Simplified Communication of a Reputation Score for an Entity

• US 20090328209A1
• Filed: 06/30/2008
• Published: 12/31/2009
• Est. Priority Date: 06/30/2008
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Nachenberg, Carey S.
• Granted Patent: US 8,595,282 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A reputation server is coupled to multiple clients via a network. A security module in each client monitors client encounters with entities such as files, programs, and websites, and then computes a hygiene score based on the monitoring. The hygiene scores are then provided to the reputation server, which computes reputation scores for the entities based on the clients'"'"' hygiene scores and the interactions between the clients and the entity. When a particular client encounters an entity, the security module obtains a reputation score for the entity from the reputation server. The reputation score may comprises a statistical measure based on a number of other trustworthy or “good hygiene” clients that have a hygiene score above a threshold. The client communicates this reputation score to a user with a message indicating that the reputation score is based on other clients deemed trustworthy.

Claims

1. A computer-implemented method for communicating an entity'"'"'s reputation to a user, the method comprising:

determining hygiene scores associated with a plurality of clients, the hygiene scores representing assessments of the trustworthiness of the clients;

encountering an entity by one of the plurality of clients;

identifying a set of trustworthy clients based on the hygiene scores of the clients;

calculating a reputation score for the entity as a function of the trustworthy clients that have used the entity, wherein the calculated reputation score represents an assessment of whether the entity is malicious; and

presenting the reputation score on the client that encountered the entity, the reputation score accompanied by a message indicating that the reputation score is based on other clients deemed trustworthy.

2. The method of claim 1, wherein the reputation score comprises a measure of a ratio of clients that have used the entity that are trustworthy clients to all clients that have used the entity.

3. The method of claim 1, wherein the reputation score comprises a measure of a number of clients that have used the entity that are trustworthy clients.

4. The method of claim 1, wherein the reputation score comprises a mathematical transformation of the hygiene scores of a set of clients that have used the entity.

5. The method of claim 1, wherein the message comprises a statistic about use of the entity by one or more trustworthy clients.

6. The method of claim 1, wherein the entity is a file, and encountering the entity comprises downloading or attempting to download the entity.

7. The method of claim 1, wherein the entity is a website, and encountering the entity comprises viewing or attempting to view the website.

8. The method of claim 1, wherein the trustworthy clients are the set of clients that have a hygiene score above a threshold.

9. A computer-implemented method for communicating a reputation of an entity to a user, the reputation based on a plurality of other clients, each client having a hygiene score representing an assessment of the trustworthiness of the client, the method comprising:

encountering an entity at a client;

receiving a reputation score that represents an assessment of whether the entity is malicious, wherein the reputation score comprises a statistical measure of use of the entity by other trustworthy clients, a trustworthy client defined as a client that has a hygiene score above a threshold;

communicating the reputation score via an output device of the client; and

communicating a message indicating that the reputation score is based on other clients deemed trustworthy.

10. The method of claim 9, wherein the reputation score comprises a measure of a ratio of clients that have used the entity that are trustworthy clients to all clients that have used the entity.

11. The method of claim 9, wherein the reputation score comprises a measure of a number of clients that have used the entity that are trustworthy clients.

12. The method of claim 9, wherein the reputation score comprises a mathematical transformation of the hygiene scores of a set of clients that have used the entity.

13. The method of claim 9, wherein the message comprises information about use of the entity by one or more trustworthy clients.

14. The method of claim 9, wherein the entity is a file, and encountering the entity comprises downloading or attempting to download the entity.

15. The method of claim 9, wherein the entity is a website, and encountering the entity comprises viewing or attempting to view the website.

16. A computer program product for communicating an entity'"'"'s reputation to a user, the computer program product comprising a computer-readable storage medium containing computer program code for:

determining hygiene scores associated with a plurality of clients, the hygiene scores representing assessments of the trustworthiness of the clients;

encountering an entity by one of the plurality of clients;

determining a set of trustworthy clients based on the hygiene scores of the clients;

calculating a reputation score for the entity as a function of the trustworthy clients that have used the entity, wherein the calculated reputation score represents an assessment of whether the entity is malicious; and

presenting the reputation score on the client that encountered the entity, the reputation score accompanied by a message indicating that the reputation score is based on other clients deemed trustworthy.

17. The computer program product of claim 16, wherein the reputation score comprises a measure of a ratio of clients that have used the entity that are trustworthy clients to all clients that have used the entity.

18. The computer program product of claim 16, wherein the reputation score comprises a measure of a number of clients that have used the entity that are trustworthy clients.

19. The computer program product of claim 16, wherein the reputation score comprises a mathematical transformation of the hygiene scores of a set of clients that have used the entity.

20. The computer program product of claim 16, wherein the message comprises a statistic about use of the entity by one or more trustworthy clients.

21. The computer program product of claim 16, wherein the entity is a file, and encountering the entity comprises downloading or attempting to download the entity.

22. The computer program product of claim 16, wherein the entity is a website, and encountering the entity comprises viewing or attempting to view the website.

23. The computer program product of claim 16, wherein the trustworthy clients are the set of clients that have a hygiene score above a threshold.

24. A computer-implemented method for communicating a reputation of an entity to a user, the reputation based on a plurality of other clients, each client having a hygiene score representing an assessment of the trustworthiness of the client, the method comprising:

encountering an entity at a client;

receiving a reputation score that represents an assessment of whether the entity is malicious, wherein the reputation score comprises a statistical measure of use of the entity by other trustworthy clients, a trustworthy client defined as a client that has a hygiene score above a threshold;

communicating the reputation score via an output device of the client; and

communicating a message indicating that the reputation score is based on other clients deemed trustworthy.

25. The computer program product of claim 24, wherein the reputation score comprises a measure of a ratio of clients that have used the entity that are trustworthy clients to all clients that have used the entity.

26. The computer program product of claim 24, wherein the reputation score comprises a measure of a number of clients that have used the entity that are trustworthy clients.

27. The computer program product of claim 24, wherein the reputation score comprises a mathematical transformation of the hygiene scores of a set of clients that have used the entity.

28. The computer program product of claim 24, wherein the message comprises information about use of the entity by one or more trustworthy clients.

29. The computer program product of claim 24, wherein the entity is a file, and encountering the entity comprises downloading or attempting to download the entity.

30. The computer program product of claim 24, wherein the entity is a website, and encountering the entity comprises viewing or attempting to view the website.