MULTI-DIMENSIONAL REPUTATION SCORING

• US 20140366144A1
• Filed: 06/16/2014
• Published: 12/11/2014
• Est. Priority Date: 01/24/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Alperovitch, Dmitri, Foote-Lennox, Tomo, Gould, Jeremy, Greve, Paula, Hernandez, Alejandro Manuel, Judge, Paul, Krasser, Sven, Schneck, Phyllis Adele, Stecher, Martin, Tang, Yuchun, Trivedi, Aarjav Jyotindra Neeta, Yang, Weilai, Zdziarski, Jonathan Alexander, Lange, Tim, Willis, Lamar Lorenzo
• Granted Patent: US 10,050,917 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

Methods and systems for assigning reputation to communications entities include collecting communications data from distributed agents, aggregating the communications data, analyzing the communications data and identifying relationships between communications entities based upon the communications data.

Claims

1-40. -40. (canceled)

41. At least one machine accessible storage medium having code stored thereon, the code when executed on a machine, causes the machine to:

provide analysis of traffic associated with a particular source to identify one or more attributes associated with the particular source;

for one or more of a plurality of security categories, provide a corresponding reputation category value for the particular source based at least in part on the one or more attributes; and

generate a view of a reputation of the particular source, wherein the view includes an indication of one or more of the reputation category values.

42. The storage medium of claim 41, wherein the code, when executed on the machine, further causes the machine to perform an action on data to be received from or sent to the particular source based on one or more of the reputation category values for the particular source.

43. The storage medium of claim 42, wherein at least a portion of a communication comprising the data is to be blocked based on the one or more reputation category values.

44. The storage medium of claim 41, wherein each reputation category value indicates a probability that the particular source is reputable in a corresponding security category.

45. The storage medium of claim 41, wherein the security category comprises an email reputation category.

46. The storage medium of claim 41, wherein the security category comprises a malware reputation category.

47. The storage medium of claim 41, wherein the security category comprises a web traffic reputation category.

48. The storage medium of claim 41, wherein the traffic comprises a plurality of communications involving the particular source on a network.

49. The storage medium of claim 48, wherein the data of the communications are collected by a plurality of agents on the network.

50. The storage medium of claim 41, wherein each of the reputation category value for the particular source are to be mapped to an IP address of the particular source.

51. The storage medium of claim 41, wherein at least a particular one of the reputation category values of the particular source is to be determined based on a comparison of attributes of the particular source with attributes of another known entity.

52. The storage medium of claim 51, wherein the other known entity comprises a plurality of known entities and the plurality of known entities include entities with reputable reputations and entities with non-reputable reputations for the particular reputation category value.

53. The storage medium of claim 41, wherein the particular source comprises at least one of a human user or an automated system.

54. The storage medium of claim 41, wherein at least one of the reputation category values comprises a local reputation and a global reputation.

55. The storage medium of claim 41, wherein the reputation category value is based on reputation data from a source and the code, when executed, further causes the machine to communicate over a network to obtain the reputation data from the source.

56. A method comprising:

providing analysis of traffic associated with a particular source to identify one or more attributes associated with the particular source;

for one or more of a plurality of security categories, providing a corresponding reputation category value for the particular source based at least in part on the one or more attributes; and

generating a view of a reputation of the particular source, wherein the view includes an indication of one or more of the reputation category values.

57. The method of claim 56, further comprising causing communications involving the particular source to be processed based on one or more of the reputation category values.

58. The method of claim 56, receiving reputation data from a source, wherein the reputation category values are based on the reputation data.

59. A system comprising:

one or more processor devices;

a storage device; and

one or more software components that, when executed on the one or more processing devices, cause the system to;

provide analysis of traffic associated with a particular source to identify one or more attributes associated with the particular source;

for one or more of a plurality of security categories, provide a corresponding reputation category value for the particular source based at least in part on the one or more attributes; and

generate a view of a reputation of the particular source, wherein the view includes an indication of one or more of the reputation category values.

60. The system of claim 59, further comprising a reputation server to calculate the one or more of the reputation category values.

61. The system of claim 60, wherein the reputation server calculates reputation category values for a plurality of sources including the particular source.

62. The system of claim 60, wherein the reputation server calculates the reputation category values from data describing traffic associated with the particular source.

63. The system of claim 59, further comprising a plurality of agents, wherein each agent is to monitor traffic on a network and generate data describing the traffic, and the data is used to determine the reputation category values.

64. At least one machine accessible storage medium having code stored thereon, the code when executed on a machine, to cause the machine to:

provide analysis of traffic associated with a particular source to identify one or more attributes associated with the particular source;

for one or more of a plurality of security categories, provide a corresponding reputation category value for the particular source based at least in part on the one or more attributes; and

generate a view of a reputation of the particular source, wherein the view includes an indication of one or more of the security categories.

65. The storage medium of claim 64, wherein the view further comprises an indication of one or more of the reputation category values.