Agent assisted malicious application blocking in a network environment
First Claim
1. At least one non-transitory machine readable storage medium encoded with instructions for blocking malware, wherein the instructions, when executed by at least one processor, cause the processor to:
- receive metadata of a process intercepted on an end host when attempting to access a network, wherein the metadata includes a hash of an application associated with the process and an endpoint reputation score of the application, the endpoint reputation score assigned by the end host to the application to indicate a degree of maliciousness of the application determined by the end host;
request a threat intelligence reputation score based on the hash of the application;
determine an action to be taken by the end host based, at least in part, on one or more policies and at least one of the threat intelligence reputation score and the endpoint reputation score; and
send a response to the end host indicating the action to be taken by the end host, wherein, if the action includes allowing a network session established by the process to continue, the end host is to monitor the network session to identify any dynamic link library (DLL) invoked by the application that indicates some degree of maliciousness based on activities performed by the DLL for the application.
10 Assignments
0 Petitions
Accused Products
Abstract
Embodiments are configured to receive metadata of a process intercepted on an end host when attempting to access a network. The metadata includes a hash of an application associated with the process and an endpoint reputation score of the application. Embodiments are configured to request a threat intelligence reputation score based on the hash of the application, to determine an action to be taken by the end host based, at least in part, on one or more policies and at least one of the threat intelligence reputation score and the endpoint reputation score, and to send a response indicating the action to be taken by the end host. Further embodiments request another threat intelligence reputation score based on another hash of a dynamic link library module loaded by the process on the end host, and the action is determined based, at least in part, on the other threat intelligence score.
475 Citations
25 Claims
-
1. At least one non-transitory machine readable storage medium encoded with instructions for blocking malware, wherein the instructions, when executed by at least one processor, cause the processor to:
-
receive metadata of a process intercepted on an end host when attempting to access a network, wherein the metadata includes a hash of an application associated with the process and an endpoint reputation score of the application, the endpoint reputation score assigned by the end host to the application to indicate a degree of maliciousness of the application determined by the end host; request a threat intelligence reputation score based on the hash of the application; determine an action to be taken by the end host based, at least in part, on one or more policies and at least one of the threat intelligence reputation score and the endpoint reputation score; and send a response to the end host indicating the action to be taken by the end host, wherein, if the action includes allowing a network session established by the process to continue, the end host is to monitor the network session to identify any dynamic link library (DLL) invoked by the application that indicates some degree of maliciousness based on activities performed by the DLL for the application. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19)
-
-
20. An apparatus for blocking malware, the apparatus comprising:
-
at least one memory element; at least one processor coupled to the at least one memory element; an endpoint intelligence server running on the at least one processor, wherein the endpoint intelligence server is configured to; receive metadata of a process intercepted on an end host when attempting to access a network, wherein the metadata includes a hash of an application associated with the process and an endpoint reputation score of the application, the endpoint reputation score assigned by the end host to the application to indicate a degree of maliciousness of the application determined by the end host; request a threat intelligence reputation score based on the hash of the application; determine an action to be taken by the end host based, at least in part, on one or more policies and at least one of the threat intelligence reputation score and the endpoint reputation score; and send a response to the end host indicating the action to be taken by the end host, wherein, if the action includes allowing a network session established by the process to continue, the end host is to monitor the network session to identify any dynamic link library (DLL) invoked by the application that indicates some degree of maliciousness based on activities performed by the DLL for the application. - View Dependent Claims (21, 22, 23)
-
-
24. A method for blocking malware, the method comprising:
-
receiving metadata of a process intercepted by at least one processor of an end host when attempting to access a network, wherein the metadata includes a hash of an application associated with the process and an endpoint reputation score of the application, the endpoint reputation score assigned by the end host to the application to indicate a degree of maliciousness of the application determined by the end host; requesting a threat intelligence reputation score based on the hash of the application; determining, by one or more processors of a network security device, an action to be taken by the end host based, at least in part, on one or more policies and at least one of the threat intelligence reputation score and the endpoint reputation score; and sending a response to the end host indicating the action to be taken by the end host, wherein, if the action includes allowing a network session established by the process to continue, the end host is to monitor the network session to identify any dynamic link library (DLL) invoked by the application that indicates some degree of maliciousness based on activities performed by the DLL for the application. - View Dependent Claims (25)
-
Specification