# US 10,313,369 B2 · Blocking malicious internet content at an appropriate hierarchical level > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,369 B2 - Document ID: US10313369B2 - Status: Granted - Kind: B2 - Application number: 15/716,909 - Filed: 2017-09-27 - Published: 2019-03-28 - Granted: 2019-06-04 - Earliest claimed: 2017-09-27 - Assignees: Symantec Corporation - Applicants: Symantec Corporation - Inventors: Jonathan J. Dinerstein - Web page: https://patentgrep.com/patent/US10313369B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - G06F 21/554: {involving event detection and direct action} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0245: {Filtering by information in the payload} - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Blocking malicious Internet content at an appropriate hierarchical level. In one embodiment, a method may include identifying evidence of security risks in hierarchical levels of an Internet hierarchy. The method may also include generating security risk scores for the hierarchical levels of the Internet hierarchy based on the evidence of security risks. The method may further include identifying a security risk threshold. The method may also include identifying, as an appropriate blocking level, the highest hierarchical level of the Internet hierarchy having a security risk score at or above the security risk threshold. The method may further include blocking a network device from accessing Internet content in the Internet hierarchy at or below the appropriate blocking level. ## Claims ### Claim 1 A computer-implemented method for blocking malicious Internet content at an appropriate hierarchical level, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying evidence of security risks in hierarchical levels of an Internet hierarchy; generating security risk scores for the hierarchical levels of the Internet hierarchy based on the evidence of security risks; identifying a security risk threshold; identifying, as an appropriate blocking level, the highest hierarchical level of the Internet hierarchy having a security risk score at or above the security risk threshold; and blocking a network device from accessing Internet content in the Internet hierarchy at or below the appropriate blocking level. ### Claim 2 (depends on 1) The method of claim 1, wherein the hierarchical levels of the Internet hierarchy comprise Top Level Domain (TLD), Autonomous System Number (ASN), Classless Inter-Domain Routing (CIDR) Range, Internet Protocol (IP) address, Domain, Host, Path, and File. ### Claim 3 (depends on 1) The method of claim 1, wherein the generating of the security risk scores for the hierarchical levels of the Internet hierarchy based on the evidence of security risks is accomplished using machine learning. ### Claim 4 (depends on 1) The method of claim 1, wherein the evidence of security risks comprises direct evidence. ### Claim 5 (depends on 4) The method of claim 4, wherein the evidence of security risks further comprises indirect evidence. ### Claim 6 (depends on 5) The method of claim 5, further comprising: weighting the indirect evidence of security risks based on the hierarchical level to which the indirect evidence corresponds. ### Claim 7 (depends on 6) The method of claim 6, wherein the indirect evidence corresponding to higher hierarchical levels of the Internet hierarchy are weighted lower than the indirect evidence corresponding to lower hierarchical levels of the Internet hierarchy. ### Claim 8 A computer-implemented method for blocking malicious Internet content at an appropriate hierarchical level, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying a base hierarchical level of an Internet hierarchy that has a potential security risk; identifying direct evidence of security risks in the base hierarchical level and other hierarchical levels of the Internet hierarchy that are higher than and/or lower than the base hierarchical level; generating indirect evidence of security risks in the base hierarchical level and other hierarchical levels; combining the direct and indirect evidence of security risks in the base hierarchical level and other hierarchical levels into combined evidence of security risks; generating security risk scores for the hierarchical levels of the Internet hierarchy based on the combined evidence of security risks; identifying a security risk threshold; identifying, as an appropriate blocking level, the highest hierarchical level of the Internet hierarchy having a security risk score at or above the security risk threshold; and blocking a network device from accessing Internet content in the Internet hierarchy at or below the appropriate blocking level. ### Claim 9 (depends on 8) The method of claim 8, wherein the hierarchical levels of the Internet hierarchy comprise Top Level Domain (TLD), Autonomous System Number (ASN), Classless Inter-Domain Routing (CIDR) Range, Internet Protocol (IP) address, Domain, Host, Path, and File. ### Claim 10 (depends on 8) The method of claim 8, wherein the generating of the security risk scores for the hierarchical levels of the Internet hierarchy based on the combined evidence of security risks is accomplished using machine learning. ### Claim 11 (depends on 8) The method of claim 8, further comprising: weighting the indirect evidence of security risks based on the hierarchical level to which the indirect evidence corresponds. ### Claim 12 (depends on 11) The method of claim 11, wherein the indirect evidence corresponding to higher hierarchical levels of the Internet hierarchy are weighted lower than the indirect evidence corresponding to lower hierarchical levels of the Internet hierarchy. ### Claim 13 (depends on 11) The method of claim 11, wherein the weighting of the indirect evidence of security risks is accomplished using machine learning. ### Claim 14 (depends on 8) The method of claim 8, wherein the identifying of the direct evidence of security risks comprises identifying the direct evidence of security risks in one or more of telemetry data, traffic log data, and historical tracking data. ### Claim 15 One or more non-transitory computer-readable media comprising one or more computer-readable instructions that, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform a method for blocking malicious Internet content at an appropriate hierarchical level, the method comprising: identifying evidence of security risks in hierarchical levels of an Internet hierarchy; generating security risk scores for the hierarchical levels of the Internet hierarchy based on the evidence of security risks; identifying a security risk threshold; identifying, as an appropriate blocking level, the highest hierarchical level of the Internet hierarchy having a security risk score at or above the security risk threshold; and blocking a network device from accessing Internet content in the Internet hierarchy at or below the appropriate blocking level. ### Claim 16 (depends on 15) The one or more non-transitory computer-readable media of claim 15, wherein the hierarchical levels of the Internet hierarchy comprise Top Level Domain (TLD), Autonomous System Number (ASN), Classless Inter-Domain Routing (CIDR) Range, Internet Protocol (IP) address, Domain, Host, Path, and File. ### Claim 17 (depends on 15) The one or more non-transitory computer-readable media of claim 15, wherein the generating of the security risk scores for the hierarchical levels of the Internet hierarchy based on the evidence of security risks is accomplished using machine learning. ### Claim 18 (depends on 15) The one or more non-transitory computer-readable media of claim 15, wherein the evidence of security risks comprises direct evidence. ### Claim 19 (depends on 18) The one or more non-transitory computer-readable media of claim 18, wherein the evidence of security risks further comprises indirect evidence. ### Claim 20 (depends on 19) The one or more non-transitory computer-readable media of claim 19, wherein: the method further comprises weighting the indirect evidence of security risks based on the hierarchical level to which the indirect evidence corresponds; and the indirect evidence corresponding to higher hierarchical levels of the Internet hierarchy are weighted lower than the indirect evidence corresponding to lower hierarchical levels of the Internet hierarchy.