Back to results
US 8,381,289 B1Granted
Communication-based host reputation system
AssigneeSymantec Corporation
InventorsShane Pereira, Sourabh Satish
Life of this patent
Estimating the term…
Abstract
A host reputation score indicating whether a host connected to the client by a network is malicious is received. An entity on the client that communicates with the host is identified. Whether the entity is a malware threat is determined based at least in part on the host reputation score.
Claims20
A computer system for generating a host reputation score for a host connected to a network, the computer system comprising:
- a memory;
- a processor;
- a reporting module stored on the memory and executable by the processor to:
- receive information identifying a plurality of hosts connected to the network and information describing communications between a plurality of entities executing on a plurality of clients and the plurality of hosts;
- receive information identifying one or more of the plurality of entities executing on the plurality of clients as malware threats;
- and
- provide generated host reputation scores to the plurality of clients;
- and a host reputation module stored on the memory and executable by the processor to:
- identify malware entities executing on
- the plurality of clients that
- communicate with the host based at least on the information
- identifying the plurality of hosts, the information describing
- communications between the plurality of entities executing on the
- plurality of clients and the plurality of hosts, and the information
- identifying one or more of the plurality of entities as malware threats;
- determine a number of the malware entities executing on the plurality of
- clients that communicate with the host;
- and
- generate the host reputation score for the host based at least on the
- number of the malware entities executing on the plurality of clients
- that communicate with the host
- wherein the host reputation
- score for the host indicates a likelihood that the host is malicious.
20 more elements
A computer-implemented method of identifying a malware threat at a client, the method comprising:
- receiving a host reputation score indicating whether a host connected to the client by a network is malicious, wherein the host reputation score is determined by:
- identifying malware entities executing on a plurality of clients that communicate with the host based at least on information identifying a plurality of hosts, information describing communications between a plurality of entities executing on the plurality of clients and the plurality of hosts, and information identifying one or more of the plurality of entities as malware threats;
- determining a number of the malware entities executing on the plurality of clients that communicate with the host;
- and
- generating the host reputation score for the host based at least on the number of malware entities executing on the plurality of clients that communicate with the host;
- identifying an entity executing on the client that communicates with the host via the network;
- and
- determining, by a computer, whether the entity is a malware threat based at least on the host reputation score indicating whether the host connected to the client by the network is malicious.
5 more elements
A non-transitory computer-readable storage medium storing executable computer program code for identifying a malware threat at a client, the program code when executed by a processor causes the processor to perform the steps of:
- receiving a host reputation score indicating whether a host connected to the client by a network is malicious, wherein the host reputation score is determined by:
- identifying malware entities executing on a plurality of clients that communicate with the host based at least on information identifying a plurality of hosts, information describing communications between a plurality of entities executing on a plurality of clients and the plurality of hosts, and information identifying one or more of the plurality of entities as malware threats;
- determining a number of the malware entities executing on the plurality of clients that communicate with the host;
- and
- generating the host reputation score for the host based at least on the number of malware entities executing on the plurality of clients that communicate with the host;
- identifying an entity executing on the client that communicates with the host via the network;
- and
- determining whether the entity is a malware threat based at least on the host reputation score indicating whether the host connected to the client by the network is malicious.
5 more elements
Dependencies are inferred from the claim text.