# US 10,320,823 B2 · Discovering yet unknown malicious entities using relational data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,823 B2 - Document ID: US10320823B2 - Status: Granted - Kind: B2 - Application number: 14/844,379 - Filed: 2015-09-03 - Published: 2016-11-17 - Granted: 2019-06-11 - Earliest claimed: 2015-05-13 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Vojt{hacek over (e)}ch Létal; Tomá{hacek over (s)} Pevný; Petr Somol - Web page: https://patentgrep.com/patent/US10320823B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06Q 10/40: Business processes related to social networking or social networking services - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract Data is collected from a database arrangement about behavior of observed entities, wherein the collected data includes one or more features associated with the observed entities. A probabilistic model is determined that correlates the one or more features with malicious and/or benign behavior of the observed entities. Data is collected from the database arrangement for unobserved entities that have at least one common feature with at least one of the observed entities. One of the unobserved entities is determined to be a malicious entity based on the at least one common feature and the probabilistic model. Network policies are applied to packets sent from the malicious entity. ## Claims ### Claim 1 A method comprising: collecting data from a database arrangement about behavior of observed entities observed operating in a network, wherein the collected data includes one or more features associated with the observed entities; generating a probabilistic model that correlates features with malicious and/or benign behavior of the observed entities; collecting data from the database arrangement for unobserved entities that have not been observed operating in the network and that have at least one common feature with at least one of the observed entities; generating, from the probabilistic model, a numerical confidence level that one of the unobserved entities is a malicious entity prior to receiving packets sent from the one of the unobserved entities; determining a numerical threshold for the probabilistic model such that a deviation of the numerical confidence level from the numerical threshold is indicative that the one of the unobserved entities is malicious; determining from the probabilistic model that the one of the unobserved entities is a malicious entity; including the one of the unobserved entities as a malicious entity on a blacklist prior to receiving the packets sent from the one of the unobserved entities; and applying network policies to the packets sent from the one of the unobserved entities based upon the blacklist. ### Claim 2 (depends on 1) The method of claim 1, further comprising determining an acceptable false positive rate at which the probabilistic model will falsely identify benign entities as malicious entities, and setting the numerical threshold to a value to achieve the acceptable false positive rate. ### Claim 3 (depends on 1) The method of claim 1, wherein collecting data from the database arrangement for unobserved entities comprises collecting data from a database of social networking data. ### Claim 4 (depends on 1) The method of claim 1, wherein collecting data from the database arrangement for unobserved entities comprises collecting data from a WHOIS database. ### Claim 5 (depends on 1) The method of claim 1, wherein applying network policies to the packets comprises blocking network packets sent by the malicious entity. ### Claim 6 (depends on 1) The method of claim 1, wherein determining from the probabilistic model that the one of the unobserved entities is a malicious entity comprises: determining that the one of the unobserved entities shares one or more features with one or more observed malicious entities; determining that the one of the unobserved entities shares one or more features with one or more observed benign entities; and determining that the one of the unobserved entities is the malicious entity by comparing the one or more features shared with the one or more observed malicious entities to the one or more features shared with the one or more observed benign entities. ### Claim 7 (depends on 6) The method of claim 6, wherein comparing the one or more features shared with the one or more observed malicious entities to the one or more features shared with the one or more observed benign entities comprises comparing a number of features shared with the one or more observed malicious entities to a number of features shared with the one or more observed benign entities. ### Claim 8 (depends on 1) The method of claim 1, further comprising pre-registering the one of the unobserved entities as a malicious entity prior to receiving packets sent from the one of the unobserved entities. ### Claim 9 (depends on 1) The method of claim 1, wherein the probabilistic model comprises a Multinomial distribution and a Dirichlet distribution. ### Claim 10 An apparatus, comprising: a network interface; and a processor, wherein the processor is configured to: collect data from a database arrangement about behavior of observed entities observed operating in a network, wherein the collected data includes one or more features associated with the observed entities; generate a probabilistic model that correlates the one or more features with malicious and/or benign behavior of the observed entities; collect data from the database arrangement for unobserved entities that have not been observed operating in the network and that have at least one common feature with at least one of the observed entities; generate, from the probabilistic model, a numerical confidence level that one of the unobserved entities is a malicious entity prior to receiving packets sent from the one of the unobserved entities; determine a numerical threshold for the probabilistic model such that a deviation of the numerical confidence level from the numerical threshold is indicative that the one of the unobserved entities is malicious; determine from the probabilistic model that the one of the unobserved entities is a malicious entity; include the one of the unobserved entities as a malicious entity on a blacklist prior to receiving the packets sent from the one of the unobserved entities; and apply, via the network interface, network policies to the packets sent from the one of the unobserved entities based upon the blacklist. ### Claim 11 (depends on 10) The apparatus of claim 10, wherein the processor is configured to determine an acceptable false positive rate at which the probabilistic model will falsely identify benign entities as malicious entities, and set the numerical threshold to a value to achieve the acceptable false positive rate. ### Claim 12 (depends on 10) The apparatus of claim 10, wherein the processor is configured to collect data from the database arrangement for unobserved entities by collecting data from a database of social networking data. ### Claim 13 (depends on 10) The apparatus of claim 10, wherein the processor is configured to collect data from the database arrangement for unobserved entities by collecting data from a WHOIS database. ### Claim 14 (depends on 10) The apparatus of claim 10, wherein the processor is configured to apply network policies to the packets by blocking network packets sent by the malicious entity. ### Claim 15 (depends on 10) The apparatus of claim 10, wherein the processor is configured to determine from the probabilistic model that the one of the unobserved entities is a malicious entity by: determining that the one of the unobserved entities shares one or more features with one or more observed malicious entities; determining that the one of the unobserved entities shares one or more features with one or more observed benign entities; and determining that the one of the unobserved entities is the malicious entity by comparing the one or more features shared with the one or more observed malicious entities to the one or more features shared with the one or more observed benign entities. ### Claim 16 (depends on 10) The apparatus of claim 10, wherein the processor is further configured to pre-register the one of the unobserved entities as a malicious entity prior to receiving packets sent from the one of the unobserved entities. ### Claim 17 A tangible, non-transitory computer readable medium encoded with instructions, wherein the instructions, when executed by a processor, cause the processor to: collect data from a database arrangement about behavior of observed entities observed operating in a network, wherein the collected data includes one or more features associated with the observed entities; generate a probabilistic model that correlates the one or more features with malicious and/or benign behavior of the observed entities; collect data from the database arrangement for unobserved entities that have not been observed operating in the network and that have at least one common feature with at least one of the observed entities; generate, from the probabilistic model, a numerical confidence level that one of the unobserved entities is a malicious entity prior to receiving packets sent from the one of the unobserved entities; determine a numerical threshold for the probabilistic model such that a deviation of the numerical confidence level from the numerical threshold is indicative that the one of the unobserved entities is malicious; determine from the probabilistic model that the one of the unobserved entities is a malicious entity; include the one of the unobserved entities as a malicious entity on a blacklist prior to receiving the packets sent from the one of the unobserved entities; and apply, via a network interface, network policies to the packets sent from the one of the unobserved entities based upon the blacklist. ### Claim 18 (depends on 17) The computer readable media of claim 17, further comprising instructions that cause the processor to determine an acceptable false positive rate at which the probabilistic model will falsely identify benign entities as malicious entities, and set the numerical threshold to a value to achieve the acceptable false positive rate. ### Claim 19 (depends on 17) The computer readable media of claim 17, wherein the instructions cause the processor to determine from the probabilistic model that the one of the unobserved entities is a malicious entity by: determining that the one of the unobserved entities shares one or more features with one or more observed malicious entities; determining that the one of the unobserved entities shares one or more features with one or more observed benign entities; and determining that the one of the unobserved entities is a malicious entity by comparing the one or more features shared with the one or more observed malicious entities to the one or more features shared with the one or more observed benign entities. ### Claim 20 (depends on 17) The computer readable media of claim 17, wherein the instructions further cause the processor to pre-register the one of the unobserved entities as a malicious entity prior to receiving packets sent from the one of the unobserved entities.