Real-time website safety reputation system
View Patent ↗A mechanism is provided for determining a safety reputation for a network site in a manner that provides both wide coverage of potentially malicious sites as well as improves the freshness of information from which the safety reputation is derived. Community-based information, such as reports from users related to recently-visited network sites, malware detected by reporting network nodes, non-specific information such as unusual CPU usage and network activity of visiting nodes, and information received from other types of external feeds is used in determining the safety reputation and updating the safety reputation. Such information is analyzed in order to determine network sites that are potential sources of malware, which can then be subjected to more detailed analysis. Historical information as to a site's reputation and other factors such as commercial importance can also be reviewed to make a determination as to whether information being currently gathered by a community of users is sufficient to trigger additional analysis of the network site. Thus, resources used for detailed analysis of suspect network sites is conserved.
1. A method comprising:
receiving information, wherein
the information is related to a plurality of network sites;
identifying a suspect network site of the plurality of network sites, wherein
the identifying is based on the information,
the information comprises a safety rating for the suspect network site, and
the safety rating for the suspect network site is determined prior to the identifying;
determining, using one or more processors, a probability that the safety rating for the suspect network site will change due to a security analysis of the suspect network site, wherein
the determining is based, at least in part, on
the safety rating for the suspect network site, and
a portion of the information, wherein
the portion of the information is associated with the suspect network site, and
performance of the security analysis of the suspect network site depends on a determination of the probability.
2. The method of claim 1 , further comprising:
responsive to the determination of the probability that the safety rating for the suspect network site will change, scheduling the security analysis for the suspect network site.
3. The method of claim 1 , further comprising:
receiving a result from the security analysis, wherein
the safety rating for the suspect network site is configured to be changed using the result.
4. The method of claim 1 , further comprising:
storing a result provided by the security analysis as a safety rating for the suspect network site.
5. The method of claim 1 , wherein the receiving the information comprises:
receiving the information from a plurality of network nodes, wherein
the information comprises, for each of the plurality of network nodes, one or more of
a history of network sites recently visited by the each respective network node, or
a result of a security scan of the each respective network node, wherein
the result is configured to indicate a presence of malicious software.
6. The method of claim 5 , wherein
the result of the security scan of the network node comprises
an indication of one or more dynamic performance parameters associated with the each respective network node.
7. The method of claim 1 , wherein the identifying the suspect network site comprises one or more of
analyzing security scans from the plurality of network nodes, wherein
the analyzing the security scans is configured to identify a presence of a malicious software in a first subset of the plurality of network nodes,
analyzing a history of network sites recently visited by each network node of the
first subset of the plurality of network nodes, wherein
the analyzing the history is configured to identify a site visited by a
plurality of the first subset of the purality of network nodes, or
identifying the suspect network site as the site that is visited by a plurality of the first subset of the plurality of network nodes.
8. The method of claim 1 , wherein
the information is received from one or more sources,
the one or more sources comprises
one or more trusted sources, and
one or more untrusted sources, and
the identifying the suspect network site further comprises
aggregating information from the one or more untrusted sources, and
applying a greater weight to a subset of the information that is received from the trusted sources.
9. The method of claim 8 , wherein
the identifying the suspect network site further comprises
aggregating information from the one or more untrusted sources, and
applying a greater weight to a subset of the information that is received from the trusted sources.
10. The method of claim 1 , wherein
the determining the probability comprises
calculating a decayed safety rating indicative of a decay in an accuracy of the safety rating, wherein
the decay in the accuracy is dependent on a time period since the safety rating was calculated; and
calculating the probability based on a statistical analysis of
the information, and
the decayed safety rating.
11. The method of claim 10 , wherein
the statistical analysis comprises a Bayesian analysis.
12. That method of claim 1 , further comprising:
calculating an expected change in utility to a user of the safety rating for the suspect network site, wherein
the calculating the expected change is based on the probability; and
scheduling the security analysis for the suspect network site if the expected change in utility exceeds a predetermined threshold.
13. An apparatus comprising:
at least one processor;
an input module configured to receive information, wherein
the information is related to safety of one or more network sites;
an event processor module, coupled to the input module, and configured to be executed by the at least one processor to:
identify a suspect network site of the one or more network sites, wherein
the event processor is configured to perform the identification using the information,
the information comprises a safety rating for the suspect network site, and
the safety rating for the suspect network site is determined prior to the event processor performing the identification, and
submit the suspect network site to a scheduler module for security analysis, wherein
the event processor is configured to perform the submitting depending on a determination of the probability; and
a statistical analysis module, coupled to the event processor module, and configured to determine the probability that the safety rating for the suspect network site will change due to a security analysis of the suspect network site, wherein
the statistical analysis module is configured to perform the determining based, at least in part, on
the safety rating, and
a portion of the information, wherein
the portion of the information is associated with the suspect network site.
14. The apparatus of claim 13 , further comprising:
the scheduler module, coupled to the event processor module and to one or more security analysis engines, and configured to
queue the suspect network site for security analysis, wherein
a selected one of the one or more security analysis engines is configured to perform the security analysis to provide a result.
15. The apparatus of claim 14 , further comprising:
a database interface module, coupled to the event processor module, and configured to provide the safety rating to a database for storage, wherein
the safety rating is configured to be changed using the result.
16. The apparatus of claim 13 , wherein
the input module is configured to receive the information from a plurality of network nodes, and
the information comprises, for each of the plurality of network nodes, one or more of a history of network sites recently visited by the each respective network node, or a result of a security scan of the each respective network node, wherein
the result is configured to indicate a presence of malicious software.
17. A non-transitory computer-readable storage medium comprising:
a first set of instructions, executable by a processor, configured to receive information, wherein
the information is related to a plurality of network sites;
a second set of instructions, executable by the processor, configured to identify a suspect network site of the one or more network sites, wherein
the identifying is based on the information,
the information comprises a safety rating for the suspect network site, and
the safety rating for the suspect network site is determined prior to the identifying, and
a third set of instructions, executable by the processor, configured to determine a probability that the safety rating for the suspect network site will change due to a security analysis of the suspect network site, wherein
the determining is based, at least in part, on
the safety rating for the suspect network site, and
a portion of the information, wherein
the portion of the information is associated with the suspect network site, and
performance of the security analysis of the suspect network site depends on a determination of the probability.
18. The non-transitory computer-readable storage medium of claim 17 , further comprising:
a fourth set of instructions, executable by the processor, configured to, in response to the determination that the probability that the safety rating for the suspect network site will change, schedule the security analysis for the suspect network site.
19. The non-transitory computer-readable storage medium of claim 17 , further comprising:
a fourth set of instructions, executable by the processor, configured to receive a result from the security analysis, wherein
the safety rating for the suspect network site is configured to be changed using the result.
20. The non-transitory computer-readable storage medium of claim 17 , further comprising:
a fourth set of instructions, executable by the processor, configured to
receive the information from a plurality of network nodes, wherein
the information comprises, for each of the plurality of network nodes, one or more of
a history of network sites recently visited by the each respective network node, or
a result of a security scan of the each respective network node, wherein
the result is configured to indicate a presence of malicious software.