Apparatus and method for characterizing the risk of a user contracting malicious software
View Patent ↗A non-transitory computer readable storage medium includes executable instructions to identify specified network interactions initiated by a client machine. The specified network interactions are compared to normative values to produce a promiscuity score indicative of the risk of the client machine contracting malicious software. Depending upon the promiscuity score, prophylactic actions are optionally applied to the client machine.
1. A server, comprising:
a processor; and
a memory storing a scoring module with instructions executed by a processor to:
identify specified network interactions, wherein the specified network interactions include a client machine initiating connections to network endpoints; and
evaluate a statistical deviation of the specified network interactions relative to a normative value for the client machine to produce a promiscuity score indicative of a risk of the client machine contracting malicious software, wherein the specified network interactions include:
a host communication count during a specified time period and the normative value is a mean host communication count;
evaluations of accessed servers with respect to normative values for low risk server countries and Uniform Resource Locator character distribution;
evaluations of domain name system queries against normative values for combinations or distributions of characters in a domain name system query and the number of IP addresses a domain name system query resolves to;
evaluations of executable file transfers against a white list of permissible executable files;
evaluations of excessive server message block connections; and
evaluations of the number of Hypertext Transfer Protocol (HTTP) posts and the data set size of HTTP posts.
2. The server of claim 1 further comprising executable instructions stored in the memory and executable by the processor to apply a prophylactic action to the client machine.
3. The server of claim 2 , wherein the prophylactic action is installing anti-virus software on the client machine.
4. The server of claim 2 , wherein the prophylactic action is isolating the client machine with a firewall.
5. The server of claim 2 , wherein the prophylactic action is automatically remediating an infection.
6. The server of claim 2 , wherein the prophylactic action is delivering an alert to an administrator.
7. The server of claim 1 , wherein the client machine is selected from the group consisting of a personal computer, a tablet, and smart phone, and a personal digital assistant.
8. The server of claim 1 , wherein the host communication count is a total number of unique endpoints the client machine communicates with.
9. The server of claim 1 , wherein the host communication count is a total number of connections made the client machine with a specific endpoint.
10. The server of claim 1 , wherein the host communication count is a combination of a total number of unique endpoints the client machine communicates with and a total number of connections made by the client machine with a specific endpoint.
11. The server of claim 1 , wherein the specified network interactions include evaluations of SSL and TLS sessions.