System and method for hierarchical and chained internet security analysis
AssigneeSymantec Corporation
InventorsJonathan J. Dinerstein, Daniel Hardman, Christian E. Larsen
Life of this patent
Estimating the term…
Abstract
According to one embodiment, a method for predicting the trustworthiness of a particular website comprising receiving information about a plurality of websites and constructing a hierarchy of groups from the received information, the hierarchy of groups comprising one or more tiers and each tier comprising one or more groups. The method further comprising receiving information about a particular website and predicting the trustworthiness of the particular website based on the hierarchy.
Claims18
A hierarchical system for determining a trustworthiness of a website to prevent malware, the system comprising:
- a processor configured to:
- receive information about a plurality of websites, wherein at least one of the plurality of websites exhibits behavior associated with malware;
- construct a hierarchical classifier by:
- constructing a hierarchy of groups based on the information about the plurality of websites, the hierarchy of groups comprising:
- one or more first tier groups corresponding to one or more domains, wherein one or more of the plurality of websites are associated with the one or more domains;
- one or more second tier groups corresponding to one or more internet protocol addresses, wherein one or more of the domains are associated with the one or more internet protocol addresses;
- and
- one or more third tier groups corresponding to one or more autonomous systems, wherein one or more of the internet protocol addresses are associated with the one or more autonomous systems;
- determining whether a level of trustworthiness for each website of the plurality of websites satisfies a pre-determined threshold based on the information about the plurality of websites;
- receiving information about a particular website;
- predicting the trustworthiness of the particular website using the hierarchical classifier, wherein predicting the trustworthiness of the particular website comprises:
- in response to receiving real-time data about the particular website, identifying at least a first tier group, a second tier group, and a third tier group of the hierarchy of groups to which the particular website should be assigned based on the real-time data about the particular website;
- determining whether the particular website is trustworthy based on whether other websites assigned to the identified groups are trustworthy;
- tagging the particular website as trustworthy, untrustworthy, or undetermined;
- and
- preventing a user from visiting a website tagged as untrustworthy.
A hierarchical system for determining a trustworthiness of a website to prevent malware, the system comprising:
- a processor configured to:
- receive information about a plurality of websites, wherein at least one of the plurality of website exhibits behavior associated with malware;
- construct a hierarchical classifier by:
- constructing a hierarchy of groups based on the information about the plurality of websites, wherein:
- the hierarchy of groups comprises one or more tiers, each tier comprising one or more groups;
- and
- each website of the plurality of websites is assigned to at least one group in each tier;
- determining whether a level of trustworthiness for each website of the plurality of websites satisfies a pre-determined threshold on the information about the plurality of websites;
- tagging each website as trustworthy, untrustworthy, or undetermined;
- and
- preventing a user from visiting a website tagged as untrustworthy.
A method for determining a trustworthiness of a website to prevent malware comprising:
- predicting the trustworthiness of a particular website using a hierarchical classifier, wherein predicting the trustworthiness of the particular website comprises:
- receiving information about a particular website;
- identifying one or more groups of a hierarchy of groups to which the particular website should be assigned, wherein the one or more groups are identified based on the received information about the particular website;
- determining whether the particular website is trustworthy based on the trustworthiness of websites assigned to the same groups as the particular website;
- determining whether the particular website is trustworthy based on whether other websites assigned to the identified groups are trustworthy and determining that the trustworthiness of other websites satisfies a predetermined trustworthiness threshold;
- tagging the particular website as trustworthy, untrustworthy, or undetermined;
- and
- preventing a user from visiting a website tagged as untrustworthy.
One or more computer-readable non-transitory storage media in one or more computing systems, the media embodying logic for determining a trustworthiness of a website to prevent malware that is operable when executed to:
- receive information about a plurality of websites, wherein at least one of the plurality of website exhibits behavior associated with malware;
- construct a hierarchical classifier by:
- constructing a hierarchy of groups based on the information about the plurality of websites, wherein:
- the hierarchy of groups comprises one or more tiers, each tier comprising one or more groups;
- and
- each website of the plurality of websites is assigned to at least one group in each tier;
- determining whether a level of trustworthiness for each website of the plurality of websites satisfies a pre-determined threshold on the information about the plurality of websites;
- tagging each website as trustworthy, untrustworthy, or undetermined;
- and
- preventing a user from visiting a website tagged as untrustworthy.
Dependencies are inferred from the claim text.