of claim 1, wherein the categorization interval adjustment engine includes a network resource category change probability calculation engine operatively coupled to a category redefinition interval calculation engine, wherein the network resource category change probability calculation engine is configured to read categorization history for each network resource, including the plurality of previous categorization results, and, based on the categorization history, to compute a probability of categorization change, and wherein the category redefinition interval calculation engine is configured to compute a new network resource-specific re-categorization interval based on the probability of categorization change.

3. The system of claim 2, wherein the probability of categorization change is based on a ratio of durations during which various categories have been assigned to the network resource.

4. The system of claim 2, wherein the new network resource-specific re-categorization interval is bound by a maximum limit and a minimum limit.

5. The system of claim 1, wherein the various predefined categories include a category indicating malicious content present in a given network resource, and wherein the categorization interval adjustment engine is configured to dynamically adjust the resource-specific time interval, wherein:

in response to a categorization of malicious content in the network resource, the time interval is reduced by a first increment; and

in response to a categorization of non-malicious content in the network resource, the time interval is increased by a second increment;

wherein the first increment is larger than the second increment.

6. The system of claim 1, wherein the various predefined categories include a category indicating a suitability of content present in a given network resource, and wherein the categorization interval adjustment engine is configured to dynamically adjust the resource-specific time interval based on the category indicating the suitability of content.

7. The system of claim 1, wherein the various predefined categories include:

a first category indicating malicious content present in a given network resource; and

a second category indicating a suitability of content present in a given network resource;

wherein the categorization interval adjustment engine is configured to dynamically adjust the resource-specific time interval based on a combination of the first and the second categories.

8. The system of claim 1, wherein the various predefined categories include:

a first category indicating malicious content present in a given network resource; and

a second category indicating a suitability of content present in a given network resource;

wherein the categorization interval adjustment engine is configured to dynamically adjust the resource-specific time interval based on the first category but not the second category.

9. The system of claim 1, wherein the categorization engine includes a first portion operating on one of a plurality of local computer systems, and a second portion operating on a server situated remotely from any of the local computer systems, wherein the first portion is configured to perform a first categorization of a given network resource based on relatively basic analysis of the given network resource, and wherein the second portion is configured to perform a second categorization of the given network resource based on relatively comprehensive analysis of the given network resource.

10. The system of claim 9, wherein the second portion is configured to perform a re-categorization of the given network resource in response to a determined discrepancy between the first categorization and the second categorization.

11. A machine-implemented method for categorizing a plurality of network resources, the method comprising:

by a computer system, autonomously analyzing collected properties of a network resource to determine applicability of various predefined categories to that network resource and assigning at least one category from among the predefined categories to that network resource according to a determination of applicability of the at least one category to the network resource; and

by a computer system, autonomously dynamically adjusting a resource-specific time interval for re-categorizing each one of the network resources based on a plurality of previous categorization results for that network resource, wherein different network resources are associated with correspondingly different re-categorization intervals.

12. The method of claim 11, wherein dynamically adjusting a resource-specific time interval includes:

reading categorization history for each network resource, including the plurality of previous categorization results;

based on the categorization history, computing a probability of categorization change; and

computing a new network resource-specific re-categorization interval based on the probability of categorization change.

13. The method of claim 12, wherein the probability of categorization change is based on a ratio of durations during which various categories have been assigned to the network resource.

14. The method of claim 12, wherein the new network resource-specific re-categorization interval is bound by a maximum limit and a minimum limit.

15. The method of claim 11, wherein the various predefined categories include a category indicating malicious content present in a given network resource, and wherein the dynamically adjusting a resource-specific time interval is performed wherein:

in response to a categorization of malicious content in the network resource, the time interval is reduced by a first increment; and

in response to a categorization of non-malicious content in the network resource, the time interval is increased by a second increment;

wherein the first increment is larger than the second increment.

16. The method of claim 11, wherein the various predefined categories include a category indicating a suitability of content present in a given network resource, and wherein the dynamically adjusting a resource-specific time interval categorization interval adjustment engine is based on the category indicating the suitability of content.

17. The method of claim 11, wherein the various predefined categories include:

a first category indicating malicious content present in a given network resource; and

a second category indicating a suitability of content present in a given network resource;

wherein dynamically adjusting the resource-specific time interval is based on a combination of the first and the second categories.

18. The method of claim 11, wherein the various predefined categories include:

a first category indicating malicious content present in a given network resource; and

a second category indicating a suitability of content present in a given network resource;

wherein dynamically adjusting the resource-specific time interval is based on the first category but not the second category.

19. A machine-implemented system for categorizing a plurality of network resources, the system comprising:

means for analyzing collected properties of a network resource to determine applicability of various predefined categories to that network resource and assigning at least one category from among the predefined categories to that network resource according to a determination of applicability of the at least one category to the network resource; and

means for dynamically adjusting a resource-specific time interval for re-categorizing each one of the network resources based on a plurality of previous categorization results for that network resource, wherein different network resources are associated with correspondingly different re-categorization intervals.