Multi-dimensional reputation scoring

• US 8,762,537 B2
• Filed: 06/04/2012
• Issued: 06/24/2014
• Est. Priority Date: 01/24/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Alperovitch, Dmitri, Foote-Lennox, Tomo, Gould, Jeremy, Greve, Paula, Hernandez, Alejandro Manuel, Judge, Paul, Krasser, Sven, Lange, Tim, Schneck, Phyllis Adele, Stecher, Martin, Tang, Yuchun, Trivedi, Aarjav Jyotindra Neeta, Willis, Lamar Lorenzo, Yang, Weilai, Zdziarski, Jonathan Alexander
• Primary Examiner(s): THIAW, CATHERINE B
• Application Number:
  US13/488,373
• Publication Number:
  US 20120239751A1
• Time in Patent Office: 750 Days
• Field of Search: 709/203, 709/206, 709223-226
• US Class Current: 709/226
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

Methods and systems for assigning reputation to communications entities include collecting communications data from distributed agents, aggregating the communications data, analyzing the communications data and identifying relationships between communications entities based upon the communications data.

Claims

1. A method comprising:

determining a first degree of relationship between a first entity in a plurality of entities participating in communications within a network and a second entity in the plurality of entities based on similarities between attributes of identified communications from the first entity and attributes of identified communications from the second entity, wherein the first entity has an unknown reputation and the second entity is associated with a reputable reputation determined for the second entity;

determining a second degree of relationship between the first entity and a third entity in the plurality of entities, the second degree of relationship based on similarities between attributes of communications from the first entity and attributes of communications from the third entity, wherein the third entity is associated with a non-reputable reputation determined for the third entity;

attributing, using at least one processor device, at least a portion of reputable qualities of the determined reputation of the second entity to the reputation of the first entity based on the first degree of relationship;

attributing, using at least one processor device, at least a portion of non-reputable qualities of the determined reputation of the third entity to the reputation of the first entity based on the second degree of relationship; and

updating the reputation of the first entity based on the attributed reputable qualities and attributed non-reputable qualities.

2. The method of claim 1, wherein the reputation of the first entity comprises indications of reputations of the first entity in a plurality of activity categories corresponding to communication activities engaged in by one or more of the plurality of entities.

3. The method of claim 2, further comprising:

selecting a set of interrogation engines from a plurality of interrogation engines to interrogate communications from the first entity, where the set of interrogation engines are selected based on whether the interrogation engines test for risks implicated by the indications of a reputation of the first entity in a plurality of activity categories.

4. The method of claim 2, wherein the indications of the reputation includes one or more of a reputation of the first entity for originating spam, a reputation of the first entity for originating image spam, a reputation of the first entity for originating attacks, a reputation of the first entity for intrusion, a reputation of the first entity for originating phishing communications, or a of the first entity reputation for originating bulk mail.

5. The method of claim 1, further comprising identifying the communications from collected communication data, wherein the attributes of communications from the first, second, and third entities are described in collected communication data.

6. The method of claim 1, wherein the communication data is collected from a plurality of sensor devices in the network.

7. The method of claim 1, further comprising communicating data specifying the updated reputation of the third entity to one or more of a plurality of agents deployed in the network, each of the agents associated with a respective security device operable to protect at least a portion of the network from communications that violate a policy associated with the respective portion of the network.

8. The method of claim 7, wherein one or more of the plurality of agents maintains local reputation information of the entities in the network, the local reputation information describing reputations of the entities within the corresponding portion of the network.

9. The method of claim 8, wherein a global reputation for one or more of the plurality of entities is generated based on an aggregation of two or more local reputations of the one or more entities.

10. The method of claim 7, wherein at least one agent applies a transform to the updated reputation based on a local bias associated with the corresponding portion of the network.

11. The method of claim 1, wherein the updated reputation of the first entity is used in determinations whether to allow communications from the first entity.

12. The method of claim 11, wherein determining whether to allow communications from the first entity includes comparing the updated reputation to a policy of the network.

13. The method of claim 1, further comprising:

identifying a particular identifier of the first entity associated with the communication attributes of the first entity; and

identifying a first of a plurality of identifiers for the second entity associated with the communication attributes of the first entity;

wherein determining the first degree of relationship includes determining an association between the particular identifier and the first identifier.

14. The method of claim 13, wherein the particular identifier and the first identifier are associated with a particular type of communication.

15. The method of claim 13, wherein the particular identifier is one of a plurality of identifiers for the first entity and the updated reputation is associated with the particular identifier and another reputation of the first entity is associated with another of the plurality of identifiers for the first entity.

16. The method of claim 1, further comprising assigning one of a set of behavioral profiles to the first entity based on the updated reputation.

17. The method of claim 1, wherein the communication attributes include geographical information, and the updated reputation is based upon geographical attribute similarities.

18. The method of claim 1, wherein each degree of relationship indicates a strength of relationship between the corresponding entity and the first entity, and the strength of relationship corresponds to how much of the qualities of the determined reputation of the corresponding entity are to be attributed to the reputation of the first entity.

19. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

determine a first degree of relationship between a first entity in a plurality of entities participating in communications within a network and a second entity in the plurality of entities, wherein the first degree of relationship indicates a strength of relationship between the first entity and second entity based on similarities between attributes of identified communications from the first entity and attributes of identified communications from the second entity, and the first entity has an unknown reputation and the second entity is associated with a reputable reputation determined for the second entity;

determine a second degree of relationship between the first entity and a third entity in the plurality of entities, wherein the second degree of relationship indicates a strength of relationship between the first entity and third entity based on similarities between attributes of communications from the first entity and attributes of communications from the third entity, and the third entity is associated with a non-reputable reputation determined for the third entity;

attribute at least a portion of reputable qualities of the determined reputation of the second entity to the reputation of the first entity based on the first degree of relationship;

attribute at least a portion of non-reputable qualities of the determined reputation of the third entity to the reputation of the first entity based on the second degree of relationship, wherein the amount of the qualities of the determined reputation of the corresponding entity to be attributed to the reputation of the first entity correspond to the respective strength of relationship between the corresponding entity and the first entity; and

update the reputation of the first entity based on the attributed reputable qualities and attributed non-reputable qualities.

20. A system comprising:

at least one processor device;

at least one memory element; and

a reputation engine adapted when executed by the at least one processor device to;

determine a first degree of relationship between a first entity in a plurality of entities participating in communications within a network and a second entity in the plurality of entities based on similarities between attributes of identified communications from the first entity and attributes of identified communications from the second entity, wherein the first entity has an unknown reputation and the second entity is associated with a reputable reputation determined for the second entity;

determine a second degree of relationship between the first entity and a third entity in the plurality of entities, the second degree of relationship based on similarities between attributes of communications from the first entity and attributes of communications from the third entity, wherein the third entity is associated with a non-reputable reputation determined for the third entity;

attribute at least a portion of reputable qualities of the determined reputation of the second entity to the reputation of the first entity based on the first degree of relationship;

attribute at least a portion of non-reputable qualities of the determined reputation of the third entity to the reputation of the first entity based on the second degree of relationship; and

updating the reputation of the first entity based on the attributes reputable qualities and attributed non-reputable qualities.

21. The system of claim 20, further comprising a plurality of sensors adapted to collect communication data within the network describing the attributes of communications from the plurality of entities, wherein the reputation engine utilizes the collected communication data in determining the first and second degrees of relationship.

22. The system of claim 20, further comprising a plurality of agents deployed in the network, each of the agents associated with a respective security device operable to protect at least a portion of the network from communications that violate a policy associated with the respective portion of the network, wherein the plurality of agents utilize reputation data describing reputations of the plurality of entities including the updated reputation.

23. The system of claim 22, wherein the plurality of agents are further adapted to generate local reputation information describing reputations of the plurality of entities based on communications involving a corresponding portion of the network.