Enterprise reputations for uniform resource locators
View Patent ↗There is disclosed in an example a computing apparatus configured to operate as an enterprise threat intelligence server, and including: a network interface configured to communicatively couple to a network; and one or more logic elements providing a reputation engine, operable for: receiving a first uniform resource locator (URL) identifier; determining that a first URL identified by the first URL identifier has an unknown enterprise reputation; and establishing a baseline reputation for the URL. There is further disclosed a method of providing the reputation engine, and one or more computer-readable mediums having stored thereon executable instructions for providing the reputation engine.
1. A computing apparatus configured to operate as an enterprise threat intelligence server, comprising:
a network interface configured to communicatively couple to a network of an enterprise and to a global threat intelligence service (GTIS); and
one or more logic elements comprising a reputation engine, operable for:
receiving a first reputation request for a uniform resource locator (URL) identifier;
querying the GTIS for a global reputation for a first URL identified by the first URL identifier;
based at least in part on the global reputation, determining that the first URL has an unknown enterprise reputation, wherein the enterprise reputation is specific to the enterprise;
establishing an enterprise reputation for the first URL;
setting an expiry for the enterprise reputation, wherein the expiry is based at least partly on a frequency the URL is visited and wherein a time-to-live (TTL) of the expiry is directly proportional to the frequency; and
caching the enterprise reputation for the duration of the expiry.
2. The computing apparatus of claim 1 , wherein the reputation engine is further operable for:
receiving a response from the enterprise threat intelligence server that the first URL has an unknown global reputation; and
assigning the first URL a reputation as suspicious.
3. The computing apparatus of claim 1 , wherein the reputation engine is further operable for:
receiving a response from the enterprise threat intelligence server that the first URL has a known global reputation; and
generating an enterprise reputation for the first URL based at least in part on the known global reputation.
4. The computing apparatus of claim 1 , wherein the reputation engine is further operable for querying an enterprise gateway for information about the first URL, and for generating an enterprise reputation for the first URL based at least in part on the information about the first URL.
5. The computing apparatus of claim 1 , wherein the reputation engine is further operable for submitting the first URL for sandbox analysis, receiving sandbox analysis results, and generating an enterprise reputation for the first URL based at least in part on the sandbox analysis.
6. The computing apparatus of claim 1 , wherein the enterprise reputation comprises a second URL identifier, an age, a reputation, prevalence, and metadata.
7. The computing apparatus of claim 6 , wherein the second URL identifier includes the first URL itself or a hash of the first URL.
8. The computing apparatus of claim 1 , wherein the reputation engine is further operable for:
determining that the first URL has an existing enterprise reputation; and
acting on the existing enterprise reputation.
9. The computing apparatus of claim 1 , wherein the reputation engine is further operable for:
determining that a network object with a known reputation has an association with the first URL; and
assigning the first URL a reputation based at least in part on the known reputation of the network object.
10. The computing apparatus of claim 9 , wherein assigning the first URL a reputation based at least in part on the known reputation of the network object comprises:
determining that the known reputation of the network object is an untrusted reputation;
determining that the URL has low prevalence within the enterprise; and
assigning the URL an untrusted reputation.
11. The computing apparatus of claim 9 , wherein determining that a network object with a known reputation has an association with the first URL comprises determining that the network object was received from the first URL.
12. The computing apparatus of claim 9 , wherein determining that a network object with a known reputation has an association with the first URL comprises determining that the network object contacts the first URL.
13. One or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions for providing a reputation engine operable for:
communicatively coupling to a network of an enterprise and to a global threat intelligence service (GTIS) via a network interface;
receiving a first reputation request for a uniform resource locator (URL) identifier;
querying the GTIS for a global reputation for a first URL identified by the first URL identifier;
based at least in part on the global reputation, determining that the first URL has an unknown enterprise reputation, wherein the enterprise reputation is specific to the enterprise;
establishing an enterprise reputation for the first URL;
setting an expiry for the enterprise reputation, wherein the expiry is based at least partly on a frequency the URL is visited and wherein a time-to-live (TTL) of the expiry is directly proportional to the frequency; and
caching the enterprise reputation for the duration of the expiry.
14. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the reputation engine is further operable for:
receiving a response from the global threat intelligence server that the first URL has an unknown global reputation; and
assigning the first URL a reputation as suspicious.
15. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the reputation engine is further operable for:
receiving a response from the global threat intelligence server that the first URL has a known global reputation; and
generating an enterprise reputation for the first URL based at least in part on the known global reputation.
16. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the reputation engine is further operable for querying an enterprise gateway for information about the first URL, and for generating an enterprise reputation for the first URL based at least in part on the information about the first URL.
17. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the reputation engine is further operable for submitting the first URL for sandbox analysis, receiving sandbox analysis results, and generating an enterprise reputation for the first URL based at least in part on the sandbox analysis.
18. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the reputation engine is further operable for:
determining that the first URL has an existing enterprise reputation; and
acting on the existing enterprise reputation.
19. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the reputation engine is further operable for:
determining that a network object with a known reputation has an association with the first URL; and
assigning the first URL a reputation based at least in part on the known reputation of the network object.
20. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the reputation engine is further operable for assigning the first URL a reputation based at least in part on a known reputation of a network object, comprising:
determining that the known reputation of the network object is an untrusted reputation;
determining that the URL has low prevalence within the enterprise; and
assigning the URL an untrusted reputation.
21. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the reputation engine is further operable for determining that a network object with a known reputation has an association with the first URL, comprising determining that the network object was received from the first URL or contacts the first URL.
22. A computer-implemented method of providing a reputation engine operable for:
communicatively coupling to a network of an enterprise and to a global threat intelligence service (GTIS) via a network interface;
receiving a first reputation request for a uniform resource locator (URL) identifier via a network interface;
querying the GTIS for a global reputation for a first URL identified by the first URL identifier;
based at least in part on the global reputation, determining that the first URL has an unknown enterprise reputation, wherein the enterprise reputation is specific to the enterprise; and
establishing an enterprise baseline reputation for the URL;
setting an expiry for the enterprise reputation, wherein the expiry is based at least partly on a frequency the URL is visited and wherein a time-to-live (TTL) of the expiry is directly proportional to the frequency; and
caching the enterprise reputation for the duration of the expiry.
23. The computing apparatus of claim 1 , wherein the reputation engine is further operable for:
receiving a second request for the URL identifier;
determining that the cached entry for the URL identifier has expired; and
re-querying the GTIS for the global reputation of the first URL.
24. The one or more tangible, non-transitory computer-readable mediums of claim 13 , wherein the reputation engine is further operable for:
receiving a second request for the URL identifier;
determining that the cached entry for the URL identifier has expired; and
re-querying the GTIS for the global reputation of the first URL.
25. The computer-implemented method of claim 22 , further comprising:
receiving a second request for the URL identifier;
determining that the cached entry for the URL identifier has expired; and
re-querying the GTIS for the global reputation of the first URL.