Scalable network security with fast response protocol

A server for use with a first network, the server comprising at least one processor and instructions stored on non-transitory computer readable storage, the instructions to cause the at least one processor to receive a query specifying an identifier of a possible network security threat and to cause the server to automatically respond to the query, the instructions when executed further operable to control the at least one processor to cause the server to:

• determine whether the query is of a first type, that requires response within a predetermined period of time, or of a second type, that does not require response within the predetermined period of time;
• if the query is of the first type, service the query with information on hand, from storage local to the first network, and provide a response to the query within the period of time, even if no matching information is found within the local storage;
• if the query is of the second type, forward the query via a wide area network connection to another information source for response, even if matching information is found within the local storage, and respond to the query only once the other information source has responded, irrespective of expiration the period of time;
• wherein the at least one computer is further to forward the query to the other information source if the query is of the first type, and is to responsively update the storage local to the first network to contain data representing correlation of the possible network security threat dependent on response by the other information source;
• and
• wherein response to the query includes a field representing relative threat level of the possible network security threat and includes transmission of a security response action.

An apparatus comprising instructions stored on computer readable storage, the instructions to cause at least one computer of a first network to receive a query specifying an identifier of a possible network security threat and automatically respond to the query, wherein the query is one of a first type or a second type, the instructions when executed further to cause the at least one computer to:

• if the query is of the first type,
• determine whether a database associated with the first network possesses information responsive to the query, said information associated with the possible network security threat, and reply with a response message to a source of the query specifying the identifier within a predetermined time, even if no matching information is found within the database, wherein the response message conveys the information if in possession of the first network, and wherein the response message is to be transmitted to the source via wide area network, and
• forward the query via wide area network to at least one other query destination, wherein the at least one computer is adapted to receive an asynchronous update from the at least one other query destination responsive to the forwarded query and responsively update the database irrespective of passage of the predetermined time;
• and
• if the query is of the second type,
• determine whether the database associated with the first network possesses information responsive to the query, said information associated with the possible network security threat,
• forward the query via wide area network to the another query destination, even if the database associated with the first network possesses information responsive to the query, wherein the at least one computer is adapted to responsively receive an asynchronous update from the other query destination and respond only once the other query destination has responded, to a source of the query specifying the identifier with any information responsive to the query possessed by the database and by the other query destination;
• wherein response to the query includes a field representing relative threat level of the possible network security threat and includes transmission of a security response action.