Dynamic Reputation Indicator For Optimizing Computer Security Operations

A server computer system comprising at least one hardware processor configured to perform reputation management transactions with a plurality of client systems, wherein a reputation management transaction comprises:

• in response to a request received from a client system of the plurality of client systems, retrieving a first reputation indicator of a target entity from an entity reputation database, the first reputation indicator indicative of a probability that the target entity is malicious;
• in response to retrieving the first reputation indicator, transmitting the first reputation indicator to the client system;
• in response to transmitting the first reputation indicator, receiving a second reputation indicator of the target entity from the client system;
• in response to receiving the second reputation indicator, comparing the first and second reputation indicators;
• in response, when the second reputation indicator indicates a lower probability that the target entity is malicious than indicated by the first reputation indicator, adding the second reputation indicator to a collection of reputation indicators received from the plurality of client systems, wherein all members of the collection are determined for instances of the target entity;
• in response to adding the second reputation indicator to the collection, determining whether a reputation update condition is satisfied;
• and
• in response, when the update condition is satisfied, replacing the first reputation indicator in the reputation database with an updated reputation indicator determined according to the collection;
• and wherein determining the second reputation indicator comprises employing the client system to:
• in response to receiving the first reputation indicator, determine whether the target entity has performed any of a set of pre-determined actions during a first time interval,
• when the target entity has not performed any of the set of pre-determined actions during the first time interval, formulate the second reputation indicator to indicate that the target entity is less likely to be malicious than indicated by the first reputation indicator, and
• when the target entity has performed a first action of the set of pre-determined actions, formulate the second reputation indicator to indicate that the target entity is more likely to be malicious than indicated by the first reputation indicator.

A non-transitory computer-readable medium storing a set of instructions which, when executed by a hardware processor of a client system, cause the client system to form a reputation manager and an anti-malware engine, wherein:

• the client system is configured to execute a target entity;
• the reputation manager is configured to:
• in response to receiving a first reputation indicator of a target entity from a reputation server, the first reputation indicator indicative of a probability that the target entity is malicious, transmit the reputation indicator to the anti-malware engine,
• in response to receiving the first reputation indicator, determine whether the target entity has performed any of a set of pre-determined actions during a first time interval,
• when the target entity has not performed any of the set of pre-determined actions during the first time interval, determine a second reputation indicator of the target entity, the second reputation indicator indicating that the target entity is less likely to be malicious than indicated by the first reputation indicator,
• in response to determining the second reputation indicator, transmit the second reputation indicator to the anti-malware engine and to the reputation server,
• when the target entity has performed a first action of the set of pre-determined actions, determine a third reputation indicator of the target entity, the third reputation indicator indicating that the target entity is more likely to be malicious than indicated by the first reputation indicator,
• in response to determining the third reputation indicator, transmit the third reputation indicator to the anti-malware engine and to the reputation server;
• and wherein
• the anti-malware engine is configured to:
• in response to receiving the first reputation indicator, employ a first protocol to determine whether the target entity is malicious,
• in response to receiving the second reputation indicator, employ a second protocol to determine whether the target entity is malicious, wherein the second protocol is less computationally expensive than the first protocol, and
• in response to receiving the third reputation indicator, employ a third protocol to determine whether the target entity is malicious, wherein the third protocol is more computationally expensive than the first protocol.