Granted Patent B2

US 10,868,816 · App. 16/070,866 · Granted Dec 15, 2020

Abstract

Claims (53)

1. A method comprising:

identifying a first set of community attributes to be used to generate a first community on a security information sharing platform that enables sharing of security information among a plurality of communities;

generating the first community based on the first set of community attributes;

authorizing a first user to access community-based security information of the first community, the first user associated with a first set of user attributes that satisfy the first set of community attributes, wherein the authorization comprises, in response to a request from the first user to access the community-based security information, determine whether the community-based security information is accessible by the first user based on determining whether the first user is associated with the first set of user attributes and a result of voting by users of the first community;

obtaining a first security indicator from the first user;

obtaining information related to the first security indicator from a second user of the first community; and

including the first security indicator and the information related to the first security indicator in the community-based security information.

2. The method of claim 1 , wherein the first security indicator comprises at least one of: an Internet Protocol (IP) address, a domain name, an e-mail address, a Uniform Resource Locator (URL), and a software file hash.

3. The method of claim 1 , wherein the information related to the first security indicator comprises at least one of: an investigation result that is provided by the second user for the first security indicator, an indicator score for the first security indicator, a source for the first security indicator, and a threat actor for the first security indicator.

4. The method of claim 1 , further comprising:

determining whether to authorize the first user to access the community-based security information based on user credentials of the first user.

5. The method of claim 1 , further comprising:

preventing a third user from accessing the community-based security information, wherein the third user is associated with a second set of user attributes that do not satisfy the first set of community attributes.

6. The method of claim 1 , further comprising:

identifying a second set of community attributes to be used to generate a second community on the security information sharing platform;

generating the second community based on the second set of community attributes;

authorizing the first user to access community-based security information of the second community, the first user associated with the first set of user attributes that satisfy the second set of community attributes;

obtaining a second security indicator from the first user of the second community;

obtaining information related to the second security indicator from a third user of the second community; and

including the second security indicator and the information related to the second security indicator in the community-based security information of the second community.

7. A non-transitory machine-readable storage medium comprising instructions executable by a processor of a computing device, the non-transitory machine-readable storage medium comprising:

instructions to identify a set of community attributes to be used to generate a first community on a security information sharing platform that enables sharing of security information among a plurality of communities;

instructions to receive, from a first user, a request to access community-based security information of the first community;

instructions to, in response to the request, determine whether the community-based security information is accessible by the first user based on determining whether the first user is associated with a first set of user attributes that satisfy the set of community attributes;

instructions to, in response to determining that the community-based security information is accessible by the first user, obtain a security indicator from the first user;

instructions to obtain information related to the security indicator from a second user of the first community;

instructions to include the security indicator and the information related to the security indicator in the community-based security information; and

instructions to authorize a third user to access the community-based security information based on a result of voting by the first and second users, wherein the third user is associated with a second set of user attributes that do not satisfy the set of community attributes.

8. The non-transitory machine-readable storage medium of claim 7 , wherein the first set of user attributes comprise a user attribute related to at least one of: an industry sector of the first user, a geographical region of the first user, an organization that the first user belongs to, user reputation of the first user, a citizenship status of the first user, an environmental condition, an indication of whether the first user represents a threat intelligence feed vendor, a security clearance level of the first user, and user status of the first user in the security information sharing platform.

9. The non-transitory machine-readable storage medium of claim 7 , further comprising:

instructions to assign the first set of user attributes to the first user by:

(i) allowing the first user to specify at least one user attribute of the first set of user attributes that describes the first user;

(ii) extracting at least one user attribute of the first set of user attributes from a user profile of the first user; or

(iii) allowing the third user to assign at least one user attribute of the first set of user attributes to the first user.

10. The non-transitory machine-readable storage medium of claim 7 , further comprising:

instructions to cause the first set of user attributes to be hidden from the first user.

11. The non-transitory machine-readable storage medium of claim 7 , wherein the information related to the security indicator comprises at least one of: an investigation result that is provided by the second user for the security indicator, an indicator score for the security indicator, a source for the security indicator, and a threat actor for the security indicator.

12. A system comprising:

a hardware processor to:

identify a first set of community attributes that describe users to be included in a first community on a security information sharing platform that enables sharing of security information among a plurality of communities;

identify a second set of community attributes that describe users to be included in a second community on the security information sharing platform;

authorize a first user to access community-based security information of the first community, the first user associated with a first set of user attributes that satisfy the first set of community attributes and that do not satisfy the second set of community attributes, wherein the authorization comprises, in response to a request from the first user to access the community-based security information, determine whether the community-based security information is accessible by the first user based on determining whether the first user is associated with the first set of user attributes and a result of voting by users of the first community;

prevent the first user from accessing community-based security information of the second community;

obtain a first security indicator from the first user;

obtain information related to the first security indicator from a second user of the first community; and

include the first security indicator and the information related to the first security indicator in the community-based security information of the first community.

13. The system of claim 12 , wherein the hardware processor is further to:

authorize a third user to access the community-based security information of the second community, the third user associated with a second set of user attributes that satisfy the second set of community attributes;

obtain a second security indicator from the third user of the second community;

obtain information related to the second security indicator from a fourth user of the second community; and

include the second security indicator and the information related to the second security indicator in the community-based security information of the second community.

14. The system of claim 12 , wherein an identification of the first user is hidden from the second user.

15. The system of claim 12 , wherein the first set of community attributes is in a form of a monotonic expression.

Assignments (7)