# US 10,484,398 B2 · Threat intelligence on a data exchange layer

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,398 B2
- Document ID: US10484398B2
- Status: Granted
- Kind: B2
- Application number: 14/912,743
- Filed: 2014-09-29
- Published: 2016-07-07
- Granted: 2019-11-19
- Earliest claimed: 2013-09-29
- Assignees: McAfee, Inc.
- Applicants: McAfee, LLC; Christopher Smith; Edward T. McDonald; Don R. Hanson, II
- Inventors: Christopher Smith; Edward T. McDonald; Don R. Hanson, II
- Web page: https://patentgrep.com/patent/US10484398B2

## CPC

- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/168: {above the transport layer}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

In an example, a threat intelligence controller is configured to operate on a data exchange layer (DXL). The threat intelligence controller acts as a DXL consumer of reputation data for a network object, which may be reported in various different types and from various different sources. Of the devices authorized to act as reputation data producers, each may have its own trust level. As the threat intelligence controller aggregates data from various providers, it may weight the reputation reports according to trust level. The threat intelligence engine thus builds a composite reputation for the object. When it receives a DXL message requesting a reputation for the object, it publishes the composite reputation on the DXL bus.

## Claims

### Claim 1

A threat intelligence apparatus adapted for use on a data exchange layer (DXL), comprising:
a network interface;
a DXL client engine comprising a DXL application programming interface (API) operable for communicatively coupling the apparatus to a DXL via a DXL broker, wherein the DXL is a messaging bus configured to provide endpoint-to-endpoint communication, brokered by a DXL broker, between loosely-coupled dissimilar DXL endpoints, including the threat intelligence apparatus, on a one-to-many publish-subscribe fabric on which a plurality of private DXL topics are to be established between the dissimilar DXL endpoints; and
one or more logic elements comprising a threat intelligence engine operable for:
aggregating reputation data for a network object via a plurality of DXL messages;
computing a composite reputation for the network object;
receiving from a DXL endpoint a DXL request message, via a private topic of the plurality of private topics, for a reputation for the network object; and
providing the composite reputation via a DXL message through the DXL broker and the one-to-many publish-subscribe fabric.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the DXL message for providing the composite reputation is a DXL response message directed to the private topic of the plurality of private topics.

### Claim 3 (depends on 1)

The apparatus of claim 1, wherein the DXL message for providing the composite reputation is a DXL message with an object reputation topic.

### Claim 4 (depends on 3)

The apparatus of claim 3, wherein the DXL message for providing the composite reputation comprises an expiry.

### Claim 5 (depends on 1)

The apparatus of claim 1, wherein aggregating reputation data for the network object via the plurality of DXL messages comprises:
determining permissions for a DXL message source;
determining that the source has permission to act as a provider of object reputation data; and
permitting object reputation data from the source to be included in the aggregating.

### Claim 6 (depends on 1)

The apparatus of claim 1, wherein aggregating reputation data for the network object via the plurality of DXL messages comprises:
determining permissions for a DXL message source;
determining that the source does not have permission to act as a provider of object reputation data; and
blocking object reputation data from the source from being included in the aggregating.

### Claim 7 (depends on 1)

The apparatus of claim 1, wherein aggregating reputation data for the network object via the plurality of DXL messages comprises:
determining a weighted permission for a DXL message source;
determining that the weighted permission is sufficient for the source to act as a provider of object reputation data; and
permitting object reputation data from the source to be included in the aggregating, comprising weighting data provided by the source according to the weighted permission.

### Claim 8 (depends on 1)

The apparatus of claim 1, wherein aggregating reputation data for the network object via the plurality of DXL messages comprises:
receiving a plurality of determinations that the network object is suspect but has not been blocked; and
assigning the composite reputation a score configured to block the network object on a network or subject the network object to additional scrutiny or deep analysis.

### Claim 9 (depends on 1)

The apparatus of claim 1, wherein aggregating reputation data for the network object via the plurality of DXL messages comprises:
receiving a DXL message indicating that the network object has been blocked by a DXL endpoint; and
publishing a DXL message indicating that the network object should be blocked by all DXL endpoints on the DXL.

### Claim 10 (depends on 1)

The apparatus of claim 1, wherein aggregating reputation data for the network object via the plurality of DXL messages comprises:
receiving a DXL message indicating that the network object has been blocked by a DXL endpoint; and
publishing a DXL message indicating that the network object should be blocked by a class of DXL endpoints on a network.

### Claim 11 (depends on 1)

The apparatus of claim 1, wherein aggregating reputation data for the network object via the plurality of DXL messages comprises:
determining that the network object is a new object on a network, and that the new object has been encountered multiple times in a designated time span; and
assigning the composite reputation a suspicious score.

### Claim 12 (depends on 1)

The apparatus of claim 1, further comprising a reputation store.

### Claim 13 (depends on 12)

The apparatus of claim 12, wherein the reputation store is a self-replicating NoSQL database.

### Claim 14

One or more non-transitory computer-readable mediums having stored thereon executable instructions for providing a threat intelligence engine comprising a DXL application programming interface (API) operable for:
communicatively coupling to a data exchange layer (DXL) via a DXL broker, wherein the DXL is a messaging bus configured to provide endpoint-to-endpoint communication, brokered by a DXL broker, between loosely-coupled dissimilar DXL endpoints, including the threat intelligence apparatus, on a one-to-many publish-subscribe fabric on which a plurality of private DXL topics are to be established between the dissimilar DXL endpoints;
subscribing to a DXL object reputation topic;
aggregating reputation data for a network object via a plurality of object reputation DXL messages;
computing a composite reputation for the network object;
receiving from a DXL endpoint a DXL request message, via a private topic of the plurality of private topics, for a reputation for the network object; and
providing the composite reputation via a DXL message through the DXL broker and the one-to-many publish-subscribe fabric.

### Claim 15 (depends on 14)

The one or more non-transitory computer-readable mediums of claim 14, wherein the DXL message for providing the composite reputation is a DXL response message directed to the private topic of the DXL endpoint.

### Claim 16 (depends on 14)

The one or more non-transitory computer-readable mediums of claim 14, wherein the DXL message for providing the composite reputation is a DXL message with an object reputation topic.

### Claim 17 (depends on 14)

The one or more non-transitory computer-readable mediums of claim 14, wherein aggregating reputation data for the network object via the plurality of DXL messages comprises:
determining permissions for a DXL message source;
determining that the source has permission to act as a provider of object reputation data; and
permitting object reputation data from the source to be included in the aggregating.

### Claim 18 (depends on 14)

The one or more non-transitory computer-readable mediums of claim 14, wherein aggregating reputation data for the network object via the plurality of DXL messages comprises:
determining a weighted permission for a DXL message source;
determining that the weighted permission is sufficient for the source to act as a provider of object reputation data; and
permitting object reputation data from the source to be included in the aggregating, comprising weighting data provided by the source according to the weighted permission.

### Claim 19 (depends on 14)

The one or more non-transitory computer-readable mediums of claim 14, wherein aggregating reputation data for the network object via the plurality of DXL messages comprises:
receiving a plurality of determinations that the network object is suspect but has not been blocked; and
assigning the composite reputation a score configured to block the network object on a network or subject the network object to additional scrutiny or deep analysis.

### Claim 20 (depends on 14)

The one or more non-transitory computer-readable mediums of claim 14, wherein aggregating reputation data for the network object via the plurality of DXL messages comprises:
receiving a DXL message indicating that the network object has been blocked by a DXL endpoint; and
publishing a DXL message indicating that the network object should be blocked by all DXL endpoints on the DXL.

### Claim 21 (depends on 14)

The one or more non-transitory computer-readable mediums of claim 14, wherein aggregating reputation data for the network object via the plurality of DXL messages comprises:
determining that the network object is a new object on a network, and that the new object has been encountered multiple times in a designated time span; and
assigning the composite reputation a suspicious score.

### Claim 22 (depends on 14)

The one or more non-transitory computer-readable mediums of claim 14, further comprising a reputation store.

### Claim 23 (depends on 22)

The one or more non-transitory computer-readable mediums of claim 22, wherein the reputation store is a self-replicating NoSQL database.

### Claim 24

A method of providing a server engine, comprising a DXL application programming interface (API) in a threat intelligence engine apparatus, and further comprising:
communicatively coupling to a data exchange layer (DXL) via a DXL broker, wherein the DXL is a messaging bus configured to provide endpoint-to-endpoint communication, brokered by a DXL broker, between loosely-coupled dissimilar DXL endpoints, including the threat intelligence apparatus, on a one-to-many publish-subscribe fabric on which a plurality of private DXL topics are to be established between the dissimilar DXL endpoints;
subscribing to a DXL object reputation topic;
aggregating reputation data for a network object via a plurality of object reputation DXL messages;
computing a composite reputation for the network object;
receiving from a DXL endpoint a DXL request message, via a private topic of the plurality of private topics, for a reputation for the network object; and
providing the composite reputation via a DXL message through the DXL broker and the one-to-many publish-subscribe fabric.

### Claim 25 (depends on 24)

The method of claim 24, further comprising:
determining permissions for a DXL message source;
determining that the source has permission to act as a provider of object reputation data; and
permitting object reputation data from the source to be included in the aggregating.