# US 2016/0366176 A1 · High-level reputation scoring architecture

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2016/0366176 A1
- Document ID: US20160366176A1
- Status: Published application
- Kind: A1
- Application number: 15/178,827
- Filed: 2016-06-10
- Published: 2016-12-15
- Earliest claimed: 2015-06-11
- Assignees: Northrop Grumman Systems Corporation
- Applicants: Northrop Grumman Systems Corporation
- Inventors: James E. Bennison
- Web page: https://patentgrep.com/patent/US20160366176A1

## CPC

- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method for improving enterprise network security may include accessing a plurality of reputation scoring sources for a corresponding plurality of reputation scores, determining an aggregate reputation score based on the plurality of reputation scores, and, in response to a domain name service request, generating a response including information indicative of the aggregate reputation score.

## Claims

### Claim 1

A system for providing enhanced enterprise network protection, the system comprising processing circuitry configured to:
access a plurality of reputation scoring sources for a corresponding plurality of reputation scores;
determine an aggregate reputation score based on the plurality of reputation scores; and
in response to a domain name service request, generate a response including information indicative of the aggregate reputation score.

### Claim 2 (depends on 1)

The system of claim 1, wherein accessing the plurality of reputation scores comprises accessing commercial reputation scoring services.

### Claim 3 (depends on 1)

The system of claim 1, wherein accessing the plurality of reputation scores comprises accessing at least one classified governmental source.

### Claim 4 (depends on 1)

The system of claim 1, wherein accessing the plurality of reputation scores comprises accessing commercial reputation scoring services and at least one classified governmental source.

### Claim 5 (depends on 1)

The system of claim 1, wherein the aggregate reputation score comprises a weighted average of the plurality of reputation scores.

### Claim 6 (depends on 1)

The system of claim 1, wherein the processing circuitry is further configured to block access to a website from an organization's network based on the aggregate reputation score.

### Claim 7 (depends on 1)

The system of claim 1, wherein the processing circuitry is further configured to issue a warning relative to access to a website based on the aggregate reputation score.

### Claim 8 (depends on 1)

The system of claim 1, wherein generating the response including the information indicative of the aggregate reputation score comprises generating the response in response to the aggregate reputation score being above a threshold.

### Claim 9 (depends on 1)

The system of claim 1, wherein the information indicative of the aggregate reputation score is provided in a TXT resource record.

### Claim 10 (depends on 9)

The system of claim 9, wherein data fields in the TXT resource record further identify a source of the aggregate reputation score, a reason for generating the aggregate reputation score, and an expiration period of the aggregate reputation score.

### Claim 11

A method for providing enhanced enterprise network protection, the method comprising:
accessing a plurality of reputation scoring sources for a corresponding plurality of reputation scores;
determining an aggregate reputation score based on the plurality of reputation scores; and
in response to a domain name service request, generating a response including information indicative of the aggregate reputation score.

### Claim 12 (depends on 11)

The method of claim 11, wherein accessing the plurality of reputation scores comprises accessing commercial reputation scoring services.

### Claim 13 (depends on 11)

The method of claim 11, wherein accessing the plurality of reputation scores comprises accessing at least one classified governmental source.

### Claim 14 (depends on 11)

The method of claim 11, wherein accessing the plurality of reputation scores comprises accessing commercial reputation scoring services and at least one classified governmental source.

### Claim 15 (depends on 11)

The method of claim 11, wherein the aggregate reputation score comprises a weighted average of the plurality of reputation scores.

### Claim 16 (depends on 11)

The method of claim 11, further comprising blocking access to a website from an organization's network based on the aggregate reputation score.

### Claim 17 (depends on 11)

The method of claim 11, further comprising issuing a warning relative to access to a website based on the aggregate reputation score.

### Claim 18 (depends on 11)

The method of claim 11, wherein generating the response including the information indicative of the aggregate reputation score comprises generating the response in response to the aggregate reputation score being above a threshold.

### Claim 19 (depends on 11)

The method of claim 11, wherein the information indicative of the aggregate reputation score is provided in a TXT resource record.

### Claim 20 (depends on 19)

The method of claim 19, wherein data fields in the TXT resource record further identify a source of the aggregate reputation score, a reason for generating the aggregate reputation score, and an expiration period of the aggregate reputation score.