Distributed system and method for tracking and blocking malicious internet hosts
View Patent ↗Disclosed are systems and methods to perform coordinated blocking of source addresses, such as an Internet Protocol (IP) addresses, across a plurality of network appliances (e.g., gateways). In one disclosed embodiment the method and system temporarily alter a configuration of one or more network appliances (based on user defined configuration parameters) to allow communication from a “blocked” IP address for a period of time. A network appliance can then “receive” an email and perform analysis and provide results of the analysis to a reputation service. Thereby, the temporarily allowed communication can be used to learn information about a threat which would not have been available if all communication from that IP address had actually been blocked at the network appliance.
1. A computer system configured to facilitate coordinated source blocking, the computer system comprising:
one or more connections to a plurality of computer networks; and
one or more processors communicatively coupled to each other wherein the one or more processors are collectively configured to:
receive information from a first gateway, the information pertaining to a network data transmission from a source address, the source address on a first network and the network data transmission intended for a destination address on a second network, the first and second network not directly connected to each other, the first gateway configured to protect the second network by preventing selected network data transmissions from reaching the second network;
determine a score based on the received information;
determine a participation status, the participation status indicating the first gateway's participation in a coordinated source blocking method;
prepare a first response message for transmission to the first gateway, the first response message comprising an indication of the score and a blocking request indicator, wherein the blocking request indicator comprises information requesting the first gateway not to block future information from the source address even when the score indicates the network data transmission is to be blocked; and
initiating transmission of the first response message to the first gateway.
2. The computer system of claim 1 , wherein the first response message comprises the blocking request indicator only if the participation status indicates participation in the coordinated source blocking.
3. The computer system of claim 1 , wherein the network data transmission comprises an email message, a download object, a universal resource locator (URL), an instant message, a file transfer protocol (FTP) transmission, a hypertext transfer protocol (HTTP) transmission, a voice over internet protocol (VOIP) transmission, or a combination thereof.
4. The computer system of claim 1 , wherein protocol of the network data transmission comprises Internet Protocol version 4 (IPv4) or Internet Protocol version 6 (IPv6).
5. The computer system of claim 1 , wherein the source address comprises an internet protocol (IP) address, a domain name, a universal resource locator (URL), a hostname, or a combination thereof.
6. The computer system of claim 1 , wherein the information received from the first gateway comprises a finger print of at least a portion of the network data transmission.
7. The computer system of claim 1 , wherein the blocking request indicator in the first response message is based upon blocking status, relative to the source address, of a second gateway.
8. The computer system of claim 1 , wherein the blocking request indicator in the first response message is based upon network activity associated with the source address of the network data transmission.
9. The computer system of claim 1 , wherein the blocking request indicator in the first response message is based upon configuration information of the first gateway.
10. The computer system of claim 1 , wherein the blocking request indicator in the first response message is based upon the determined score.
11. The computer system of claim 1 , wherein the computer system comprises a cloud resource.
12. The computer system of claim 1 , wherein the one or more processors are further configured to proactively send a second message to a second gateway participating in the coordinated blocking method, the second message comprising a blocking request indicator pertaining to the source address of the network data transmission received by the first gateway regardless of if the second gateway has received a transmission from the source address.
13. The computer system of claim 12 , wherein the second message is sent to the second gateway to request the second gateway to not block the source address.
14. The computer system of claim 13 , wherein the request to not block the source address indicates a period of time to not block the source address.
15. The computer system of claim 12 , wherein the second message is sent to the second gateway to request the second gateway to block the source address.
16. A non-transitory computer readable medium comprising program instructions stored thereon to configure one or more processors to:
receive information from a first gateway, the information pertaining to a network data transmission from a source address, the source address on a first network and the network data transmission intended for a destination address on a second network, the first and second network not directly connected to each other, the first gateway configured to protect the second network by preventing selected network data transmissions from reaching the second network;
determine a score based on the received information;
determine a participation status indicating if the first gateway is participating in a coordinated source blocking method;
prepare a first response message for transmission to the first gateway, the first response message comprising an indication of the score and a blocking request indicator, wherein the blocking request indicator comprises information requesting the first gateway not to block future information from the source address even when the score indicates the network data transmission is to be blocked; and
initiate transmission of the first response message to the first gateway.
17. The non-transitory computer readable medium of claim 16 wherein the blocking request indicator in the first response message is based upon the determined score and the determined participation status of the first gateway.
18. The non-transitory computer readable medium of claim 16 further comprising program instructions to configure one or more processors to send a second message to a second gateway participating in the coordinated blocking method, the second message comprising a blocking request indicator pertaining to the source address of the network data transmission received by the first gateway regardless of if the second gateway has received a transmission from the source address.
19. A network appliance gateway configured to participate in a coordinated source address blocking method, the network appliance gateway comprising:
one or more connections to a first network and a second network, the first and second networks not directly connected to each other, wherein the network appliance gateway is configured to protect the second network by preventing selected network data transmissions from reaching the second network; and
one or more processors communicatively coupled to each other, wherein the one or more processors are configured to:
receive a network data transmission from a source address, the source address on the first network and the network data transmission intended for a destination address on the second network;
perform a fingerprint analysis of at least a portion of the network data transmission;
send a first message to a centralized blocking coordination computer system, the first message comprising an indication of the fingerprint analysis, an indication of the source address, and blocking configuration information pertaining to the network appliance gateway wherein the blocking configuration information comprises an indication of participation status, in a coordinated source address blocking method, for the network appliance gateway;
receive a second message in response to the first message, the second message comprising a score related to the information in the first message and a blocking request, wherein the blocking request comprises information requesting the network appliance gateway not to block future information from the source address even when the score related to the information in the first message indicates the network data transmission is to be blocked by the network appliance gateway; and
determine to block or not block communication from the source address based on the blocking request and on information in the second message.
20. The network appliance gateway of claim 19 wherein the network appliance gateway is configured as a subscriber to a cloud performing a centralized blocking function.
21. The network appliance gateway of claim 19 wherein blocking of transmissions from the source address is only performed if the score is above a configured threshold.
22. The network appliance gateway of claim 19 wherein blocking of transmissions from the source address is determined based on local configuration information of the network appliance gateway.
23. The network appliance gateway of claim 19 wherein the second message further indicates a period of time associated with the request not to block future information from the source address.
24. The network appliance gateway of claim 19 wherein the second message further comprises network communication information pertaining to the source address and blocking of transmissions from the source address is determined based at least in part on the network communication information.
25. The network appliance gateway of claim 19 , wherein the network data transmission comprises an email message, a download object, a universal resource locator (URL), an instant message, a file transfer protocol (FTP) transmission, a hypertext transfer protocol (HTTP) transmission, a voice over internet protocol (VOIP) transmission, or a combination thereof.
26. The network appliance gateway of claim 19 , wherein protocol of the network data transmission comprises Internet Protocol version 4 (IPv4) or Internet Protocol version 6 (IPv6).
27. The network appliance gateway of claim 19 , wherein the source address comprises an internet protocol (IP) address, a domain name, a universal resource locator (URL), a hostname, or a combination thereof.
28. A non-transitory computer readable medium comprising program instructions stored thereon to configure one or more processors to:
receive a network data transmission from a source address, the source address on a first network and the network data transmission intended for a destination address on a second network, the one or more processors configured to protect the second network by preventing selected network data transmissions from reaching the second network;
perform a fingerprint analysis of at least a portion of the network data transmission;
send a first message to a centralized blocking coordination computer system, the first message comprising an indication of the fingerprint analysis, an indication of the source address, and blocking configuration information pertaining to the one or more processors, wherein the blocking configuration information comprises an indication of participation status, in a coordinated source address blocking method, for a network appliance gateway;
receive a second message in response to the first message, the second message comprising a score related to information in the first message and a blocking request, wherein the blocking request comprises information requesting the one or more processors not to block future information from the source address even when the score related to information in the first message indicates the network data transmission is to be blocked by the one or more processors; and
determine to block or not block future communication from the source address based on the blocking request and on information in the second message.
29. A network appliance gateway configured to participate in a coordinated source address blocking method, the network appliance gateway comprising:
one or more connections for connection to a first network and a second network, the first and second networks not directly connected to each other, wherein the network appliance gateway is configured to protect the second network by preventing selected network data transmissions from reaching the second network; and
one or more processors communicatively coupled to each other, wherein the one or more processors are configured to:
receive a message from a centralized blocking coordination computer system, the message comprising a request for the network appliance gateway not to block future network data transmissions from a source address on the first network wherein the network appliance gateway has not previously received a network data transmission from the source address after the centralized blocking coordination computer system has determined that network data transmissions from the source address have a score above a blocking threshold; and
determine to not block communication from the source address based on the blocking request and on information in the message wherein the determination is based at least in part on local configuration information of the network appliance gateway.