Real-time network updates for malicious content

• US 9,672,359 B2
• Filed: 07/07/2015
• Issued: 06/06/2017
• Est. Priority Date: 06/16/2005
• Status: Expired due to Fees

• Current Assignee: Quest Software, Inc.
• Original Assignee: SonicWALL, Inc. (SonicWall Holdings Ltd.)
• Inventors: Eikenberry, Scott D., Bilogorskiy, Nick, Bhimaraju, Gayatri, Rachamreddy, Bhuvanasundar, Yanovsky, Boris
• Primary Examiner(s): Siddiqi, Mohammad A
• Application Number:
  US14/793,683
• Publication Number:
  US 20160026797A1
• Time in Patent Office: 700 Days
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A global response network collects, analyzes, and distributes “cross-vector” threat-related information between security systems to allow for an intelligent, collaborative, and comprehensive real-time response.

Claims

1. A method for establishing the reputation of message components, the method comprising:

transmitting over a network communication interface a request for data from a first electronic computing device;

receiving the requested data over the network communication interface;

executing instructions out of a memory, wherein execution of the instructions by a processor breaks the received data into a plurality of component parts, wherein the plurality of component parts are stored in a database;

receiving a first set of information from a second electronic computing device, wherein the received first set of information is associated with a bad reputation and includes a plurality of constituent components, and a processor at the second electronic computing device generates the plurality of constituent components from data contained in a message by breaking the data contained in the message into the plurality of constituent components;

comparing the received plurality of constituent components with the plurality of component parts;

identifying that at least one of the constituent components of the plurality of constituent components matches at least one of the component parts;

associating each of the plurality of component parts with a threat, wherein the database is updated with information indicating that the plurality of component parts are associated with the threat;

transmitting over a network communication interface a second request for additional data from the first electronic computing device;

receiving the additional requested data over the network communication interface;

breaking the additional received data into a plurality of additional component parts;

storing the plurality of additional component parts in the database;

receiving a second set of information from a second electronic computing device, wherein the received information is associated with the bad reputation and includes a plurality of additional constituent components, and the processor at the second electronic computing device generates the plurality of additional constituent components from data contained in a second message by breaking the data from the second message into the plurality of additional constituent components;

comparing the received plurality of additional constituent components with the plurality of additional component parts and with the plurality of constituent components;

identifying that at least one of the additional constituent components of the plurality of additional constituent components matches at least one of the plurality of additional component parts or at least one of the plurality of constituent components; and

associating each of the plurality of additional component parts with the threat, wherein the database is updated with information indicating that the plurality of additional component parts are associated with the threat.

2. The method of claim 1, further comprising:

periodically transmitting over the network communication interface requests for other additional data from the first electronic computing device;

receiving the plurality of other additional requested data over the network communication interface;

the processor executing instructions out of a memory breaking the received data into a plurality of other additional component parts; and

storing the other additional component parts in the database.

3. The method of claim 1, wherein the bad reputation associated with the first set of information is identified by the processor at the second electronic computing device according to one or more votes from one or more users.

4. The method of claim 1, wherein the bad reputation associated with the first set of information is identified by the processor executing instructions out of the memory at the second electronic computing device to include at least one of a computer virus or malware.

5. The method of claim 1, wherein the processor executing instructions out of the memory also generates a signature from the data contained in the message, the signature associated with a recognized pattern in the message.

6. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for performing a method for establishing the reputation of message components, the method comprising:

transmitting over a network communication interface a request for data from a first electronic computing device;

receiving the requested data over the network communication interface;

breaking the received data into a plurality of component parts, wherein the plurality of component parts are stored in a database;

receiving a first set of information from a second electronic computing device, wherein the received first set of information is associated with a bad reputation and includes a plurality of constituent components, and a processor at the second electronic computing device generates the plurality of constituent components from data contained in a message by breaking the data contained in the message into the plurality of constituent components;

comparing the received plurality of constituent components with the plurality of component parts;

identifying that at least one of the constituent components of the plurality of constituent components matches at least one of the component parts;

associating each of the plurality of component parts with a threat, wherein the database is updated with information indicating that the plurality of component parts are associated with the threat;

transmitting over a network communication interface a second request for additional data from the first electronic computing device;

receiving the additional requested data over the network communication interface;

breaking the additional received data into a plurality of additional component parts;

storing the plurality of additional component parts in the database;

receiving a second set of information from the second electronic computing device, wherein the received information is associated with the bad reputation and includes a plurality of additional constituent components, and the processor at the second electronic computing device generates the plurality of additional constituent components from data contained in a second message by breaking the data from the second message into the plurality of additional constituent components;

comparing the received plurality of additional constituent components with the plurality of additional component parts and with the plurality of constituent components;

identifying that at least one of the additional constituent components of the plurality of additional constituent components matches at least one of the plurality of additional component parts or at least one of the plurality of constituent components; and

associating each of the plurality of the plurality of additional component parts with the threat, wherein the database is updated with information indicating that the plurality of additional component parts are associated with the threat.

7. The non-transitory computer-readable storage medium of claim 6, the program further executable to:

periodically transmit over the network communication interface requests for other additional data from the first electronic computing device;

receive the other additional requested data over the network communication interface;

a processor executing instructions out of a memory breaking the received data into a plurality of more other additional component parts; and

store the plurality of more other additional component parts in a database.

8. The non-transitory computer-readable storage medium of claim 6, wherein the bad reputation associated with the first set of information is identified by the processor at the second electronic computing device according to one or more votes from one or more users.

9. The non-transitory computer-readable storage medium of claim 6, wherein the bad reputation associated with the first set of information is identified by the processor executing instructions out of the memory at the second electronic computing device to include at least one of a computer virus or malware.

10. The non-transitory computer-readable storage medium of claim 6, wherein the processor executing instructions out of the memory also generates a signature from the data contained in the message, the signature associated with a recognized pattern in the message.

11. A system for establishing the reputation of message components, the system comprising:

a data center electronic computing device including a processor, a memory, and one or more network communication interfaces, wherein the data center electronic computing device;

transmits over a network communication interface of the one or more network communication interfaces a request for data from a first electronic computing device;

receives the requested data over the network communication interface of the one or more network communication interfaces;

breaks the received data into a plurality of component parts, wherein the plurality of component parts are stored in a database; and

receives a first set of information from a second electronic computing device, wherein the received first set of information is associated with a bad reputation and includes a plurality of constituent components, and a processor at the second electronic computing device generates the plurality of constituent components from data contained in a message by breaking the data contained in the message into the plurality of constituent components;

compares the received plurality of constituent components with the plurality of component parts;

identifies that at least one of the constituent components of the plurality of constituent components matches at least one of the component parts;

associates each of the component parts with a threat, wherein the database is updated with information indicating that the component parts are associated with the threat;

transmits over a network communication interface of the one or more network communication interfaces a second request for additional data from the first electronic computing device;

receives the additional requested data over the network communication interface of the one or more network communication interfaces;

breaks the additional received data into a plurality of additional component parts;

stores the plurality of additional component parts in the database;

receives a second set of information from the second electronic computing device, wherein the received information is associated with the bad reputation and includes a plurality of additional constituent components, and the processor at the second electronic computing device generates the plurality of additional constituent components from data contained in a second message by breaking the data from the second message into the plurality of additional constituent components;

compares the received plurality of additional constituent components with the plurality of additional component parts and with the plurality of constituent components;

identifies that at least one of the additional constituent components of the plurality of additional constituent components matches at least one of the plurality of additional component parts or at least one of the plurality of constituent components; and

associates each of the plurality of the plurality of additional component parts with the threat, wherein the database is updated with information indicating that the plurality of additional component parts are associated with the threat.

12. The system of claim 11, wherein the data center electronic computing device:

periodically transmits over the network communication interface of the one or more network communication interfaces requests for other additional data from the first electronic computing device;

receives the other additional requested data over the network communication interface of the one or more network communication interfaces;

breaks the received data into a plurality of more other additional component parts; and

stores the plurality of more other additional component parts in the database.

13. The system of claim 11, wherein the bad reputation associated with the first set of information is identified by the processor at the second electronic computing device according to one or more votes from one or more users.

14. The system of claim 11, wherein the bad reputation associated with the first set of information is identified by the processor executing instructions out of the memory at the second electronic computing device to include at least one of a computer virus or malware.

15. The system of claim 11, wherein the processor executing instructions out of the memory at the second electronic computing device also generates a signature from the data contained in the message, the signature associated with a recognized pattern in the message.