Storing and accessing threat information for use in predictive modeling in a network security service

A method for storing and accessing threat information for use in predictive modeling in a network security service, comprising:

• receiving, at a detection service server over a network from a first participant client device, information that describes a threat instance detected in the network, the information comprising a threat information code that identifies a threat type associated with the threat instance and a subscriber code that uniquely identifies the first participant client device, wherein one or more data attributes associated with the threat instance are not received at the detection service server;
• storing a record that describes the threat instance in a database coupled to the detection service server, wherein the record includes the threat information code and the subscriber code;
• receiving, over the network from a second participant client device, a request for information about a potential threat identified by the threat information code;
• obtaining from storage the subscriber code that is stored with the threat information code and uniquely identifies the first participant client device;
• returning the subscriber code to the second participant client device over the network;
• receiving, at a hierarchical name service, the subscriber code from the second participant client device over the network;
• and
• returning a network location on the network associated with the first participant client device to the second participant client device over the network, wherein the network location identifies a local name service node associated with the first participant client device in the hierarchical name service to enable the second participant client device to obtain one or more of the data attributes from the first participant client device over the network.

A registry server in a distributed system for storing and accessing threat information for use in predictive modeling in a network security service, the registry server comprising:

• an information service database configured to store a record that describes a threat instance detected in a network, wherein the record includes a threat information code that identifies a threat type associated with the threat instance and one or more data attributes associated with the threat instance;
• one or more processors configured to register information about the threat instance over the network with a detection service server associated with the network security service, wherein the registered information includes the threat information code that identifies the threat type associated with the threat instance and a subscriber code that uniquely identifies the registry server, but not the one or more data attributes associated with the threat instance;
• and
• a local name service configured to:
• receive over the network a request from participant client device;
• obtain from storage a database location associated with the information service database based on the threat information code, and
• return the database location to the participant client device;
• wherein the database location enables the participant client device to obtain the one or more data attributes from the information service database over the network.

A method for storing and accessing threat information at a registry server for use in predictive modeling in a network security service, the method comprising:

• storing a record that describes a threat instance detected in a network in an information service database, wherein the record includes a threat information code that identifies a threat type associated with the threat instance and one or more data attributes associated with the threat instance;
• communicating information about the threat instance over the network to a detection service server associated with the network security service to register the information therewith, wherein the information includes the threat information code that identifies the threat type associated with the threat instance and a subscriber code that uniquely identifies the registry server, but not the one or more data attributes associated with the threat instance;
• receiving a request from a participant client device;
• obtaining from storage a database location associated with the information service database based on the threat information code, and
• returning the database location to the participant client device over the network;
• wherein the database location enables the participant client device to obtain the one or more data attributes from the information service database over the network.

A registrar computer system in a distributed system for accessing threat information for use in predictive modeling in a network security service, the registrar computer system configured to:

• communicate a first query to a detection service server over the network, the first query includes a threat instance code that identifies a threat type;
• in response to the first query, receive over the network from the remote detection service server one or more subscriber codes that uniquely identify one or more participant client devices in the network security service, wherein the one or more participant client devices had previously registered one or more threat instances having the threat type identified in the threat instance code;
• communicate a second query over the network to a hierarchical name service server, the second query includes the one or more subscriber codes,
• in response to the second query, receive over the network from the hierarchical name service server one or more network locations on the network associated with the one or more participant client devices;
• and
• retrieve over the network one or more data attributes associated with the one or more threat instances from the one or more participant client devices using the one or more network locations.

A method using a computer system for accessing threat information for use in predictive modeling in a network security service, the method comprising:

• communicating a first query to a detection service server over the network, the first query includes a threat instance code that identifies a threat type;
• in response to the first query, receiving, over the network from the remote detection service sever, one or more subscriber codes that uniquely identify one or more participant client devices in the network security service, wherein the one or more participant client devices had previously registered one or more threat instances having the threat type identified in the threat instance code;
• communicating a second query over the network to a hierarchical name service server, the second query includes the one or more subscriber codes,
• in response to the second query, receiving over the network from the hierarchical name service one or more network locations associated with the one or more participant client devices;
• and
• retrieving over the network one or more data attributes associated with the one or more threat instances from the one or more participant client devices using the one or more network locations.