System and method for malware and network reputation correlation

• US 9,661,017 B2
• Filed: 08/31/2015
• Issued: 05/23/2017
• Est. Priority Date: 03/21/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Alperovitch, Dmitri, Krasser, Sven
• Primary Examiner(s): ZAIDI, SYED A
• Application Number:
  US14/840,826
• Publication Number:
  US 20150373033A1
• Time in Patent Office: 631 Days
• Field of Search: 726 24
• CPC Class Codes: G06F 16/148 File search processing
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method is provided in one example embodiment and includes receiving a reputation value based on a hash of a file making a network connection and on a network address of a remote end of the network connection. The network connection may be blocked if the reputation value indicates the hash or the network address is associated with malicious activity. In more specific embodiments, the method may also include sending a query to a threat analysis host to request the reputation value. Additionally or alternatively the reputation value may be based on query patterns in particular embodiments. In yet more specific embodiments, the network connection may be an inbound connection and/or an outbound connection, and the reputation value may be based on a file reputation associated with the hash and a connection reputation associated with the network address of the remote end of the network connection.

Claims

1. At least one non-transitory tangible medium comprising logic encoded therein, and when executed by one or more processors the logic causes the one or more processors to:

receive a first reputation query including a first network address of a first remote end and a first hash of a first file, the first file associated with a first endhost and an attempt to establish a first network connection to the first remote end;

identify the first file as malicious based on determining the first network address is associated with a malicious reputation;

receive a second reputation query including a second network address of a second remote end and a second hash of a second file, the second file associated with a second endhost and an attempt to establish a second network connection to the second remote end; and

identify the second network address as malicious based on determining the second hash corresponds to the first hash, wherein the second network address is different from the first network address.

2. The at least one non-transitory tangible medium of claim 1, wherein the logic, when executed by the one or more processors, causes the one or more processors to:

based on identifying the first file as malicious, adjust a first file reputation associated with the first file to indicate the first file is malicious.

3. The at least one non-transitory tangible medium of claim 1, wherein the first file is identified as malicious without analyzing the first file.

4. The at least one non-transitory tangible medium of claim 1, wherein the logic, when executed by the one or more processors, causes the one or more processors to:

based on identifying the second network address as malicious, adjust a network address reputation associated with the second network address to indicate the second network address is malicious.

5. The at least one non-transitory tangible medium of claim 4, wherein the logic, when executed by the one or more processors, causes the one or more processors to:

receive a third reputation query including the second network address and a third hash of a third file, the third file associated with a third endhost and an attempt to establish a third network connection to the second remote end; and

identify the third file as malicious based on the network address reputation of the second network address indicating the second network address is malicious.

6. The at least one non-transitory tangible medium of claim 5, wherein a third file reputation associated with the third hash is unknown when the third reputation query is received.

7. The at least one non-transitory tangible medium of claim 5, wherein the logic, when executed by the one or more processors, causes the one or more processors to:

based on identifying the third file as malicious, adjust a third file reputation associated with the third file to indicate the third file is malicious.

8. The at least one non-transitory tangible medium of claim 5, wherein the third file is identified as malicious without analyzing the third file.

9. The at least one non-transitory tangible medium of claim 5, wherein the logic, when executed by the one or more processors, causes the one or more processors to:

assign a reputation value to the third network connection based on the network address reputation of the second network address.

10. The at least one non-transitory tangible medium of claim 5, wherein the first, second, and third hashes are cryptographic hashes.

11. The at least one non-transitory tangible medium of claim 1, wherein the logic, when executed by the one or more processors, causes the one or more processors to:

assign a reputation value to the first network connection based on a first network address reputation of the first network address.

12. The at least one non-transitory tangible medium of claim 1, wherein the logic, when executed by the one or more processors, causes the one or more processors to:

assign a reputation value to the second network connection based on a first file reputation.

13. The at least one non-transitory tangible medium of claim 1, wherein the first and second network connections are each one of an inbound connection or an outbound connection.

14. An apparatus, the apparatus comprising:

at least one processor; and

an analyzer module coupled to the at least one processor, the analyzer module to;

receive a first reputation query including a first network address of a first remote end and a first hash of a first file, the first file associated with a first endhost and an attempt to establish a first network connection to the first remote end;

identify the first file as malicious based on determining the first network address is associated with a malicious reputation;

receive a second reputation query including a second network address of a second remote end and a second hash of a second file, the second file associated with a second endhost and an attempt to establish a second network connection to the second remote end; and

identify the second network address as malicious based on determining the second hash corresponds to the first hash, wherein the second network address is different from the first network address.

15. The apparatus of claim 14, wherein the analyzer module is to:

based on identifying the first file as malicious, adjust a first file reputation associated with the first file to indicate the first file is malicious.

16. The apparatus of claim 14, wherein the first file is identified as malicious without analyzing the first file.

17. The apparatus of claim 14, wherein the analyzer module is to:

based on identifying the second network address as malicious, adjust a network address reputation associated with the second network address to indicate the second network address is malicious.

18. The apparatus of claim 17, wherein the analyzer module is to:

receive a third reputation query including the second network address and a third hash of a third file, the third file associated with a third endhost and an attempt to establish a third network connection to the second remote end; and

identify the third file as malicious based on the network address reputation of the second network address indicating the second network address is malicious.

19. The apparatus of claim 18, wherein a third file reputation associated with the third hash is unknown when the third reputation query is received.

20. The apparatus of claim 18, wherein the analyzer module is to:

based on identifying the third file as malicious, adjust a third file reputation associated with the third file to indicate the third file is malicious.

21. The apparatus of claim 18, wherein the third file is identified as malicious without analyzing the third file.

22. A method for navigational route selection, the method comprising:

receiving a first reputation query including a first network address of a first remote end and a first hash of a first file, the first file associated with a first endhost and an attempt to establish a first network connection to the first remote end;

identifying the first file as malicious based on determining the first network address is associated with a malicious reputation;

receiving a second reputation query including a second network address of a second remote end and a second hash of a second file, the second file associated with a second endhost and an attempt to establish a second network connection to the second remote end; and

identifying the second network address as malicious based on determining the second hash corresponds to the first hash, wherein the second network address is different from the first network address.

23. The method of claim 22, further comprising:

receiving a third reputation query including the second network address and a third hash of a third file, the third file associated with a third endhost and an attempt to establish a third network connection to the second remote end; and

identifying the third file as malicious based on a network address reputation of the second network address if the network address reputation indicates the second network address is malicious indicating the second network address is malicious.