# US 10,122,753 B2 · Using reputation to avoid false malware detections > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,753 B2 - Document ID: US10122753B2 - Status: Granted - Kind: B2 - Application number: 14/263,977 - Filed: 2014-04-28 - Published: 2015-10-29 - Granted: 2018-11-06 - Earliest claimed: 2014-04-28 - Assignees: Sophos Limited - Applicants: Sophos Limited - Inventors: Andrew J. Thomas - Web page: https://patentgrep.com/patent/US10122753B2 ## CPC - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A variety of techniques are disclosed for detection of advanced persistent threats and similar malware. In one aspect, the detection of certain network traffic at a gateway is used to trigger a query of an originating endpoint, which can use internal logs to identify a local process that is sourcing the network traffic. In another aspect, an endpoint is configured to periodically generate and transmit a secure heartbeat, so that an interruption of the heartbeat can be used to signal the possible presence of malware. In another aspect, other information such as local and global reputation information is used to provide context for more accurate malware detection. ## Claims ### Claim 1 A system comprising: an endpoint associated with an enterprise, the endpoint including a computing device comprising a memory and a processor, the endpoint executing a process from a file, the process, during execution, opening a data file for manipulation, and the endpoint configured to evaluate a local reputation of the file using one or more local criteria including a first criterion based on a user executing the process and to evaluate the local reputation of the file further based on evaluating one or more of an origin of the data file, evaluating a reputation of an environment for the data file, evaluating a reputation of a user that created the data file, and evaluating a reputation of the process using the data file; a gateway associated with the enterprise and coupled in a communicating relationship with the endpoint, the gateway configured to detect the process executing from the file on the endpoint and to request a global reputation of the file from a remote resource, the gateway further configured to enforce a network policy of the enterprise by detecting network traffic from the endpoint in violation of the network policy and providing a violation notification to the remote resource in response to the network traffic; and a threat management facility associated with the enterprise and coupled in a communicating relationship with the gateway and the endpoint, the threat management facility configured to receive the request from the gateway and to determine a global reputation of the file, the threat management facility further configured to receive the local reputation from the endpoint and the violation notification from the gateway, wherein the threat management facility is configured to respond to the violation notification by determining a remedial action for the file on the endpoint based upon the local reputation evaluated by the endpoint using the first criterion based on the user executing the process from the file, the global reputation of the file determined by the threat management facility, and the violation notification from the gateway in response to the network traffic from the endpoint in violation of the network policy. ### Claim 2 (depends on 1) The system of claim 1 wherein evaluating the local reputation includes using locally available attributes applied by a local whitelisting system. ### Claim 3 (depends on 1) The system of claim 1 wherein evaluating the local reputation includes locally evaluating a source of the file. ### Claim 4 (depends on 1) The system of claim 1 wherein the violation includes a prohibited Uniform Resource Identifier in the network traffic from the endpoint. ### Claim 5 (depends on 1) The system of claim 1 wherein the violation includes a prohibited domain in the network traffic from the endpoint. ### Claim 6 (depends on 1) The system of claim 1 wherein the violation includes a command and control location for an advanced persistent threat in the network traffic from the endpoint. ### Claim 7 (depends on 1) The system of claim 1 wherein the violation includes prohibited content in the network traffic from the endpoint. ### Claim 8 (depends on 7) The system of claim 7 wherein the prohibited content includes command and control protocol traffic for an advanced persistent threat. ### Claim 9 (depends on 1) The system of claim 1 wherein responding to the violation notification includes treating the endpoint as a compromised network asset includes quarantining the endpoint. ### Claim 10 (depends on 1) The system of claim 1 wherein responding to the violation notification includes treating the endpoint as a compromised network asset includes blocking network access for a network. ### Claim 11 (depends on 1) The system of claim 1 wherein the threat management facility is further configured to locate one or more other endpoints containing the file or the process. ### Claim 12 (depends on 11) The system of claim 11 wherein the threat management facility is further configured to quarantine the one or more other endpoints. ### Claim 13 (depends on 11) The system of claim 11 wherein the threat management facility is further configured to remove the file or the process from the one or more other endpoints. ### Claim 14 (depends on 11) The system of claim 11 wherein the threat management facility is further configured to block network traffic for the one or more other endpoints. ### Claim 15 (depends on 1) The system of claim 1 wherein evaluating the local reputation further includes evaluating a reputation of a data file used by the process. ### Claim 16 (depends on 15) The system of claim 15 wherein evaluating the reputation of the data file includes one or more of evaluating a reputation of an origin of the data file, evaluating a reputation of an environment for the data file, evaluating a reputation of a user that created the data file, and evaluating a reputation of the process that is using the data file. ### Claim 17 (depends on 1) The system of claim 1 wherein the threat management facility is further configured to respond to the violation notification from the gateway by conditionally treating the endpoint as a compromised network asset only when the local reputation is low and the global reputation is low or unknown. ### Claim 18 (depends on 1) The system of claim 1 wherein the threat management facility is further configured to direct the endpoint to take the remedial action determined for the endpoint. ### Claim 19 A network comprising: an endpoint associated with an enterprise, the endpoint including a computing device comprising a memory and a processor, the endpoint executing a process from a file, the process, during execution, opening a data file for manipulation, and the endpoint configured to evaluate a local reputation of the file using one or more local criteria based on a user executing the process and to evaluate the local reputation of the file further based on evaluating one or more of an origin of the data file, evaluating a reputation of an environment for the data file, evaluating a reputation of a user that created the data file, and evaluating a reputation of the process using the data file; a gateway associated with the enterprise and coupled in a communicating relationship with the endpoint, the gateway configured to detect the process executing from the file on the endpoint and to request a global reputation of the file from a remote resource, the gateway further configured to enforce a network policy of the enterprise by detecting network traffic from the endpoint in violation of the network policy and providing a violation notification to the remote resource in response to the network traffic; and a threat management facility associated with the enterprise and coupled in a communicating relationship with the gateway and the endpoint, the threat management facility configured to receive the request from the gateway and to determine a global reputation of the file, the threat management facility further configured to receive the local reputation from the endpoint and the violation notification from the gateway, wherein the threat management facility is configured to respond to the violation notification by directing the endpoint to take a remedial action for the file based upon the local reputation evaluated by the endpoint based on the user executing the process from the file, the global reputation of the file determined by the threat management facility, and the violation notification from the gateway in response to the network traffic from the endpoint in violation of the network policy. ### Claim 20 (depends on 19) The network of claim 19 wherein directing the endpoint to take the remedial action includes directing the endpoint to block use of low-reputation files on the endpoint.