Reputation of network address
View Patent ↗Example embodiments disclosed herein relate to determining a reputation of a network address. A long-term reputation of the network address is determined. A short-term reputation of the network address is determined based on the long-term reputation and trend information associated with the long-term reputation.
1. A computing system comprising:
at least one hardware processor; and
at least one application executable on the at least one hardware processor to:
monitor, during a first time period, events associated with a network address to obtain event information;
determine a first reputation score of the network address based on the event information, wherein the first reputation score is associated with the first time period; and
determine a second reputation score of the network address based on the first reputation score, trend information associated with the first reputation score, and a portion of the event information corresponding to a second time period, wherein the second reputation score is associated with the second time period, and wherein the second time period is a portion of the first time period, wherein the trend information includes a slope associated with multiple historical points, wherein the multiple historical points are associated with the first reputation score.
2. The computing system of claim 1 , wherein the at least one application is further to perform a security action based on the second reputation score.
3. The computing system of claim 1 , wherein the at least one application is further to receive a request from a device associated with the network address, wherein the security action is taken based on request.
4. The computing system of claim 1 ,
wherein the first reputation score is initially set at a base value, wherein, when the network address is associated with a malicious action, the first reputation score is modified, and wherein the first reputation score is normalized based on time.
5. The computing system of claim 4 , wherein the multiple historical points are based on the normalized first reputation score.
6. The computing system of claim 4 , wherein the first reputation score is associated with a likelihood that the network address is malicious.
7. The computing system of claim 1 , wherein the event information comprises statistical values associated with the events.
8. A non-transitory machine-readable storage medium storing instructions that, if executed by at least one processor of a device, cause the device to:
monitor, during a first time period, one or more events associated with a network address to generate event information;
determine a first reputation score of the network address based on the event information, wherein the first reputation score is associated with the first time period; and
determine a second reputation score of the network address based on the first reputation score, trend information associated with the first reputation score, and a recent portion of the event information corresponding to a second time period, wherein the trend information includes a slope associated with multiple historical points, wherein the multiple historical points are associated with the first reputation score, wherein the second reputation score is associated with the second time period, and wherein the second time period is a portion of the first time period.
9. The non-transitory machine-readable storage medium of claim 8 , further comprising instructions that, if executed by the at least one processor, cause the device to:
receive a request from a computing device associated with the network address; and
perform a security action based on the second reputation score.
10. The non-transitory machine-readable storage medium of claim 8 , further comprising instructions that, if executed by the at least one processor, cause the device to:
initially set the first reputation score at a base value, when the network address is associated with a malicious action, modify the first reputation score negatively, and
normalize the first reputation score based on time.
11. The non-transitory machine-readable storage medium of claim 8 , wherein the first reputation score is associated with a likelihood that the network address is malicious.
12. The non-transitory machine-readable storage medium of claim 8 , wherein the event information comprises one or more statistical values associated with the one or more events.
13. The non-transitory machine-readable storage medium of claim 8 , wherein the second time period is less than one minute.
14. A method comprising:
monitoring, during a first time period, one or more events associated with a network address to generate event information;
determining a first reputation score of the network address based on the event information, wherein the first reputation score is associated with a first time period; and
determining, at a processor, a second reputation score of the network address based on the first reputation score, trend information associated with the first reputation score, and a recent portion of the event information corresponding to a second time period, wherein the second reputation score is associated with the second time period, wherein the second time period is a portion of the first time period, wherein the trend information includes a slope associated with multiple historical points, wherein the multiple historical points are associated with the first reputation score; and updating the first reputation score based on the second reputation score.
15. The method of claim 14 , further comprising:
initially set the first reputation score at a base value, when the network address is associated with a malicious action, modifying the first reputation score negatively,
when the network address is associated with a third time period without malicious activity, modifying the first reputation score positively.
16. The method of claim 15 , wherein modifying the first reputation score negatively is based on a priority of the malicious action.
17. The method of claim 14 , further comprising:
performing a security function based on the second reputation score.
18. The method of claim 14 , wherein the event information comprises one or more statistical values associated with the one or more events.