Systems and methods for using client reputation data to classify web domains
View Patent ↗A computer-implemented method for using client reputation data to classify web domains may include identifying a web domain. The computer-implemented method may also include identifying at least one client that has attempted to access the web domain. The computer-implemented method may further include identifying a reputation associated with the client that attempted to access the web domain. The computer-implemented method may additionally include classifying the web domain based at least in part on the reputation of the client that attempted to access the web domain. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for using client reputation data to classify web domains, the method comprising:
identifying, at a server-side computing device that comprises at least one processor, a web domain;
identifying, at the server-side computing device, a plurality of applications that previously attempted to access the web domain;
identifying, at the server-side computing device, at least one client device that previously attempted to access the web domain at least in part by receiving information from the client device that indicates that an attempt by the client device to access the web domain triggered a security event;
calculating, at the server-side computing device, a proportion of applications within the plurality of applications that have a reputation for being malicious;
classifying, at the server-side computing device, the web domain based at least in part on the calculated proportion of applications, of the plurality of applications that previously attempted to access the web domain, that have the reputation for being malicious.
2. The method of claim 1 , wherein
the attempt by the client device to access the web domain comprises an attempt by a user of the client device to access the web domain.
3. The method of claim 1 , wherein the information received from the client device identifies at least one of:
the client device;
the web domain.
4. The method of claim 1 , wherein classifying the web domain comprises:
identifying a threat category triggered by the client device's attempt to access the web domain;
classifying the web domain based at least in part on the threat category triggered by the client device's attempt to access the web domain.
5. The method of claim 1 , wherein classifying the web domain comprises ignoring at least some reputation information collected outside of a predetermined time window when classifying the web domain.
6. The method of claim 1 , wherein classifying the web domain comprises:
calculating a reputation score for the web domain based at least in part on the reputation of the client device that previously attempted to access the web domain;
determining that the reputation score for the web domain achieves a maliciousness threshold.
7. The method of claim 6 , further comprising, upon determining that the reputation score for the web domain achieves a maliciousness threshold, performing a security operation on the web domain.
8. The method of claim 7 , wherein performing the security operation on the web domain comprises at least one of:
adding the web domain to a blacklist;
blocking downloading of files from the web domain.
9. The method of claim 8 , further comprising:
after calculating the reputation score, identifying a reputation of at least one additional client device that previously attempted to access the web domain;
updating the reputation score for the web domain based at least in part on the reputation of the additional client device.
10. The method of claim 9 , further comprising:
making a second determination that the updated reputation score does not achieve the maliciousness threshold;
updating the classification of the web domain by removing the web domain from the blacklist in response to determining that the updated reputation score does not achieve the maliciousness threshold.
11. The method of claim 1 , wherein classifying the web domain comprises classifying the web domain based at least in part on at least one of:
a third-party classification of the web domain;
a previous classification of the web domain.
12. A system for using client reputation data to classify web domains, comprising:
a web domain identification module programmed to identify, at a server-side computing device, a web domain;
a client identification module programmed to:
identify, at the server-side computing device, a plurality of applications that previously attempted to access the web domain;
identify, at the server-side computing device, at least one client device that previously attempted to access the web domain at least in part by receiving information from the client device that indicates that an attempt by the client device to access the web domain triggered a security event;
a client reputation identification module programmed to calculate, at the server-side computing device, a proportion of applications within the plurality of applications that have a reputation for being malicious;
a web domain classification module programmed to classify, at the server-side computing device, the web domain based at least in part on the calculated proportion of applications, of the plurality of applications that previously attempted to access the web domain, that have the reputation for being malicious;
at least one processor configured to execute at least one of the web domain identification module, the client identification module, the client reputation identification module, and the web domain classification module.
13. The system of claim 12 , wherein
the attempt by the client device to access the web domain comprises an attempt by a user of the client device to access the web domain.
14. The system of claim 12 , wherein the information received from the client device identifies at least one of:
the client device;
the web domain.
15. The system of claim 12 , wherein the web domain classification module classifies the web domain by:
identifying a threat category triggered by the client device's attempt to access the web domain;
classifying the web domain based at least in part on the threat category triggered by the client device's attempt to access the web domain.
16. The system of claim 12 , wherein the web domain classification module classifies the web domain by ignoring at least some reputation information collected outside of a predetermined time window when classifying the web domain.
17. The system of claim 12 , wherein the web domain classification module classifies the web domain by:
calculating a reputation score for the web domain based at least in part on the reputation of the client device that previously attempted to access the web domain;
determining that the reputation score for the web domain achieves a maliciousness threshold.
18. A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
identify, at a server-side computing device that comprises at least one processor, a web domain;
identify, at the server-side computing device, a plurality of applications that previously attempted to access the web domain;
identify, at the server-side computing device, at least one client device that previously attempted to access the web domain at least in part by receiving information from the client device that indicates that an attempt by the client device to access the web domain triggered a security event;
calculate, at the server-side computing device, a proportion of applications within the plurality of applications that have a reputation for being malicious;
classify, at the server-side computing device, the web domain based at least in part on the calculated proportion of applications, of the plurality of applications that previously attempted to access the web domain, that have the reputation for being malicious.