Granted Patent B2

US 8,549,641 · App. 12/553,658 · Granted Oct 1, 2013

Abstract

Claims (116)

1. A method for remotely auditing a security posture of a client machine at a centralized server, the method comprising:

receiving, by the centralized server, a security report from the client machine, wherein the security report comprises entries associated with a plurality of security events, wherein a respective entry of the security report indicates a particular security event to be executed on the client machine, and wherein a respective entry of the security report is generated and encrypted using an entry-specific signing key that is erased after the respective entry is encrypted and before the security event takes effect at the client machine, thereby preventing entries of the security report from being corrupted by a security attack;

detecting a pattern among entries in one or more reports received from one or more client machines, wherein the pattern indicates a probable security attack, and wherein detecting the pattern involves:

obtaining a fixed public key for a respective report, wherein the fixed public key provides a decryption key corresponding to a plurality of entry-specific signing keys each used to encrypt an entry of the respective report;

decrypting entries of the respective report using the corresponding fixed public key;

determining characteristics of the security event and the client machine configuration from the one or more security reports that were recorded before the security event takes effect; and

analyzing the determined characteristics to identify the detected pattern; and

classifying the security posture of the client machine based on the detected pattern.

2. The method of claim 1 , wherein at least a part of the report is generated from one or more sources, the sources comprising: the client machine, a router, a cell phone tower, a carrier, network data from a third party, and any other device associated with the client machine.

3. The method of claim 2 , further comprising:

receiving a plurality of reports from a plurality of the sources, wherein a respective report comprises a common element;

identifying a discrepancy of the common element among the plurality of reports; and

resolving the identified discrepancy in accordance with a predetermined criterion.

4. The method of claim 1 , wherein the report entries comprise one or more characteristics of the security events to facilitate identification of the probable security attack.

5. The method of claim 1 , wherein the security events associated with the report entries comprise one or more of:

installing an executable file;

opening an attachment in an email message;

browsing a Uniform Resource Locator (URL) of a website;

visiting an Internet Protocol (IP) address; and

making a wireless connection.

6. The method of claim 1 , wherein the security events are associated with an application on the client machine:

that is determined to be malicious;

that is determined to have vulnerabilities;

that is not permitted to install or execute under terms of service of the client machine;

that potentially has a negative impact on the client machine; or

that needs to be updated, replaced, or removed.

7. The method of claim 4 , wherein the plurality of characteristics comprise one or more of:

a local time;

a time zone;

a geographic location;

a social network;

a type of an application;

a user history;

a device platform type; and

a device configuration.

8. The method of claim 1 , wherein detecting the pattern in the at least one characteristic further comprises:

generating a list of secure or susceptible security events; and

determining whether the security events associated with the report entries are present in the list.

9. The method of claim 8 , wherein detecting the pattern in the at least one characteristic further comprises detecting a security event that is highly correlated with the probable security attack but is not included in the list, the security event comprising one of:

an event that occurs on the client machine more or less often than on other devices;

receipt of an email from a sender not in a user's contact list;

a connection attempt from an external source;

a visit to a URL that the user does not navigate to;

a browser redirection with an invalid field;

an event following installation of a client application; and

an event following refusal by the user to install the client application.

10. The method of claim 1 , wherein classifying the security posture of the client machine comprises performing one or more of the following operations:

classifying the client machine as being infected by malware spreading via a wireless connection, wherein the detected pattern shows correlation between the security events associated with the report entries and a geographic characteristic as a function of time;

classifying the client machine as being infected by malware spreading via an attachment, wherein the detected pattern shows correlation between the security events and a social characteristic;

classifying the client machine as being infected by a worm, wherein the detected pattern shows that occurrence of the security events is independent of a local time characteristic;

classifying the client machine as being infected by malware, wherein the detected pattern shows that the occurrence of the security events is notably more frequent than a normal frequency;

classifying the client machine as being infected by malware, wherein the detected pattern shows a consistent inclusion of a characteristic during the security events; and

classifying the client machine as being infected by malware, wherein the detected pattern shows that the occurrence of the security events is a function of a platform, an application, or a configuration.

11. The method of claim 1 , wherein the report entry further comprises:

one or more ciphertext sections that describe the associated security event in various degrees of details, and

a plaintext section that describes a general classification of the associated security event.

12. The method of claim 1 , wherein the client machine is also configured as a server for remotely auditing the security posture of another client machine in a hierarchic or circular architecture.

13. A system for remotely auditing a security posture of a client machine at a centralized server, the system comprising:

a processor;

a memory;

a report receiving mechanism configured to receive a security report at the centralized server from the client machine, wherein the security report comprises entries associated with a plurality of security events, wherein a respective entry of the security report indicates a particular security event to be executed on the client machine, and wherein a respective entry of the security report is generated and encrypted using an entry-specific signing key that is erased after the respective entry is encrypted and before the security s event takes effect at the client machine, thereby preventing entries of the report from being corrupted by a security attack;

a pattern detecting mechanism configured to detect a pattern among entries in one or more reports received from one or more client machines, wherein the pattern indicates a probable security attack, and wherein while detecting the pattern, the pattern detecting mechanism is configured to:

obtain a fixed public key for a respective report, wherein the fixed public key provides a decryption key corresponding to a plurality of entry-specific signing keys each used to encrypt an entry of the respective report;

decrypt entries of the respective report using the corresponding fixed public key;

determine characteristics of the security event and the client machine configuration from the one or more security reports that were recorded before the security event takes effect; and

analyze the determined characteristics to identify the detected pattern; and

a security posture classifying mechanism configured to classify the security posture of the client machine based on the detected pattern.

14. The system of claim 13 , where in at least a part of the report is generated from one or more sources, the sources comprising: the client machine, a router, a cell phone tower, a carrier, network data from a third party, and any other device associated with the client machine.

15. The system of claim 13 , further comprising:

receiving a plurality of reports from a plurality of resources, wherein a respective report comprises a common element;

identifying a discrepancy of common element among the plurality of reports; and

resolving the identified discrepancy in accordance with a predetermined criterion.

16. The system of claim 13 , wherein the report entries comprise one or more characteristics of the security events to facilitate identification of the probable security attack.

17. The system of claim 13 , wherein the security events associated with the report entries comprise one or more of:

installing an executable file;

opening an attachment in an email message;

browsing a Uniform Resource Locator (URL) of a website;

visiting an Internet Protocol (IP) address; and

making a wireless connection.

18. The system of claim 13 , wherein the security events are associated with an application on the client machine:

that is determined to be malicious;

that is determined to have vulnerabilities;

that is not permitted to install or execute under terms of service of the client machine;

that potentially has a negative impact on the client machine; or

that needs to be updated, replaced, or removed.

19. The system of claim 13 , wherein the plurality of characteristics comprise one or more of:

a local time;

a time zone;

a geographic location;

a social network;

a type of an application;

a user history;

a device platform type; and

a device configuration.

20. The system of claim 13 , wherein the pattern detector is further configured to:

generate a list of secure or susceptible security events; and

determine whether the security events associated with the report entries are present in the list.

21. The system of claim 20 , wherein the pattern detector is further configured to detect a security event or security state that is highly correlated with the probable security attack but is not included in the list, the security event or security state comprising one of:

an event that occurs on the client machine more or less often than on other devices;

receipt of an email from a sender not in a user's contact list;

a connection attempt from an external source;

a visit to a URL that the user does not navigate to;

a browser redirection with an invalid field;

an event following installation of a client application; and

an event following refusal by the user to install the client application.

22. The system of claim 13 , wherein the security posture classifier is configured to perform one or more of the following operations:

classifying the client machine as being infected by malware spreading via a wireless connection, wherein the detected pattern shows correlation between the security events associated with the report entries and a geographic characteristic as a function of time;

classifying the client machine as being infected by malware spreading via an attachment, wherein the detected pattern shows correlation between the security events and a social characteristic;

classifying the client machine as being infected by a worm, wherein the detected pattern shows that occurrence of the security events is independent of a local time characteristic;

classifying the client machine as being infected by malware, wherein the detected pattern shows that the occurrence of the security events is notably more frequent than a normal frequency;

classifying the client machine as being infected by malware, wherein the detected pattern shows a consistent inclusion of a characteristic during the security events; and

classifying the client machine as being infected by malware, wherein the detected pattern shows that the occurrence of the security events is a function of a platform, an application, or a configuration.

23. The system of claim 13 , wherein the log entry further comprises:

one or more ciphertext sections that describe the associated security event or security state or both in various degrees of details, and

a plaintext section that describes a general classification of the associated security event or security state or both.

24. The system of claim 13 , wherein the client machine is also configured as a server for remotely auditing the security posture of another client machine in a hierarchic or circular architecture.

Assignments (10)