Real-time network updates for malicious content
A global response network collects, analyzes, and distributes “cross-vector” threat-related information between security systems to allow for an intelligent, collaborative, and comprehensive real-time response.
1. A method for establishing the reputation of message components, the method comprising:
disassembling an electronic mail message into constituent components at a security appliance coupled to an end-user computing device that processes electronic mail;
identifying a reputation for each of the constituent components, the identified reputation based on aggregated data specific to the constituent component and received from a data center;
processing one or more of the constituent components at the security appliance using a hash process to create a thumbprint of the one or more constituent components; and
transmitting the thumbprints from the security appliance to the data center for subsequent processing and distribution to other security appliances, wherein each of the transmitted thumbprints has a corresponding reputation.
2. The method of claim 1 , wherein the corresponding reputation for one or more of the transmitted thumbprints is good.
3. The method of claim 1 , wherein the corresponding reputation for one or more of the transmitted thumbprints is bad.
4. The method of claim 1 , wherein the hash process is non-reversible.
5. The method of claim 1 , wherein the transmitted thumbprints are transmitted over an encoded HTTPS connection.
6. The method of claim 1 , wherein at least one of the votes is from a desktop application executing at a computing device coupled to the security appliance.
7. The method of claim 1 , wherein at least one of the votes is from an enterprise server.
8. The method of claim 1 , wherein the corresponding reputation for one or more of the transmitted thumbprints is an anonymously assigned reputation.
9. The method of claim 1 , further comprising receiving updated thumbprints from the data center, the updated thumbprints compiled from a plurality of other security appliances on a global communications network.
10. The method of claim 9 , further comprising using the updated thumbprints compiled from a plurality of other security appliances on the global communications network to filter electronic mail messages including constituent components associated with a thumbprint from having a particular reputation from entering a secure network.
11. A system for establishing the reputation of message components, the system comprising:
a security appliance coupled to an end-user computing device that processes electronic mail, the security appliance comprising:
a processor for executing instructions stored in memory, wherein execution of the instructions by the processor:
disassembles an electronic mail message into constituent components,
identifies a reputation for each of the constituent components, the identified reputation based on aggregated data specific to the constituent component and received from a data center,
processes one or more of the constituent components using a hash process to create a thumbprint of the one or more constituent components; and
a communications interface for transmitting the thumbprints to a data center for subsequent processing and distribution to other security appliances, wherein each of the transmitted thumbprints has a corresponding reputation.
12. The system of claim 11 , wherein the transmitted thumbprints are transmitted over an encoded HTTPS connection.
13. The system of claim 11 , wherein the communications interface receives at least one of the votes from a desktop application executing at a computing device coupled to the security appliance.
14. The system of claim 11 , wherein the communications interface receives at least one of the votes from an enterprise server.
15. The system of claim 11 , wherein the corresponding reputation for one or more of the transmitted thumbprints is an anonymously assigned reputation.
16. The system of claim 11 , wherein the communications interface further receives updated thumbprints from the data center, the updated thumbprints compiled from a plurality of other security appliances on a global communications network.
17. The system of claim 12 , wherein further execution of instructions by the processor uses the updated thumbprints compiled from a plurality of other security appliances on the global communications network to filter electronic mail messages including constituent components associated with a thumbprint from having a particular reputation from entering a secure network.
18. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor to perform a method for establishing the reputation of message components, the method comprising:
disassembling an electronic mail message into constituent components at a security appliance coupled to an end-user computing device that processes electronic mail;
identifying a reputation for each of the constituent components, the identified reputation based on aggregated data specific to the constituent component and received from a data center;
processing one or more of the constituent components at the security appliance using a hash process to create a thumbprint of the one or more constituent components; and
transmitting the thumbprints from the security appliance to the data center for subsequent processing and distribution to other security appliances, wherein each of the transmitted thumbprints has a corresponding reputation.