Granted Patent B2

US 11,489,857 · App. 13/888,341 · Granted Nov 1, 2022

Inventors: Ron Hegli (San Diego, CA); Hal Lonas (Carlsbad, CA); Christopher K. Harris (San Diego, CA)

Assignee: Webroot Inc.

H04L63/1425G06N20/00

Abstract

Claims (102)

1. A method for classifying an Internet resource, the method comprising:

receiving a plurality of reputation vectors for a plurality of Internet resources, each reputation vector comprising a plurality of reputation factors for an associated Internet resource, the plurality of reputation factors for the associated Internet resource including a virtual hosting factor for the associated Internet resource, an assessor site time known for the associated Internet resource and a classification age for the associated Internet resource, the virtual hosting factor for the associated Internet resource indicating whether other authorities than a first authority associated with the associated Internet resource share an IP address associated with the first authority, the assessor site time known for the associated Internet resource indicating how long the associated Internet resource has been known to an assessor site and the classification age indicating how long the associated Internet resource has held a reputation classification;

partitioning the plurality of reputation vectors into one or more training sets;

training a classifier using the one or more training sets;

performing a predictive security assessment of a first Internet resource, by a reputation generating site, based on known facts about the first Internet resource, the performing the predictive security assessment further comprising:

accessing, at the reputation generating site, one or more HyperText Markup Language (HTML) documents of the first Internet resource;

obtaining a plurality of reputation factors of the one or more HTML documents of the first Internet resource, the plurality of reputation factors of the one or more HTML documents including a virtual hosting factor for the first Internet resource, a classification age of the first Internet resource and an assessor site time known for the first Internet resource, the virtual hosting factor for the first Internet resource indicating whether other authorities than a second authority associated with the first Internet resource share an IP address associated with the second authority;

weighting each of the plurality of reputation factors of the one or more HTML documents based on empirical knowledge of each of the plurality of reputation factors;

analyzing, at the reputation generating site, a reputation vector of the first Internet resource, the reputation vector based on the plurality of reputation factors of the one or more HTML documents;

calculating, at the reputation generating site, using the classifier, a calculated reputation index score for the first Internet resource in real-time using, as input to the classifier, the reputation vector based on the plurality of reputation factors of the one or more HTML documents, including the virtual hosting factor for the first Internet resource, the classification age for the first Internet resource and the assessor site time known for the first Internet resource; and

storing, in a data store at the reputation generating site, the calculated reputation index score for the first Internet resource;

transmitting the calculated reputation index score to a local area network of a security appliance;

at the local area network, controlling access to the first Internet resource, the controlling access further comprising:

receiving, by the security appliance, a request for the first Internet resource from a client device over the local area network;

accessing, by the security appliance, the calculated reputation index score;

comparing the calculated reputation index score to a security policy of the local area network, wherein the security policy comprises a threshold reputation index score established for the local area network for denying access to the plurality of the Internet resources; and

when the calculated reputation index score for the first Internet resource is less than the threshold reputation index score, denying access to the first Internet resource.

2. The method according to claim 1 , wherein the plurality of reputation factors for the associated Internet resource comprises one or more of a security history factor, a legitimacy factor, a behavior factor, an association factor, and a location factor.

3. The method of claim 2 , wherein the location factor of the plurality of reputation factors for the associated Internet resource comprises at least one of: country of domain registration, country of service hosting and country of an internet protocol address block; and

wherein the legitimacy factor of the plurality of reputation factors for the associated Internet resource comprises at least one of: age of a domain registration, popularity rank, internet protocol address, number of hosts, top-level domain; and

wherein the behavior factor of the plurality of reputation factors for the associated Internet resource comprises at least one of: plurality of run-time behaviors, script block count, picture count, immediate redirect and response latency.

4. The method of claim 1 , wherein the first Internet resource comprises a Uniform Resource Identifier.

5. The method of claim 1 , further comprising:

transmitting the calculated reputation index score to the security appliance.

6. The method of claim 1 , wherein the plurality of reputation factors for the associated Internet resource comprises a number of hosts factor for the associated Internet resource and the plurality of reputation factors of the one or more HTML documents comprises a number of hosts factor for the first Internet resource.

7. The method of claim 1 , wherein the plurality of reputation factors for the associated Internet resource comprises a latency factor for the associated Internet resource and the plurality of reputation factors of the one or more HTML documents comprises a latency factor for the first Internet resource.

8. A method for classifying an Internet resource, the method comprising:

receiving a plurality of reputation vectors for a plurality of Internet resources, each reputation vector comprising a plurality of reputation factors for an associated Internet resource from the plurality of Internet resources, the plurality of reputation factors for the associated Internet resource including a virtual hosting factor for the associated Internet resource, the virtual hosting factor for the associated Internet resource indicating whether other authorities than a first authority associated with the associated Internet resource share an IP address associated with the first authority, the assessor site time known for the associated Internet resource and a classification age for the associated Internet resource, an assessor site time known for the associated Internet resource indicating how long the associated Internet resource has been known to an assessor site and the classification age indicating how long the associated Internet resource has held a reputation classification;

partitioning the plurality of reputation vectors into one or more training sets, the one or more training sets comprising one or more of high reputation Internet resources and low reputation Internet resources;

training a maximum entropy discrimination (MED) classifier with the one or more training sets;

performing a predictive security assessment of a first Internet resource, by a reputation generating site, based on known facts about the first Internet resource, the performing the predictive security assessment further comprising:

accessing, at the reputation generating site, one or more HyperText Markup Language (HTML) documents of the first Internet resource;

obtaining a plurality of reputation factors of the one or more HTML documents of the first Internet resource, the plurality of reputation factors of the one or more HTML documents including a virtual hosting factor for the first Internet resource, a classification age of the first Internet resource and an assessor site time known for the first Internet resource, the virtual hosting factor for the first Internet resource indicating whether other authorities than a second authority associated with the first Internet resource share an IP address associated with the second authority;

weighting each of the plurality of reputation factors of the one or more HTML documents based on empirical knowledge of each of the plurality of reputation factors;

analyzing, at the reputation generating site, a reputation vector of the first Internet resource, the reputation vector based on the plurality of reputation factors of the one or more HTML documents;

calculating, at the reputation generating site, using the MED classifier, a calculated reputation index score for the first Internet resource using, as input to the MED classifier, the reputation vector based on the plurality of reputation factors of the one or more HTML documents, including the virtual hosting factor for the first Internet resource, the classification age for the first Internet resource and the assessor site time known for the first Internet resource;

storing, in a data store at the reputation generating site, the calculated reputation index score for the first Internet resource; and

transmitting the calculated reputation index score to a local area network of a security appliance;

at the local area network, controlling access to the first Internet resource, the controlling access further comprising:

receiving, by the security appliance, a request for the first Internet resource from a client device over the local area network;

accessing, by the security appliance, the calculated reputation index score;

comparing the calculated reputation index score to a security policy of the local area network, wherein the security policy comprises a threshold reputation index score established for the local area network for denying access to the plurality of the Internet resources; and

when the calculated reputation index score for the first Internet resource is less than the threshold reputation index score, denying access to the first Internet resource.

9. The method according to claim 8 , wherein the plurality of reputation factors for the associated Internet resource comprises one or more of a security history factor, a legitimacy factor, a behavior factor, an association factor, and a location factor.

10. The method of claim 9 , wherein the location factor of the plurality of reputation factors for the associated Internet resource comprises at least one of: country of domain registration, country of service hosting and country of an internet protocol address block; and

wherein the legitimacy factor of the plurality of reputation factors for the associated Internet resource comprises at least one of: age of a domain registration, popularity rank, internet protocol address, number of hosts, top-level domain; and

wherein the behavior factor of the plurality of reputation factors for the associated Internet resource comprises at least one of: plurality of run-time behaviors, script block count, picture count, immediate redirect and response latency.

11. The method of claim 8 , wherein the MED classifier is created for the local area network.

12. The method of claim 8 , wherein the first Internet resource comprises a Uniform Resource Identifier.

13. The method according to claim 8 , wherein the MED classifier is trained to classify Internet resources based on a plurality of reputations, the plurality of reputations including a high reputation and a low reputation and wherein training the MED classifier further comprises:

identifying a first set of Internet resources that are marked as high reputation Internet resources, but received confidence scores by the MED classifier that were below a confidence score threshold;

identifying a second set of Internet resources that are marked as low reputation Internet resources, but received confidence scores by the MED classifier that were below the confidence score threshold; and

examining the first and second sets of Internet resources to reclassify the first and second sets of Internet resources into proper reputation classifications.

14. The method according to claim 13 , wherein training the MED classifier further comprises:

identifying a third set of Internet resources based on a confidence score received by each from the MED classifier and a prior probability of a reputation from the plurality of reputations; and

examining the third set of Internet resources.

15. The method according to claim 13 , wherein examining the first and second sets of Internet resources is performed using human intervention.

16. The method of claim 8 , wherein the plurality of reputation factors for the associated Internet resource comprises a number of hosts factor for the associated Internet resource and the plurality of reputation factors of the one or more HTML documents comprises a number of hosts factor for the first Internet resource.

17. The method of claim 8 , wherein the plurality of reputation factors for the associated Internet resource comprises a latency factor for the associated Internet resource and the plurality of reputation factors of the one or more HTML documents comprises a latency factor for the first Internet resource.

18. A system for classifying an Internet resource, the system comprising:

a reputation site including one or more servers; and

a maximum entropy discrimination (MED) classifier, the MED classifier comprising instructions that when executed by the one or more servers, cause the MED classifier to perform operations comprising:

receive a plurality of reputation vectors for a plurality of Internet resources, each reputation vector comprising a plurality of reputation factors for an associated Internet resource from the plurality of Internet resources, the plurality of reputation factors for the associated Internet resource including a virtual hosting factor for the associated Internet resource, a reputation site time known for the associated Internet resource and a classification age for the associated Internet resource, the virtual hosting factor for the associated Internet resource indicating whether other authorities than a first authority associated with the associated Internet resource share an IP address associated with the first authority, the reputation site time known for the associated Internet resource indicating how long the associated Internet resource has been known to the reputation site and the classification age indicating how long the associated Internet resource has held a classification assigned by the reputation site;

partition the plurality of reputation vectors into one or more training sets, the one or more training sets comprising one or more of high reputation Internet resources and low reputation Internet resources; and

train the maximum entropy discrimination (MED) classifier with the one or more training sets; and

wherein the one or more servers of the reputation site are configured to perform a predictive security assessment of a first Internet resource based on known facts about the first Internet resource, the predictive security assessment further comprising:

receive a reputation vector comprising a plurality of obtained factors for the first Internet resource, the plurality of obtained factors including a virtual hosting factor for the first Internet resource, a classification age of the first Internet resource and a reputation site time known for the first Internet resource, the virtual hosting factor for the first Internet resource indicating whether other authorities than a second authority associated with the first Internet resource share an IP address associated with the second authority;

calculate a calculated reputation index score for the internet resource based on the reputation vector using the MED classifier, and

store, in a data store at the reputation site, the calculated reputation index score for the first Internet resource; and

transmit the calculated reputation index score to a local area network of a security appliance;

at the local area network, control access to the first Internet resource, the controlling access further comprising:

receive, by the security appliance, a request for the first Internet resource from a client device over the local area network;

access, by the security appliance, the calculated reputation index score; and

determine denial of access to the Internet resource based on a comparison of the calculated reputation index score and a security policy of the local area network, wherein the security policy comprises a threshold reputation index score established for the local area network for denying access to the plurality of the Internet resources.

19. The system of claim 18 , wherein the plurality of reputation factors for the associated Internet resource comprises one or more of a security history factor, a legitimacy factor, a behavior factor, an association factor, and a location factor.

20. The system of claim 19 , wherein the location factor of the plurality of reputation factors for the associated Internet resource comprises at least one of: country of domain registration, country of service hosting and country of an internet protocol address block; and

wherein the legitimacy factor of the plurality of reputation factors for the associated Internet resource comprises at least one of: age of a domain registration, popularity rank, internet protocol address, number of hosts, top-level domain; and

wherein the behavior factor of the plurality of reputation factors for the associated Internet resource comprises at least one of: plurality of run-time behaviors, script block count, picture count, immediate redirect and response latency.

21. The system of claim 18 , further comprising:

weighting each of the plurality of reputation factors.

22. The system of claim 18 , wherein the MED classifier is created for the local area network.

23. The system of claim 18 , wherein the first Internet resource comprises a Uniform Resource Identifier.

24. The system of claim 18 , further comprising

transmitting the calculated reputation index score to the security appliance that is part of the local area network.

25. The system of claim 18 , wherein the plurality of reputation factors for the associated Internet resource comprises a number of hosts factor for the associated Internet resource and the plurality of obtained factors for the first Internet resource comprises a number of hosts factor for the first Internet resource.

26. The system of claim 18 , wherein the plurality of reputation factors for the associated Internet resource comprises a latency factor for the associated Internet resource and the plurality of obtained factors for the first Internet resource comprises a latency factor for the first Internet resource.

27. A method for classifying an Internet resource, the method comprising:

performing a predictive security assessment of an internet resource, by a reputation generating site, based on known facts about the Internet resource, the performing the predictive security assessment further comprising:

accessing, at the reputation generating site, one or more HyperText Markup Language (HTML) documents of the Internet resource;

obtaining a plurality of reputation factors of the one or more HTML documents of the Internet resource, the plurality of reputation factors of the one or more HTML documents including a virtual hosting factor for the Internet resource, a time known for the Internet resource and a classification age of the Internet resource, the virtual hosting factor for the Internet resource indicating whether other authorities than a first authority associated with the Internet resource share an IP address associated with the first authority, the time known for the Internet resource indicating how long the Internet resource has been known to the reputation generating site and the classification age indicating how long the Internet resource has held a reputation classification assigned by the reputation generating site;

weighting each of the plurality of reputation factors of the one or more HTML documents based on empirical knowledge of each of the plurality of reputation factors;

analyzing, at the reputation generating site, a reputation vector of the Internet resource, the reputation vector based on the plurality of reputation factors;

using a trained classifier to calculate, at the reputation generating site, a calculated reputation index score for the Internet resource using, as input to the trained classifier, the reputation vector based on the plurality of reputation factors, including the virtual hosting factor for the Internet resource, the time known for the Internet resource and the classification age of the Internet resource; and

storing, in a data store at the reputation generating site, the calculated reputation index score for the Internet resource;

transmitting the calculated reputation index score to a local area network of a security appliance;

at the local area network, controlling access to the internet resource, the controlling access further comprising:

receiving, by the security appliance, a request for the Internet resource from a client device over the local area network;

accessing, by the security appliance, the calculated reputation index score;

comparing the calculated reputation index score to a security policy of the local area network, wherein the security policy comprises a threshold reputation index score for denying access to Internet resources established for the local area network; and

based on results of the comparison, either permitting or denying access to the Internet resource.

28. The method of claim 27 , wherein the plurality of reputation factors of the one or more HTML documents comprises a number of hosts factor for the Internet resource.

29. The method of claim 27 , wherein the plurality of reputation factors of the one or more HTML documents comprises a latency factor for the Internet resource.

Assignments (9)

Continuity (4)