REAL-TIME NETWORK UPDATES FOR MALICIOUS CONTENT

• US 20170316207A1
• Filed: 05/09/2017
• Published: 11/02/2017
• Est. Priority Date: 03/16/2009
• Status: Active Grant

• Current Assignee: SonicWALL US Holdings, Inc. (SonicWall Holdings Ltd.)
• Original Assignee: Quest Software, Inc.
• Inventors: Yanovsky, Boris, Eikenberry, Scott D., Rachamreddy, Bhuvanasundar, Bilogorskiy, Nick, Bhimaraju, Gayatri
• Granted Patent: US 10,089,466 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A global response network collects, analyzes, and distributes “cross-vector” threat-related information between security systems to allow for an intelligent, collaborative, and comprehensive real-time response.

Claims

1. A method for identifying network threats, the method comprising:

receiving data over a communication network from one or more real-time data feeds;

aggregating data from a plurality of sources regarding the one or more real-time data feeds;

breaking down the received data from the one or more real-time data feeds into a series of components;

generating a reputation scores for each component;

identifying that at least one of the real-time data feeds is associated with malicious content based on a reputation score of a component associated with the identified real-time data feed; and

blocking the identified real-time data feed based on the association with the malicious content.

2. The method of claim 1, wherein at least some of the series of components are thumbprints generated from at least a portion of the at least one real-time data feed.

3. The method of claim 1, further comprising generating a signature from the data from the at least one of the real-time data feed.

4. The method of claim 3, further comprising identifying that the signature is associated with a pattern that has a bad reputation, wherein blocking the identified real-time data feed is further based on the signature being associated with the pattern that has the bad reputation.

5. The method of claim 3, wherein the signature is associated with the malicious content, and at least one thumbprint generated from the at least one real-time data feed is not yet associated with the malicious content, and further comprising associating the at least one thumbprint with the bad reputation.

6. The method of claim 1, further comprising identifying a component reputation as good or bad for each of the series of components.

7. The method of claim 6, wherein the component reputation for each of the series of components is identified based on reputation information received from a data center.

8. The method of claim 6, wherein the component reputation for each of the series of components is identified based on at least one of an IP address, a URL, a file attachment, or an embedded image.

9. The method of claim 6, further comprising vetting the component reputations identified as good or bad against the data received from a plurality of security appliances using votes received from one or more user devices.

18. The non-transitory computer readable storage medium of claim 6, wherein the program further comprises instructions executable to vet the component reputations identified as good or bad against the data received from a plurality of security appliances using votes received from one or more user devices.

10. A non-transitory computer readable storage medium having embodied thereon a program executable by a processor for implementing a method for identifying network threats, the method comprising:

receiving data over a communication network from one or more real-time data feeds;

aggregating data from a plurality of sources regarding the one or more real-time data feeds;

breaking down the received data from the one or more real-time data feeds into a series of components;

generating a reputation scores for each component;

identifying that at least one of the real-time data feeds is associated with malicious content based on a reputation score of a component associated with the identified real-time data feed; and

blocking the identified real-time data feed based on the association with the malicious content.

11. The non-transitory computer readable storage medium of claim 10, wherein at least some of the series of components are thumbprints generated from at least a portion of the at least one real-time data feed.

12. The non-transitory computer readable storage medium of claim 10, wherein the program further comprises instructions executable to generate a signature from the data from the at least one of the real-time data feed.

13. The non-transitory computer readable storage medium of claim 12, wherein the program further comprises instructions executable to identify that the signature is associated with a pattern that has a bad reputation, wherein blocking the identified real-time data feed is further based on the signature being associated with the pattern that has the bad reputation.

14. The non-transitory computer readable storage medium of claim 12, wherein the signature is associated with the malicious content, and at least one thumbprint generated from the at least one real-time data feed is not associated with the malicious content, and wherein the program further comprises instructions executable to associate the at least one thumbprint with the bad reputation.

15. The non-transitory computer readable storage medium of claim 10, wherein the program further comprises instructions executable to identify a component reputation as good or bad for each of the series of components.

16. The non-transitory computer readable storage medium of claim 15, wherein the component reputation for each of the series of components is identified using reputation information received from a data center.

17. The non-transitory computer readable storage medium of claim 15, wherein the component reputation for each of the series of components is identified using at least one of an IP address, a URL, a file attachment, or an embedded image.

19. A system for identifying network threats, the system comprising:

a communication network interface of a computing device that receives data over a communication network from one or more real-time data feeds; and

a processor of the computing device that executes instructions stored in memory, wherein execution of the instructions by the processor;

aggregates data from a plurality of sources regarding the one or more real-time data feeds;

breaks down the received data from the one or more real-time data feeds into a series of components;

generates a reputation scores for each component;

identifies that at least one of the real-time data feeds is associated with malicious content based on a reputation score of a component associated with the identified real-time data feed; and

blocks the identified real-time data feed based on the association with the malicious content.

20. The system of claim 19, further comprising a plurality of security appliances communicatively coupled to the computing device, wherein the component reputations identified as good or bad are vetted against the data received from the plurality of security appliances using votes received from one or more user devices.