Subscription-based malware detection

A computerized method for authenticating access to a subscription-based service, the method comprising:

• receiving, by a subscription review service, a request from a network device to subscribe to the subscription-based service that is configured to analyze one or more objects for a potential presence of malware representing an attempted cyber-attack;
• receiving, by a cloud broker, information based on operational metadata, the operational metadata includes metadata that pertains to an operating state of at least the cluster of the plurality of clusters;
• and
• using, by the cloud broker, at least service policy level information received from the subscription review service and the information based on the operational metadata, to select a cluster from a plurality of clusters, wherein the cluster determines whether the one or more objects are associated with the attempted cyber-attack.

A computerized method for authenticating access to a subscription-based service, the method comprising:

• receiving, by a subscription review service, a request to subscribe to the subscription-based service that is configured to analyze one or more objects for a potential presence of malware representing an attempted cyber-attack, the request being a message including information that identifies a network device that is associated with a customer;
• and
• selecting, based on service policy level information, a cluster from a plurality of clusters that analyzes whether the one or more objects are associated with the attempted cyber-attack,
• wherein the service policy level information includes an identifier assigned to the customer or a network device associated with the customer for use in accessing one or more databases to access performance-based attributes used to select the cluster of the plurality of clusters.

A system for detection and reporting of malware, comprising:

• a plurality of clusters, each cluster of the plurality of clusters includes one or more compute nodes for analyzing one or more objects for a potential presence of malware;
• a subscription review service configured to provide (i) service policy level information in response to confirmation that a customer associated with the service policy level information is permitted access to the plurality of clusters and (ii) a network address for use in establishing communications with a first cluster of the plurality of clusters for submission of the one or more objects;
• and
• a cloud broker communicatively coupled to the plurality of clusters, the cloud broker being configured to control selection of the first cluster from the plurality of clusters to analyze the one or more objects for the potential presence of malware based at least on the service policy level information accessible by the cloud broker,
• wherein the cloud broker to select the first cluster based, at least in part, on the service policy level information provided by the subscription review service, the service policy level information includes cluster availability information that restricts a number of clusters of the plurality of clusters available to analyze the one or more objects to a second plurality of clusters being a subset of the plurality of clusters, the first cluster included as a cluster of the second plurality of clusters.

A system for detection and reporting of malware, comprising:

• a plurality of clusters, each cluster of the plurality of clusters includes one or more compute nodes for analyzing one or more objects for a potential presence of malware;
• a subscription review service configured to provide (i) service policy level information t-e in response to confirmation that a customer associated with the service policy level information is permitted access to the plurality of clusters and (ii) a network address for use in establishing communications with a first cluster of the plurality of clusters for submission of the one or more objects;
• and
• a cloud broker communicatively coupled to the plurality of clusters, the cloud broker being configured to control selection of the first cluster from the plurality of clusters to analyze the one or more objects for the potential presence of malware based on at least the service policy level information accessible by the cloud broker,
• wherein the cloud broker to select the first cluster based, at least in part, on the service policy level information provided by the subscription review service, the service policy level information includes information that identifies one or more geographic locations that are permitted for analysis of the one or more objects upon confirming that compute nodes within the first cluster conducting the analysis of the one or more objects for the potential presence of malware reside within the one or more geographic locations.

A subscription review service apparatus deployed within a malware detection system, subscription review service apparatus comprising:

• one or more processors;
• and
• a memory coupled to the one or more processors, the memory includes
• licensing logic, upon execution by the one or more processors, to receive a license request message from a first network device and to store service policy level information within a data store, the service policy level information identifies a subscription level associated with the first network device, and
• enrollment logic, upon execution by the one or more processors, to (i) receive an enrollment request message from the first network device that is requesting access to the malware detection system, and upon authentication of the first network device, (ii) return, to the first network device, information for accessing a second network device that controls selection of one or more resources of a plurality of resources offered by the malware detection system,
• wherein the service policy level information includes an identifier assigned to a customer associated with the enrollment request message, the identifier being used to access performance-based attributes used to control the selection of the one or more of the plurality of resources.

A method for authenticating access to a subscription-based service for analyzing submitted objects for malware, the method comprising:

• receiving, by enrollment logic, a message to enroll a customer associated with a sensor as a subscriber of the subscription-based service for analyzing objects submitted by the sensor for malware, the request includes information that identifies the sensor;
• authenticating the sensor;
• and
• after authenticating the sensor, providing information to a cloud broker for controlling selection of a cluster from a plurality of clusters to analyze the objects from the sensor,
• wherein the information includes operational metadata that is received by a cluster management system monitoring operations of each cluster of the plurality of clusters and used to generate cluster selection values provided to the cloud broker, the cluster selection values including information used by policy and routing rules processed by a rules engine within the cloud broker that controls selection of the cluster from the plurality of clusters.

A method for providing a subscription review service, the method comprising:

• receiving a license request message from a first network device;
• storing service policy level information within a data store, the service policy level information identifies a subscription level associated with the first network device;
• receiving an enrollment request message from the first network device that is requesting access to a malware detection system;
• and
• after authentication of the first network device, returning, to the first network device, information for accessing a second network device that controls selection of one or more resources of a plurality of resources offered by the malware detection system,
• wherein the service policy level information includes performance-based attributes that defines a level of analysis conducted by the selected resources including at least a first cluster of a plurality of clusters.