System and method for securing a network against malicious communications through peer-based cooperation

A method executed by a first application installed on a first computer system, the method comprising:

• determining that a second application is attempting to transmit a first communication to the first application, wherein the first computer system is configured to store:
• a first list of trusted applications, wherein each trusted application of the first list of trusted applications is associated with a probability that the trusted application of the first list of trusted applications is malicious that is less than a lower threshold;
• a first list of malicious applications, wherein each malicious application of the first list of malicious applications is associated with a probability that the malicious application of the first list of malicious applications is malicious that is greater than an upper threshold;
• and
• a list of peer applications corresponding to a subset of the list of trusted applications, the list of peer applications comprising:
• a first peer application installed on a second computer system configured to store a second list of malicious applications different from the first list of malicious applications, each malicious application of the second list of malicious applications associated with a probability that the malicious application of the second list of malicious applications is malicious that is greater than the upper threshold;
• and
• a second peer application installed on a third computer system, the third computer system comprising a third memory configured to store a third list of malicious applications different from the first list of malicious applications and the second list of malicious applications, each malicious application of the third list of malicious applications associated with a probability that the malicious application of the third list of malicious applications is malicious that is greater than the upper threshold;
• determining that the second application is not included in any of the first list of trusted applications and the first list of malicious applications;
• in response to determining that the second application is not included in any of the first list of trusted applications and the first list of malicious applications:
• transmitting a message to each of the first peer application and the second peer application inquiring about the second application, wherein transmitting the message to the first peer application comprises transmitting the message to the second computer system, and transmitting the message to the second peer application comprises transmitting the message to the third computer system;
• receiving a response from each of the first peer application and the second peer application, the response received from the first peer application indicating that the second application is included in the second list of malicious applications, the response received from the second peer application indicating that information associated with the second application is not stored in the third memory;
• and
• in response to receiving the response from the first peer application indicating that the second application is included in the second list of malicious applications, refusing the first communication.

A system comprising:

• a first computer system configured to execute a first application, the first computer system comprising:
• a first memory configured to store:
• a first list of trusted applications, wherein each trusted application of the first list of trusted applications is associated with a probability that the trusted application of the first list of trusted applications is malicious that is less than a lower threshold;
• a first list of malicious applications, wherein each malicious application of the first list of malicious applications is associated with a probability that the malicious application of the first list of malicious applications is malicious that is greater than an upper threshold;
• and
• a list of peer applications comprising a first peer application and a second peer application;
• and
• a first hardware processor communicatively coupled to the memory;
• a second computer system configured to execute the first peer application, the second computer system comprising:
• a second memory configured to store a second list of malicious applications, each malicious application of the second list of malicious applications associated with a probability that the malicious application of the second list of malicious applications is malicious that is greater than the upper threshold;
• and
• a second hardware processor;
• and
• a third computer system configured to execute the second peer application, the third computer system comprising:
• a third memory configured to store a third list of malicious applications, each malicious application of the third list of malicious applications associated with a probability that the malicious application of the third list of malicious applications is malicious that is greater than the upper threshold;
• and
• a third hardware processor, wherein the first hardware processor is configured to:
• determine that a second application is attempting to transmit a first communication to the first application;
• determine that the second application is not included in any of the first list of trusted applications and the first list of malicious applications;
• in response to determining that the second application is not included in any of the first list of trusted applications and the first list of malicious applications:
• transmit a message to each of the first peer application and the second peer application inquiring about the second application, wherein:
• transmitting the message to the first peer application comprises transmitting the message to the second computer system;
• transmitting the message to the second peer application comprises transmitting the message to the third computer system;
• the second hardware processor of the second computer system is configured to:
• receive the message;
• determine that the second application is included in the second list of malicious applications;
• and
• transmit a response to the first computer system indicating that the second application is included in the second list of malicious applications;
• and
• the third hardware processor of the third computer system is configured to:
• receive the message;
• and
• transmit a response to the first computer system indicating that information associated with the second application is not stored in the third memory;
• receive the responses from each of the first peer application and the second peer application;
• and
• in response to receiving the response from the first peer application indicating that the second application is included in the second list of malicious applications refuse the first communication.