Control of unwanted network traffic

1. An apparatus comprising:

at least one processor; and

at least one memory including computer program code,

the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following:

detect unwanted traffic flowing through a host which subscribes to a network node;

encrypt a detection result for the unwanted traffic with a homomorphic encryption key that is unknown to the network node,

wherein the homomorphic encryption key is associated with global trust evaluation of a source host;

generate a detection report which contains a first identifier of the host, a second identifier of the source host which transmits the unwanted traffic to the host, a content identifier identifying content of the unwanted traffic, and the encrypted detection result; and

sign the detection report by means of a Public Key Infrastructure (PKI) public/private key pair of the host.

2. The apparatus according to claim 1 wherein the at least one memory and the computer program code configured to, with the at least one processor, further cause the apparatus to:

monitor inbound traffic of the host;

in response to a traffic monitoring result satisfying a first condition, check similarity of two or more contents of the inbound traffic by performing a calculation on the two or more contents, wherein the calculation indicates a difference between the two or more contents;

monitor behaviors of the host in processing the inbound traffic; and

obtain a detection result based on the traffic monitoring result, the similarity of the two or more contents, and the behavior monitoring result.

3. The apparatus according to claim 1 wherein the first identifier is a real identifier identifying the host or an anonymous identifier of the host, and

wherein the second identifier is a real identifier identifying the source host or an anonymous identifier of the source host, and

wherein the content identifier is a hash code of the content.

4. The apparatus according to claim 3 wherein the anonymous identifier is a hash code of the real identifier.

5. The apparatus according to claim 1 wherein the detection result is encrypted in response to the detection result satisfying a second condition.

6. An apparatus comprising:

at least one processor; and

at least one memory including computer program code,

the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following:

receive, from a host which subscribes to the apparatus, detection reports with a digital signature, the detection reports containing

a first identifier of the host,

a second identifier of a source host which transmits unwanted traffic to the host,

a content identifier identifying content of the unwanted traffic, and

an encrypted detection result for the unwanted traffic, the encrypted detection result being based on a homomorphic encryption key that is unknown to the apparatus,

wherein the homomorphic encryption key is associated with global trust evaluation of the source host;

verify the digital signature of the respective detection reports;

aggregate the encrypted detection results of the detection reports related to a same source host; and

determine a suspicious source host to be monitored based on an aggregation result of aggregating the encrypted detection results.

7. The apparatus according to claim 6 wherein the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to further perform at least the following:

monitor traffic flowing through the suspicious source host which subscribes to the apparatus;

generate a monitoring report in response to a monitoring result of monitoring the traffic satisfying a third condition, the monitoring report containing a third identifier of the apparatus, the monitoring result for the suspicious source host, a fourth identifier of the suspicious source host, and the encrypted detection results regarding the suspicious source host; and

sign the monitoring report by means of a Public Key Infrastructure (PKI) public/private key pair of the apparatus;

wherein the third identifier is an anonymous identifier of the apparatus;

wherein the fourth identifier is an anonymous identifier of the suspicious source host.

8. The apparatus according to claim 6 wherein the first identifier is a real identifier identifying the host or an anonymous identifier of the host, and

wherein the second identifier is a real identifier identifying the source host or an anonymous identifier of the source host, and

wherein the content identifier is a hash code of the content.

9. The apparatus according to claim 8 wherein the anonymous identifier is a hash code of the real identifier.

10. The apparatus according to claim 6 wherein the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to determine a suspicious source host to be monitored based on the aggregation result by:

send, to an entity which is different from the apparatus, the aggregation result and an anonymous identifier of the source host;

receive, from the entity, a determination result which indicates whether the source host is a suspicious source host and the anonymous identifier of the source host; and

check whether the suspicious source host subscribes to the apparatus.

11. The apparatus according to claim 7 wherein the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to monitor traffic flowing through the suspicious source host which subscribes to the apparatus by:

monitor outbound traffic of the suspicious source host;

check similarity of two or more contents of the outbound traffic by performing a calculation on the two or more contents, wherein the calculation indicates a difference between the two or more contents; and

obtain the monitoring result based on a traffic monitoring result and the similarity of the two or more contents.

12. An apparatus comprising:

at least one processor; and

at least one memory including computer program code,

the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following:

receive, from a network node, a report;

in response to the report containing an aggregation result of encrypted detection results related to a same source host and an anonymous identifier of the source host, the encrypted detection results being based on a homomorphic encryption key that is unknown to the network node, decrypt the aggregation result with a homomorphic decryption key which is paired with the homomorphic encryption key;

determine whether the source host is a suspicious source host to be monitored based on the decrypted aggregation result;

transmit a determination result and the anonymous identifier of the source host to the network node;

in response to the report being a monitoring report with a digital signature, the monitoring report containing a third identifier of the network node, a monitoring result for a suspicious source host, a fourth identifier of the suspicious source host, and encrypted detection results regarding the suspicious source host, verify the digital signature;

decrypt the encrypted detection results with the homomorphic decryption key;

evaluate a global trust for the suspicious source host based on the detection results and the monitoring result;

in response to the global trust satisfying a fourth condition, determine the suspicious source host is a true unwanted traffic source; and

transmit the global trust and identifier of the true unwanted traffic source to the network node;

wherein the third identifier is an anonymous identifier of the network node;

wherein the fourth identifier is an anonymous identifier of the suspicious source host.

13. The apparatus according to claim 12 wherein the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to further perform at least the following:

evaluate detection trust for the network node based on the global trust of the true unwanted traffic source;

evaluate detection trusts for respective hosts which provide the encrypted detection results based on the global trust of the true unwanted traffic source; and

transmit the detection trusts to the network node.

14. The apparatus according to claim 12 wherein the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to determine whether the source host is a suspicious source host to be monitored based on a decrypted result by:

in response to the decrypted result satisfying a fifth condition, determine the source host is the suspicious source host; and

in response to the decrypted result not satisfying the fifth condition, determine the source host is not the suspicious source host.

15. The apparatus according to claim 12 wherein the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to evaluate a global trust of the suspicious source host by:

aggregate the detection results;

aggregate the monitoring results from different network nodes regarding the same suspicious source host; and

calculate the global trust based on the aggregation result of the detection results and the aggregation result of the monitoring results.

16. The apparatus according to claim 13 wherein the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to evaluate detection trust for the network node by:

check whether the monitoring result of the network node matches the global trust of the true unwanted traffic source;

in response to the monitoring result of the network node matching the global trust of the true unwanted traffic source, increase the detection trust of the network node; and

in response to the monitoring result of the network node not matching the global trust of the true unwanted traffic source, decrease the detection trust of the network node.

17. The apparatus according to claim 13 wherein the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to evaluate detection trusts for respective hosts which provide the encrypted detection results by:

check whether the detection result of the source host matches the global trust of the true unwanted traffic source;

in response to the detection result of the source host matching the global trust of the true unwanted traffic source, increase the detection trust of the network node; and

in response to the detection result of the source host not matching the global trust of the true unwanted traffic source, decrease the detection trust of the network node.