US 2016/0080420 A1 · USING INDICATIONS OF COMPROMISE FOR REPUTATION BASED NETWORK SECURITY

Abstract

Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted/untrusted processes or corporate/private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility.

Claims20

Dependent claims

A method comprising:

collecting a plurality of indications of compromise from an endpoint, each one of the indications of compromise based upon one or more actions on the endpoint and one or more descriptors and objects related thereto;
determining a reputation associated with the plurality of indications of compromise based upon a context for the one or more actions on the endpoint;
and
creating a rule for evaluating reputation based upon an occurrence of the plurality of indications of compromise.

1 more element

Dependencies are inferred from the claim text.

Using indications of compromise for reputation based network security

Life of this patent

Using indications of compromise for reputation based network security

Life of this patent

Abstract

Claims20