# US 2019/0173891 A1 · Agent assisted malicious application blocking in a network environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173891 A1 - Document ID: US20190173891A1 - Status: Published application - Kind: A1 - Application number: 16/270,461 - Filed: 2019-02-07 - Published: 2019-06-06 - Earliest claimed: 2013-12-18 - Assignees: McAfee, Inc. - Applicants: McAfee, LLC - Inventors: Chandan CP; Srinivasan Narasimhan - Web page: https://patentgrep.com/patent/US20190173891A1 ## CPC - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 21/554: {involving event detection and direct action} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Embodiments are configured to receive metadata of a process intercepted on an end host when attempting to access a network. The metadata includes a hash of an application associated with the process and an endpoint reputation score of the application. Embodiments are configured to request a threat intelligence reputation score based on the hash of the application, to determine an action to be taken by the end host based, at least in part, on one or more policies and at least one of the threat intelligence reputation score and the endpoint reputation score, and to send a response indicating the action to be taken by the end host. Further embodiments request another threat intelligence reputation score based on another hash of a dynamic link library module loaded by the process on the end host, and the action is determined based, at least in part, on the other threat intelligence score. ## Claims ### Claim at position 1 -25. (canceled) ### Claim 26 At least one non-transitory machine readable storage medium encoded with instructions for blocking malware, wherein the instructions, when executed by a processor cause the processor to: receive metadata of a process intercepted by an end host when attempting to access a network, wherein the metadata includes a hash of an application associated with the process and an endpoint reputation score of the application; request a threat intelligence reputation score based on the hash of the application; determine an action to be taken by the end host based, at least in part, on a policy and at least one of the threat intelligence reputation score and the endpoint reputation score; and send a response indicating an action to be taken by the end host. ### Claim 27 (depends on 26) The at least one non-transitory machine readable storage medium of claim 26, wherein the action includes blocking the application on the end host based on the threat intelligence reputation score representing at least a certain degree of maliciousness. ### Claim 28 (depends on 27) The at least one non-transitory machine readable storage medium of claim 27, wherein the instructions, when executed by the processor, further cause the processor to: corelate a tuple of connection information with network traffic associated with a network session established by the process, wherein the metadata includes the tuple of connection information; determine whether a network security device is in-line or out-of-band with the end host; and block, at a network security device, the network traffic correlated to the tuple of connection information based on a determination that the network security device is in-line with the end host. ### Claim 29 (depends on 28) The at least one non-transitory machine readable storage medium of claim 28, wherein the instructions, when executed by the processor, further cause the processor to: notify the end host to block on-going network traffic of a network session established by the process based on a determination that the network security device is out-of-band. ### Claim 30 (depends on 26) The at least one non-transitory machine readable storage medium of claim 26, wherein the action includes allowing a network session established by the process to continue based on determining the threat intelligence reputation score does not represent at least a certain degree of maliciousness. ### Claim 31 (depends on 26) The at least one non-transitory machine readable storage medium of claim 26, wherein the instructions, when executed by the processor, further cause the processor to: receive, from the end host, a second endpoint reputation score of the application; determine a second action to be taken by the end host based, at least in part, on a policy and the second endpoint reputation score; and send a second response indicating a second action to be taken by the end host. ### Claim 32 (depends on 31) The at least one non-transitory machine readable storage medium of claim 31, wherein the second endpoint reputation score of the application is based, at least in part, on heuristic analysis of a dynamic link library (DLL) module invoked by the process. ### Claim 33 (depends on 32) The at least one non-transitory machine readable storage medium of claim 32, wherein the second action includes blocking the DLL module when the second endpoint reputation score represents at least a certain degree of maliciousness. ### Claim 34 (depends on 26) The at least one non-transitory machine readable storage medium of claim 26, wherein the instructions, when executed by the processor, further cause the processor to: receive network traffic associated with a network session established by the process; detect malware in the network traffic; correlate a tuple of connection information with the network traffic containing the malware, wherein the metadata includes the tuple of connection information; determine a second action to be taken by the end host based, at least in part, on a policy; and send a second response indicating the second action to be taken by the end host. ### Claim 35 (depends on 34) The at least one non-transitory machine readable storage medium of claim 34, wherein the tuple of connection information includes a source network address of the end host, a source port of the end host, a destination network address of a remote node of a network session established by the process, a destination port of the remote node, and a protocol of the network session. ### Claim 36 An apparatus for blocking malware, the apparatus comprising: a hardware processor; a memory element; and an endpoint intelligence agent configured to run on the processor to: receive metadata of a process intercepted by an end host when attempting to access a network, wherein the metadata includes a hash of an application associated with the process and an endpoint reputation score of the application; request a threat intelligence reputation score based on the hash of the application; determine an action to be taken by the end host based, at least in part, on a policy and at least one of the threat intelligence reputation score and the endpoint reputation score; and send a response indicating an action to be taken by the end host. ### Claim 37 (depends on 36) The apparatus of claim 36, wherein the action includes blocking the application based on the threat intelligence reputation score representing at least a certain degree of maliciousness. ### Claim 38 (depends on 36) The apparatus of claim 36, wherein the action includes allowing a network session established by the process to continue based on determining the threat intelligence reputation score does not represent at least a certain degree of maliciousness. ### Claim 39 (depends on 36) The apparatus of claim 36, wherein the endpoint intelligence agent is further configured to run on the processor to: corelate a tuple of connection information with network traffic associated with a network session established by the process, wherein the metadata includes the tuple of connection information; determine whether a network security device is in-line or out-of-band with the end host; and block, at a network security device, the network traffic correlated to the tuple of connection information based on a determination that the network security device is in-line with the end host. ### Claim 40 (depends on 39) The apparatus of claim 39, wherein the endpoint intelligence agent is further configured to run on the processor to: notify the end host to block on-going network traffic of a network session established by the process based on a determination that the network security device is out-of-band. ### Claim 41 (depends on 36) The apparatus of claim 36, wherein the endpoint intelligence agent is further configured to run on the processor to: receive network traffic associated with a network session established by the process; detect malware in the network traffic; correlate a tuple of connection information with the network traffic containing the malware, wherein the metadata includes the tuple of connection information; determine a second action to be taken by the end host based, at least in part, on a policy; and send a second response indicating the second action to be taken by the end host. ### Claim 42 A method for blocking malware, the method comprising: receiving metadata of a process intercepted by an end host when attempting to access a network, wherein the metadata includes a hash of an application associated with the process and an endpoint reputation score of the application; requesting a threat intelligence reputation score based on the hash of the application; determining an action to be taken by the end host based, at least in part, on a policy and at least one of the threat intelligence reputation score and the endpoint reputation score; and sending a response indicating an action to be taken by the end host. ### Claim 43 (depends on 42) The method of claim 42, wherein the action includes blocking the application based on the threat intelligence reputation score representing at least a certain degree of maliciousness. ### Claim 44 (depends on 42) The method of claim 42, further comprising: receiving, from the end host, a second endpoint reputation score of the application; determining a second action to be taken by the end host based, at least in part, on a policy and the second endpoint reputation score; and sending a second response indicating a second action to be taken by the end host. ### Claim 45 (depends on 42) The method of claim 42, further comprising: corelating a tuple of connection information with network traffic associated with a network session established by the process, wherein the metadata includes the tuple of connection information; and blocking, at a network security device, the network traffic correlated to the tuple of connection information based on a determination that the network security device is in-line with the end host.