Real-time website safety reputation system
View Patent ↗A mechanism is provided for determining a safety reputation for a network site in a manner that provides both wide coverage of potentially malicious sites as well as improves the freshness of information from which the safety reputation is derived. Community-based information, such as reports from users related to recently-visited network sites, malware detected by reporting network nodes, non-specific information such as unusual CPU usage and network activity of visiting nodes, and information received from other types of external feeds is used in determining the safety reputation and updating the safety reputation. Such information is analyzed in order to determine network sites that are potential sources of malware, which can then be subjected to more detailed analysis. Historical information as to a site's reputation and other factors such as commercial importance can also be reviewed to make a determination as to whether information being currently gathered by a community of users is sufficient to trigger additional analysis of the network site. Thus, resources used for detailed analysis of suspect network sites is conserved.
1. A method comprising:
receiving information related to safety of one or more network sites from one or more sources;
identifying a suspect network site of the one or more network sites using the received information, wherein
a safety rating is associated with the suspect network site, and
the safety rating for the suspect network site is determined prior to the identifying;
determining a probability that the safety rating for the suspect network site will change due to a security analysis of the suspect network site,
wherein
said determining comprises using the safety rating and the received information associated with the suspect network site;
responsive to the probability that the safety rating for the suspect network site will change, submitting the suspect network site to the security analysis; and
receiving a result from the security analysis, wherein
the safety rating for the suspect network site is configured to be changed using the result.
2. The method of claim 1 wherein said receiving information related to the safety of one or more network sites comprises:
receiving the information from a plurality of network nodes, wherein for each network node the information comprises
a corresponding history of network sites recently visited by the network node,
wherein
the corresponding history is a subset of the one or more network sites, and
a result of a security scan of the network node indicative of a presence of malicious software.
3. The method of claim 2 wherein the result of the security scan of the network node comprises an identification of the malicious software.
4. The method of claim 2 wherein the result of the security scan of the network node comprises an indication that one or more dynamic performance parameters associated with the network node exceed one or more corresponding predetermined thresholds.
5. The method of claim 4 wherein the one or more dynamic performance parameters comprise CPU usage and network usage.
6. The method of claim 2 wherein said identifying the suspect network site comprises:
analyzing the security scans from each network node to identify the presence of a common malicious software among a first subset of the network nodes;
analyzing the history of network sites recently visited by each network node of the first subset of the network nodes to identify a site commonly visited by a plurality of the first subset of network nodes; and
identifying the suspect network site as the site commonly visited by the plurality of the first subset of network nodes.
7. The method of claim 1 , wherein
the one or more sources comprises one or more trusted sources and one or more untrusted sources, and
said identifying a suspect network site comprises
aggregating information from untrusted sources, and
applying a greater weight to information from trusted sources.
8. The method of claim 1 wherein said determining the probability that the safety rating for the suspect network site will change due to a security analysis of the suspect network site further comprises:
calculating a decayed safety rating comprising a decay in accuracy of the previously safety rating, wherein
the decay in accuracy is dependent upon a time expiring since the safety rating was calculated; and
applying a statistical analysis to the received information associated with the suspect network site and the decayed safety rating to calculate the probability that the safety rating for the suspect network site will change due to a security analysis of the suspect network site.
9. The method of claim 8 wherein the statistical analysis comprises a Bayesian analysis.
10. That method of claim 1 further comprising:
calculating an expected change in utility to a user of the safety rating for the suspect network site using the probability that the safety rating for the suspect network site will change due to a security analysis of the suspect network site; and
performing said submitting the suspect network site to security analysis if the expected change in utility exceeds a predetermined threshold.
11. An apparatus comprising:
at least one processor;
an input module configured to receive information related to safety of one or more network sites from one or more sources;
an event processor module, coupled to the input module, and configured to be executed by the at least one processor to:
identify a suspect network site of the one or more network sites using the received information, wherein
a safety rating is associated with the suspect network site, and
the safety rating for the suspect network site is determined prior to the event processor performing the identification, and
submit the suspect network site to a scheduler module for security analysis in response to a probability that the safety rating for the suspect network site will change if the suspect network site is subjected to the security analysis;
a statistical analysis module, coupled to the event processor module, and configured to determine the probability that the safety rating for the suspect network site will change due to a security analysis of the suspect network site, wherein
said determining comprises using the safety rating and the received information associated with the suspect network site;
a scheduler module, coupled to the event processor module and to one or more security analysis engines, and configured to
queue the suspect network site for security analysis by a selected one of the one or more security analysis engines, wherein
the selected one of the one or more security analysis engines is configured to perform the security analysis to provide a result; and
a database interface module, coupled to the event processor module, and configured to provide the safety rating to a database for storage, wherein the safety rating is configured to be changed using the result.
12. The apparatus of claim 11 wherein the input module is further configured to:
receive the information related to the safety of one or more network sites from a plurality of network nodes, wherein for each network node the information comprises
a corresponding history of network sites recently visited by the network node,
wherein
the corresponding history is a subset of the one or more network sites, and
a result of a security scan of the network node indicative of a presence of malicious software.
13. The apparatus of claim 12 wherein the event processor module performs said identifying the suspect network site by further being configured to be executed to:
analyze the security scans from each network node to identify the presence of a common malicious software among a first subset of the network nodes;
analyze the history of network sites recently visited by each network node of the first subset of the network nodes to identify a site commonly visited by a plurality of the first subset of network nodes; and
identify the suspect network site as the site commonly visited by the plurality of the first subset of network nodes.
14. The apparatus of claim 11 , wherein
the one or more sources comprises one or more trusted sources and one or more untrusted sources; and
the event processor module is further configured to
aggregate information from untrusted sources, and
apply a greater weight to information from trusted sources.
15. The apparatus of claim 11 wherein the statistical analysis module performs said determining the probability that the safety rating for the suspect network site will change due to a security analysis of the suspect network site by further being configured to:
calculate a decayed safety rating comprising a decay in accuracy of the previously determined safety rating, wherein
the decay in accuracy is dependent upon a time expiring since the predetermined safety rating was calculated; and
apply a statistical analysis to the received information associated with the suspect network site and the decayed safety rating to calculate the probability that the previously determined safety rating for the suspect network site will change due to a security analysis of the suspect network site.
16. A non-transitory computer-readable storage medium comprising:
a first set of instructions, executable by a processor, configured to receive information related to safety of one or more network sites from one or more sources;
a second set of instructions, executable by the processor, configured to identify a suspect network site of the one or more network sites using the received information,
wherein
a safety rating is associated with the suspect network site, and
the safety rating for the suspect network site is determined prior to the identifying;
a third set of instructions, executable by the processor, configured to determine a probability that a safety rating for the suspect network site will change due to a security analysis of the suspect network site, wherein the third set of instructions further comprises a fourth set of instructions,
executable by the processor, configured to use the safety rating and the received information associated with the suspect network site;
a fifth set of instructions, executable by the processor, configured to submit the suspect network site to a security analysis in response to the probability that the safety rating for the suspect network site will change; and
a sixth set of instructions, executable by the processor, configured to receive a result from the security analysis, wherein
the safety rating for the suspect network site is configured to be changed using the result.
17. The non-transitory computer-readable storage medium of claim 16 wherein the first set of instructions further comprises:
a seventh set of instructions, executable by the processor, configured to receive the information from a plurality of network nodes, wherein for each network node the information comprises
a corresponding history of network sites recently visited by the network node,
wherein
the corresponding history is a subset of the one or more network sites, and
a result of a security scan of the network node indicative of a presence of malicious software.
18. The non-transitory computer-readable storage medium of claim 17 wherein the second set of instructions further comprises:
an eighth set of instructions, executable by the processor, configured to analyze the security scans from each network node to identify the presence of a common malicious software among a first subset of the network nodes;
a ninth set of instructions, executable by the processor, configured to analyze the history of network sites recently visited by each network node of the first subset of the network nodes to identify a site commonly visited by a plurality of the first subset of network nodes; and
a tenth set of instructions, executable by the processor, configured to identify the suspect network site as the site commonly visited by the plurality of the first subset of network nodes.
19. The non-transitory computer-readable storage medium of claim 16 wherein the third set of instructions further comprises:
a seventh set of instructions, executable by the processor, configured to calculate a decayed safety rating comprising a decay in accuracy of the safety rating, wherein
the decay in accuracy is dependent upon a time expiring since the predetermined safety rating was calculated; and
an eighth set of instructions, executable by the processor, configured to apply a statistical analysis to the received information associated with the suspect network site and the decayed safety rating to calculate the probability that the safety rating for the suspect network site will change due to a security analysis of the suspect network site.
20. The non-transitory computer-readable storage medium of claim 16 further comprising:
a seventh set of instructions, executable by the processor, configured to calculate an expected change in utility to a user of the safety rating for the suspect network site using the probability that the safety rating for the suspect network site will change due to a security analysis of the suspect network site; and
an eighth set of instructions, executable by the processor, configured to perform said submitting the suspect network site to security analysis if the expected change in utility exceeds a predetermined threshold.