Back to results
US 10,476,892 B2Granted
Reputation-based application caching and white-listing
AssigneeJuniper Networks, Inc.
InventorsKhandi Sudhakar Reddy, Rajeev Chaubey, Srinivas Koripella
Life of this patent
Estimating the term…
Abstract
A device may classify an application, associated with an endpoint, based on traffic associated with the endpoint. The device may determine a reputation score associated with the endpoint. The reputation score may be indicative of a level of trustworthiness of the endpoint. The device may selectively store a classification result, associated with classifying the application, in an application cache based on the reputation score associated with the endpoint. The classification result may be selectively used to process further traffic associated with the endpoint.
Claims20
A device, comprising:
- a memory;
- and
- one or more processors to:
- classify an application, associated with an endpoint, based on traffic associated with the endpoint;
- send, to another device that has processed other traffic associated with the endpoint, a request for information regarding a reputation of the endpoint;
- receive, from the other device based on the request, the information,
- the information including at least one of:
- a first indication that the endpoint is identified in a white-list, or
- a second indication that the endpoint is identified in a black-list;
- determine, based on receiving the information from the other device, a first reputation score associated with the endpoint,
- the first reputation score being indicative of a level of trustworthiness of the endpoint;
- determine whether the first reputation score satisfies a threshold;
- selectively store a classification result, associated with classifying the application, in an application cache based on the first reputation score satisfying the threshold;
- determine a security policy based on the classification result;
- process the traffic using the security policy;
- receive an indication to inspect the classification result stored in the application cache;
- determine a second reputation score associated with the endpoint;
- compare the second reputation score and the first reputation score;
- and
- selectively remove the classification result from the application cache based on comparing the second reputation score and the first reputation score.
17 more elements
A non-transitory computer-readable medium storing instructions, the instructions comprising:
- one or more instructions that, when executed by one or more processors of a device, cause the one or more processors to:
- classify an application, associated with an endpoint, based on first traffic associated with the endpoint;
- send, to another device that has processed second traffic associated with the endpoint, a request for information regarding a reputation of the endpoint;
- receive, from the other device based on the request, the information,
- the information including at least one of:
- a first indication that the endpoint is identified in a white-list, or
- a second indication that the endpoint is identified in a black-list;
- determine, based on receiving the information from the other device, a first reputation score associated with the endpoint;
- determine whether the first reputation score satisfies a threshold;
- selectively store a classification result, associated with classifying the application, in an application cache, based on the first reputation score satisfying the threshold;
- determine a security policy based on the classification result;
- process the first traffic using the security policy;
- receive an indication to inspect the classification result stored in the application cache;
- determine a second reputation score associated with the endpoint;
- compare the second reputation score and the first reputation score;
- and
- selectively remove the classification result from the application cache based on comparing the second reputation score and the first reputation score.
14 more elements
A method, comprising:
- classifying, by a device, an application, associated with an endpoint, based on traffic associated with the endpoint;
- sending, by the device to another device that has processed other traffic associated with the endpoint, a request for information regarding a reputation of the endpoint;
- receiving, by the device from the other device based on the request, the information,
- the information including at least one of:
- a first indication that the endpoint is identified in a white-list, or
- a second indication that the endpoint is identified in a black-list;
- determining, by the device and based on receiving the information from the other device, a first reputation score, associated with the endpoint, that is indicative of a level of trustworthiness of the endpoint;
- determining, by the device, whether the first reputation score satisfies a threshold;
- and selectively:
- selectively storing, by the device, a classification result, associated with classifying the application, in an application cache based on the first reputation score satisfying the threshold,
- determining, by the device, a security policy based on the classification result,
- processing, by the device, the traffic using the security policy;
- receiving, by the device, an indication to inspect the classification result stored in the application cache;
- determining, by the device, a second reputation score associated with the endpoint;
- comparing, by the device, the second reputation score and the first reputation score;
- and
- selectively removing, by the device, the classification result from the application cache based on comparing the second reputation score and the first reputation score.
14 more elements
Dependencies are inferred from the claim text.