System and method of utilizing a dedicated computer security service

• US 9,667,657 B2
• Filed: 08/04/2015
• Issued: 05/30/2017
• Est. Priority Date: 08/04/2015
• Status: Active Grant

• Current Assignee: Lab A.O. Kaspersky
• Original Assignee: Lab A.O. Kaspersky
• Inventors: Efremov, Andrey A., Lapushkin, Anton S.
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US14/817,394
• Publication Number:
  US 20170041342A1
• Time in Patent Office: 665 Days
• Field of Search: 726 22, 726 23, 726 25, 726 1, 726 4, 726 5, 726 7, 726 8, 726 10
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1008 based on parameters of servers, e.g. available memory or workload monitoring of computer activity G06F11/30
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Disclosed are systems and method for utilizing a dedicated computer security service. An exemplary method includes storing in an electronic database rules that indicate when to use either a first cloud service or a second cloud service for one of the security services, receiving a request from a client computer to access the security service, determining parameters relating to the received request, applying the parameters to the plurality of rules to determine an instruction indicating whether to transmit the request to the first cloud service or the second cloud service; and transmitting the request to either the first cloud service or the second cloud service, based on the instruction, to use the at least one security service.

Claims

1. A method for utilizing computer security services, the method comprising:

storing, in an electronic database, a plurality of policies that indicate when to use either a private cloud service or a public cloud service configured to analyze software objects using different types of security services to determine whether the software objects are malicious,

wherein the policies relate to at least one of;

a predetermined time period when software of the private cloud service was last updated, a type of the at least one security service provided by the private cloud service, a type of data being sent in a request to the service, and a traffic quota of requests sent to at least one of the private or public service;

receiving a request from a client computer to access the at least one private or public cloud security service, wherein the request includes an unknown software object;

determining, by a processor, at least one parameter relating to the received request, including at least one of a type of the security service being accessed and a type of the software object included in the request, including one of a file, a link and a hash sum;

applying, by the processor, the at least one parameter to the plurality of policies to determine whether to transmit the request to the private cloud service or the public cloud service; and

based on the determination, transmitting the request to one of the private cloud service or the public cloud service.

2. The method of claim 1, wherein

the private cloud service and the public cloud service further configured to the generate application control rules that specify how to process the software objects on the client computer.

3. The method of claim 1, wherein the request from the client computer to access the at least one security service does not include an indication of whether to transmit the request to the private cloud service or the public cloud service.

4. The method of claim 1, wherein the request is initially transmitted to the private cloud service and then redirected to the public cloud service based on a determination made by the processor.

5. The method of claim 1, wherein the security services include one or more of a file reputation service, a link reputation service, a certificate reputation service, a behavioral detection service, a false positive control service, a content filtration service, a phishing service and a parental control service.

6. The method of claim 1, wherein the public cloud service and the private cloud services provide substantially similar security services and have substantially similar internal working logic for the analysis of software objects.

7. A system for utilizing computer security services, the system comprising:

an electronic database configured to store a plurality of policies that indicate when to use either a private cloud service or a public cloud service configured to analyze software objects using different types of security services to determine whether the software objects are malicious,

wherein the policies relate to at least one of;

a predetermined time period when software of the private cloud service was last updated, a type of the at least one security service provided by the private cloud service, a type of data being sent in a request to the service, and a traffic quota of requests sent to at least one of the private or public service;

a hardware processor configured to;

receive a request from a client computer to access the at least one private or public cloud security service, wherein the request includes an unknown software object;

determine at least one parameter relating to the received request, including at least one of a type of the security service being accessed and a type of the software object included in the request, including one of a file, a link and a hash sum;

apply the at least one parameter to the plurality of policies to determine whether to transmit the request to the private cloud service or the public cloud service; and

based on the determination, transmit the request to one of the private cloud service or the public cloud service.

8. The system of claim 7, wherein

the private cloud service and the public cloud service further configured to the generate application control rules that specify how to process the software objects on the client computer.

9. The system of claim 7, wherein the request from the client computer to access the at least one security service does not include an indication of whether to transmit the request to the private cloud service or the public cloud service.

10. The system of claim 7, wherein the request is initially transmitted to the private cloud service and then redirected to the public cloud service based on a determination made by the processor.

11. The system of claim 7, wherein the security services include one or more of a file reputation service, a link reputation service, a certificate reputation service, a behavioral detection service, a false positive control service, a content filtration service, a phishing service and a parental control service.

12. The system of claim 7, wherein the public cloud service and the private cloud services provide substantially similar security services and have substantially similar internal working logic for the analysis of software objects.

13. A non-transitory computer readable medium storing computer executable instructions for utilizing computer security services, including instructions for:

storing, in an electronic database, a plurality of policies that indicate when to use either a private cloud service or a public cloud service configured to analyze software objects using different types of security services to determine whether the software objects are malicious,

wherein the policies relate to at least one of;

a predetermined time period when software of the private cloud service was last updated, a type of the at least one security service provided by the private cloud service, a type of data being sent in a request to the service, and a traffic quota of requests sent to at least one of the private or public service;

receiving a request from a client computer to access the at least one private or public cloud security service, wherein the request includes an unknown software object;

determining, by a processor, at least one parameter relating to the received request, including at least one of a type of the security service being accessed and a type of the software object included in the request, including one of a file, a link and a hash sum;

applying, by the processor, the at least one parameter to the plurality of policies to determine whether to transmit the request to the private cloud service or the public cloud service; and

based on the determination, transmitting the request to one of the private cloud service or the public cloud service.

14. The non-transitory computer readable medium of claim 13, wherein the request from the client computer to access the at least one security service does not include an indication of whether to transmit the request to the private cloud service or the public cloud service.

15. The non-transitory computer readable medium of claim 13, wherein the request is initially transmitted to the private cloud service and then redirected to the public cloud service based on a determination made by the processor.

16. The non-transitory computer readable medium of claim 13, wherein the security services include one or more of a file reputation service, a link reputation service, a certificate reputation service, a behavioral detection service, a false positive control service, a content filtration service, a phishing service and a parental control service.

17. The non-transitory computer readable medium of claim 13, wherein the public cloud service and the private cloud services provide substantially similar security services and have substantially similar internal working logic for the analysis of software objects.

18. The non-transitory computer readable medium of claim 13, wherein the private cloud service and the public cloud service further configured to the generate application control rules that specify how to process the software objects on the client computer.