System and method for sharing malware analysis results
View Patent ↗In certain embodiments, a computer-implemented method includes accessing information related to a first file determined to satisfy at least one of a plurality of suspected malware conditions. A first of a number of manager consoles may access the information, each manager console being communicatively coupled to a respective network of a number of networks. A request may be generated for a determination of whether the first file comprises malware. The determination may be conducted at a master manager console. Data may be accessed indicating a result, outputted by the master manager console, of the determination of whether the first file comprises malware. A sharing policy may be accessed and used to determine whether the result is sharable with a second one of the manager consoles. If the result is sharable, a message comprising the result may be generated to be sent to the second manager console.
1. A computer-implemented method, comprising:
accessing, by a first manager console of a plurality of manager consoles, information related to a first file determined to satisfy at least one of a plurality of suspected malware conditions, each manager console communicatively coupled to a respective network of a plurality of networks, the information including data from a first malware detection process indicating the at least one suspected malware condition;
generating a request, by the first manager console, for a determination by a master manager console, of whether the first file comprises malware, the master manager console configured to access requests generated from each of the plurality of manager consoles;
accessing data indicating a result of the determination of whether the first file comprises malware, the result outputted by the master manager console;
accessing, by the first manager console, a sharing policy associated with the first manager console, the sharing policy including an indication of what information the first manager console may share with other manager consoles of the plurality of manager consoles in the plurality of networks;
determining that the sharing policy indicates that the result is sharable with a second manager console of the plurality of manager consoles, the second manager console communicatively coupled to a second network of the plurality of networks;
generating, by the first manager console, in response to the determination that the sharing policy indicates that the result is sharable with the second manager console, a message to be sent from the first manager console to the second manager console, the message comprising the result of the determination of whether the first file comprises malware;
accessing, by the first manager console of the plurality of manager consoles, information related to a second file determined to satisfy at least one of the plurality of suspected malware conditions, the information including data from the first malware detection process indicating the at least one suspected malware condition;
generating a second request, by the first manager console, for a second determination by the master manager console, of whether the second file comprises malware;
accessing data indicating a second result of the second determination of whether the second file comprises malware, the second result outputted by the master manager console;
accessing, by the first manager console, the sharing policy associated with the first manager console;
determining that the sharing policy indicates that the result is not sharable with the second manager console of the plurality of manager consoles; and
refraining from sharing the second result, by the first manager console, in response to the determination that the sharing policy indicates that the result is not sharable with the second manager console;
wherein each manager console of the plurality of manager consoles is remote from each other management console.
2. The method of claim 1 , wherein the information related to the first file and the data from the first malware detection process are generated by a detection node coupled to the first manager console.
3. The method of claim 1 , wherein each respective network of the plurality of networks is associated with a respective organization of a plurality of organizations.
4. The method of claim 1 , wherein the first manager console is remote from the master manager console.
5. The method of claim 1 , wherein each manager console is configured as a firewall for the respective network of the plurality of networks to which the manager console is communicatively coupled.
6. The method of claim 1 , further comprising pushing a message representing the result to at least a subset of malware analysis nodes communicatively coupled to the master manager console through the first manager console, the message indicating that the first file does not comprise malware.
7. The method of claim 1 , further comprising encrypting the message and routing the encrypted message through the master manager console.
8. A computer-implemented method, comprising:
accessing, by a master manager console, a request for a determination of whether a first file suspected of malware comprises malware, the master manager console configured to access requests generated from each of a plurality of manager consoles;
generating, by the master manager console in response to the determination, an output indicating a result of the determination of whether the first file comprises malware;
accessing an address of a first manager console of a plurality of manager consoles, each of the plurality of manager consoles residing at a respective network of a plurality of networks, the first manager console having generated the request for the determination of whether the first file comprises malware;
accessing, by the master manager console, a sharing policy associated with the first manager console, the sharing policy including an indication of what information the first manager console may share with other manager consoles of the plurality of manager consoles in the plurality of networks;
determining that the sharing policy indicates that the result is sharable with a second manager console of the plurality of manager consoles;
generating, in response to the determination that the sharing policy indicates that the result is sharable with the second manager console, a message to be sent to the second manager console, the message comprising the result of the determination of whether the first file comprises malware;
accessing, by the master manager console, a second request for a second determination of whether a second file suspected of malware comprises malware;
generating, by the master manager console in response to the second determination, a second output indicating a second result of the second determination of whether the second file comprises malware;
accessing, by the master manager console, the sharing policy associated with the first manager console;
determining that the sharing policy indicates that the result is not sharable with a second manager console of the plurality of manager consoles; and
refraining from sharing the second output, in response to the determination that the sharing policy indicates that the second result is not sharable with the second manager console;
wherein each manager console of the plurality of manager consoles is remote from each other management console.
9. The method of claim 8 , wherein each respective network of the plurality of networks is inaccessible to each other respective network of the plurality of networks.
10. The method of claim 9 , wherein each respective network of the plurality of networks is associated with a respective organization of a plurality of organizations.
11. The method of claim 9 , wherein each manager console is configured as a firewall for the respective network of the plurality of networks to which the manager console is communicatively coupled.
12. The method of claim 8 further comprising determining a fee associated with the determination of whether the first file comprises malware.
13. The method of claim 12 , further comprising determining an apportionment of the fee among each of the first and second manager consoles.
14. The method of claim 8 , wherein the first manager console is remote from the master manager console.
15. The method of claim 8 , further comprising pushing a message representing the result to at least a subset of malware analysis nodes communicatively coupled to the first manager console, the message indicating that the first file does not comprise malware.
16. The method of claim 8 , further comprising encrypting the message and routing the encrypted message through the master manager console.
17. Non-transitory computer-readable media encoded with software, the software operable, when executed by a computing system, to perform operations comprising:
accessing, by a master manager console, a request for a determination of whether a first file suspected of malware comprises malware, the master manager console configured to access requests generated from each of a plurality of manager consoles;
generating, by the master manager console in response to the determination, an output indicating a result of the determination of whether the first file comprises malware;
accessing an address of a first manager console of a plurality of manager consoles, each of the plurality of manager consoles residing at a respective network of a plurality of networks, the first manager console having generated the request for the determination of whether the first file suspected of malware comprises malware;
accessing a sharing policy associated with the first manager console, the sharing policy including an indication of what information the first manager console shares with other manager consoles of the plurality of manager consoles in the plurality of networks;
determining that the sharing policy indicates that the result is sharable with a second manager console of the plurality of manager consoles;
generating, in response to the determination that the sharing policy indicates that the result is sharable with the second manager console, a message to be sent to the second manager console, the message comprising the result of the determination of whether the first file comprises malware;
accessing, by the master manager console, a second request for a second determination of whether a second file suspected of malware comprises malware;
generating, by the master manager console in response to the second determination, a second output indicating a second result of the second determination of whether the second file comprises malware;
accessing the sharing policy associated with the first manager console;
determining that the sharing policy indicates that the second result is not sharable with the second manager console of the plurality of manager consoles; and
refraining from sharing the second output, in response to the determination that the sharing policy indicates that the result is not sharable with the second manager console.
18. The computer-readable media of claim 17 , wherein the software is further operable, when executed by the computing system, to determine a fee associated with the determination of whether the first file comprises malware.
19. A computer-implemented method, comprising:
generating, by a detection node, information related to a first file determined to satisfy at least one of a plurality of suspected malware conditions by a first malware detection process, the information comprising data indicating the at least one of the plurality of suspected malware conditions;
accessing, by a first manager console of a plurality of manager consoles, the information related to the first file, each manager console communicatively coupled to a respective network of a plurality of networks and remote from each other manager console;
generating a request, by the first manager console, for a determination by a master manager console, of whether the first file comprises malware, the master manager console configured to access requests generated from each of the plurality of manager consoles;
accessing data indicating a result of the determination of whether the first file comprises malware, the result outputted by the master manager console;
accessing, by the first manager console, a sharing policy associated with the first manager console, the sharing policy including an indication of what information the first manager console may share with other manager consoles of the plurality of manager consoles in the plurality of networks;
determining that the sharing policy indicates that the result is sharable with a second manager console of the plurality of manager consoles, the second manager console communicatively coupled to a second network of the plurality of networks;
generating a message to be sent from the first manager console to the second manager console, in response to the determination that the sharing policy indicates that the result is sharable with the second manager console, the message comprising the result of the determination of whether the first file comprises malware;
pushing the message representing the result to at least a subset of malware analysis nodes communicatively coupled to the master manager console through the first manager console, the message indicating that the first file does not comprise malware;
generating, by the detection node, information related to a second file determined to satisfy at least one of the plurality of suspected malware conditions by the first malware detection process;
accessing, by the first manager console of a plurality of manager consoles, the information related to the second file;
generating a second request, by the first manager console, for a second determination by the master manager console, of whether the second file comprises malware;
accessing data indicating a second result of the second determination of whether the second file comprises malware, the result outputted by the master manager console;
accessing, by the first manager console, the sharing policy associated with the first manager console;
determining that the sharing policy indicates that the second result is not sharable with the second manager console of the plurality of manager consoles; and
refraining from sharing the second result, in response to the determination that the sharing policy indicates that the second result is not sharable with the second manager console.
20. The method of claim 19 , further comprising:
encrypting the message and routing the encrypted message through the master manager console;
wherein each respective network of the plurality of networks is associated with a respective organization of a plurality of organizations, and each manager console of the plurality of manager consoles is remote from the master manager console.