Multi-dimensional reputation scoring

• US 9,009,321 B2
• Filed: 06/04/2012
• Issued: 04/14/2015
• Est. Priority Date: 01/24/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Alperovitch, Dmitri, Foote-Lennox, Tomo, Gould, Jeremy, Greve, Paula, Hernandez, Alejandro Manuel, Judge, Paul, Krasser, Sven, Lange, Tim, Schneck, Phyllis Adele, Stecher, Martin, Tang, Yuchun, Trivedi, Aarjav Jyotindra Neeta, Willis, Lamar Lorenzo, Yang, Weilai, Zdziarski, Jonathan Alexander
• Primary Examiner(s): THIAW, CATHERINE B
• Application Number:
  US13/488,417
• Publication Number:
  US 20120240228A1
• Time in Patent Office: 1,044 Days
• Field of Search: 709/209, 709223-226, 709/206, 715/700, 715/707, 715/708, 715/710, 715/711, 715/725, 715741-744, 715/747, 715/777, 715/833
• US Class Current: 709/226
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

Methods and systems for assigning reputation to communications entities include collecting communications data from distributed agents, aggregating the communications data, analyzing the communications data and identifying relationships between communications entities based upon the communications data.

Claims

1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

identify a range of values for each of a plurality of filter settings, wherein filter setting values define a level of tolerance for an associated classification of potential security violations in a network and the plurality of filter settings comprise a group of security settings and a group of policy settings;

cause presentation of a security control interface on a display device, the security control interface comprising a plurality of graphical security controls, each graphical security control representing a respective one of the plurality of filter settings and the corresponding range of values for the respective filter setting, wherein user adjustment of the range of values for each of the group of security settings is restricted to a respective subset of the corresponding range of values for the security setting, and each graphical security control in a subset of the plurality of graphical security controls representing the group of security settings and enabling user adjustment of the group of security settings indicates that the range of values for the corresponding security setting is restricted by presenting both the range of values permitted for the corresponding security setting and at least one of the range of values that is restricted for the corresponding security setting, and ranges of values for each filter setting in the group of policy settings are unconstrained;

receive a value for a particular one of the plurality of filter settings based on user interactions with a particular one of the plurality of graphical security controls corresponding to the particular filter setting;

adjust the particular filter setting based on the received value; and

cause communications in the network to be filtered based on the adjusted particular filter setting.

2. The non-transitory machine accessible storage medium of claim 1, wherein the particular filter setting is an adjusted filter setting of a particular user and applies to communication streams involving the particular user.

3. The non-transitory machine accessible storage medium of claim 2, wherein the user interactions are associated with the particular user.

4. The non-transitory machine accessible storage medium of claim 1, wherein the graphical security controls include a plurality of interactive security slider controls operable to be manipulated to correspond to values within a respective range of a corresponding filter setting.

5. The non-transitory machine accessible storage medium of claim 1, wherein each security filter is associated with one of a plurality of potential security violation categories.

6. The non-transitory machine accessible storage medium of claim 5, wherein the plurality of potential security violation categories includes a virus category, a phishing category, a worms category, a trojan horse category, a spam category, a content category, a spyware category, or a bulk mail category.

7. The non-transitory machine accessible storage medium of claim 1, wherein each value in each range of values indicates a relative level of filtering of a corresponding classification of potential security violations.

8. The non-transitory machine accessible storage medium of claim 1, wherein the subset of the range of values for the particular filter setting is limited to restrict at least one of selection of a value above a defined maximum value for the particular filter setting and selection of a value below a defined minimum value for the particular filter setting.

9. The non-transitory machine accessible storage medium of claim 1, wherein the network is filtered using a plurality of security agents deployed in the network, and the adjusted particular filter setting governs filtering of at least one particular security agent in the plurality of security agents.

10. The non-transitory machine accessible storage medium of claim 9, wherein the adjustment of the particular security agent applies to a particular user and communications involving the particular user are filtered at least in part using the particular security agent.

11. The non-transitory machine accessible storage medium of claim 9, wherein the security agents filter communications based on a reputation of at least one entity involved in the communications.

12. The non-transitory machine accessible storage medium of claim 11, wherein reputation of a particular entity is based on identified attribute similarities between the particular entity and at least one other entity with a determined reputation score.

13. The non-transitory machine accessible storage medium of claim 11, wherein the particular filter setting defines a local bias to be applied to reputations of entities involved in the communications.

14. A method comprising:

identifying a range of values for each of a plurality of filter settings, wherein filter setting values define a level of tolerance for an associated classification of potential security violations in a network and the plurality of filter settings comprise a group of security settings and a group of policy settings;

causing presentation of a security control interface on a display device, the security control interface comprising a plurality of graphical security controls, each graphical security control representing a respective one of the plurality of filter settings and the corresponding range of values for the respective filter setting, wherein user adjustment of the range of values for each of the group of security settings is restricted to a respective subset of the corresponding range of values for the security setting, and each graphical security control in a subset of the plurality of graphical security controls representing the group of security settings and enabling user adjustment of the setting group of security settings indicates that the range of values for the corresponding security setting is restricted by presenting both the range of values permitted for the corresponding security setting and at least one of the range of values that is restricted for the corresponding security setting, and ranges of values for each filter setting in the group of policy settings are unconstrained;

receiving a value for a particular one of the plurality of filter settings based on user interactions with a particular one of the plurality of graphical security controls corresponding to the particular filter setting;

adjusting the particular filter setting based on the received value; and

causing communications in the network to be filtered based on the adjusted particular filter setting.

15. A system comprising:

at least one processor device;

at least one memory element; and

a security control interface adapted when executed by the at least one processor device to;

present a security control interface including a plurality of interactive graphical security controls, each graphical security control representing a respective one of a plurality of filter settings and a corresponding range of values for each respective filter setting, wherein filter setting values define a level of tolerance for an associated classification of potential security violations, the plurality of filter settings comprise a group of security settings and a group of policy settings, and user adjustment of the range of values for each of the group of security settings is restricted to a respective subset of the corresponding range of values for the security setting, and each graphical security control in a subset of the plurality of graphical security controls represents a respective one of the group of security settings and enables user adjustment of the corresponding security setting, wherein each graphical security control in the subset is presented to indicate that the range of values for the corresponding security setting is restricted by presenting both the range of values permitted for the corresponding security setting and at least one of the range of values that is restricted for the corresponding security setting, wherein ranges of values for each filter setting in the group of policy settings are unconstrained; and

accept user interactions with the graphical security controls to identify user specified values for corresponding filter settings, wherein user specification of filter settings causes modification to values of the filter settings;

a security agent adapted to filter communications in a network according to the plurality of filter settings.

16. The system of claim 15, further comprising a reputation engine adapted to determine reputations of a plurality of entities involved in the communications in the network, wherein the security agent is further adapted to filter communications based on identified reputations of entities involved in the communications.

17. The system of claim 15, wherein adjustment of a filter setting value using the security control interface applies the adjustment of the filter setting to less than the entire network.

18. The system of claim 17, wherein the adjustment of the filter setting applies to communications involving a particular user associated with the adjustment.