Granted Patent B2

US 11,050,767 · App. 16/222,483 · Granted Jun 29, 2021

Inventors: Robert B. Black (Austin, TX); Harish Nair (Austin, TX); He Yin (Round Rock, TX)

Assignee: Forcepoint, LLC

H04L63/1416G06Q50/01H04L51/32H04L63/126H04L67/306

Abstract

Claims (127)

1. A computer-implemented method for identifying communications received from potentially untrustworthy entities comprising:

receiving, via a protected endpoint, an electronic communication for a receiving entity from a sending entity, the protected endpoint comprising an endpoint device and an endpoint agent, the endpoint agent executing on a hardware processor of the endpoint device;

accessing, via a security analytics system, social media information for the sending entity from a social media network;

analyzing, via the security analytics system, the social media information of the sending entity pursuant to determining whether the received electronic communication is from a potentially untrustworthy entity;

determining whether the receiving entity and the sending entity have common contacts in the social media network;

determining a number of common contacts in the social media network the receiving entity and the sending entity have;

using a threshold criterion for the number of common contacts to determine whether the sending entity may be trusted;

assigning a confidence level that the received electronic communication is a communication from a potentially untrustworthy entity when the receiving entity and the sending entity have common contacts in the social media network, wherein the confidence level includes a common contact confidence level, the common contact confidence level being based on a degree of relationship with respect to the receiving entity between any common contacts of the receiving entity and the sending entity in the social media network;

identifying, via the security analytics system, the electronic communication as a reconnaissance communication using the confidence level that the received electronic communication is from a potentially untrustworthy entity; and,

executing security mitigation operations on the received electronic communication when the electronic communication is identified as a reconnaissance communication.

2. The method of claim 1 , wherein analyzing the social media information of the sending entity comprises one or more of:

determining whether a social media profile exists on the social media network for the sending entity;

determining a number of contacts with which the sending entity is associated on the social media network;

determining whether the receiving entity and the sending entity are linked as contacts in the social media network;

determining a geographical region of the sending entity;

determining how long the social media profile has been active; and

determining a social media participation score for the sending entity.

3. The method of claim 1 , further comprising:

accessing social media data to determine a degree of relationship between the receiving entity and the sending entity; and

analyzing the degree of relationship between the receiving entity and sending entity pursuant to determining whether the received electronic communication is from a potentially untrustworthy entity.

4. The method of claim 1 , wherein analyzing social media information comprises:

assigning a weighted confidence level that the received electronic communication is a communication from a potentially untrustworthy entity, wherein the weighted confidence level includes one or more of:

a first confidence level determined from a number of contacts with which the sending entity is associated;

a second confidence level based on whether the receiving entity and the sending entity are linked as contacts in the social media network;

a third confidence level based on whether the receiving entity and the sending entity have common contacts in the social media network;

a fourth confidence level based on how long a social media profile of the sending entity has existed in the social media network;

a fifth confidence level based on a geographic region associated with the social media profile of the sending entity;

a sixth confidence level based on an organization with which the sending entity is associated;

a seventh confidence level based on a social media participation score of the sending entity; and

determining a composite confidence level using one or more of the first, second, third, fourth, fifth, sixth, or seventh confidence levels.

5. The method of claim 4 , wherein

the composite confidence level is determined using weighted values for one or more of the first, second, third, and fourth confidence levels.

6. The method of claim 1 , wherein the electronic communication comprises an email; and

the analysis of the social media information of the sending entity is used to determine whether the email is a phishing email.

7. The method of claim 1 , further comprising:

executing the security mitigation operations on the received electronic communication when the analysis of the social media information of the sending entity indicates that the received electronic communication is from a potentially untrustworthy entity, wherein the security mitigation operations comprise one or more of:

quarantining the received electronic communication;

sandboxing the received electronic communication;

communicating a notification to a security administrator that a suspicious communication has been received by the receiving entity; and

communicating a notification to the receiving entity that a suspicious communication has been received for the receiving entity.

8. The method of claim 1 , further comprising:

executing one or more further detection operations in addition to analyzing the social media information of the sending entity to determine whether the received electronic communication is received from a potentially untrustworthy entity, wherein the one or more further detection operations include one or more operations comprising:

determining whether the received electronic communication includes malware;

determining whether the received electronic communication originated from an untrusted domain or sender;

determining whether the received electronic communication includes a hyperlink to an unknown and/or untrusted domain or sender; and

determining whether the received electronic communication corresponds to a known reconnaissance communication campaign.

9. The method of claim 1 , further comprising:

if the received electronic communication is from a potentially untrustworthy entity, using the received electronic communication to assess a degree of risk associated with the receiving entity.

10. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for:

receiving, via a protected endpoint, an electronic communication for a receiving entity from a sending entity, the protected endpoint comprising an endpoint device and an endpoint agent, the endpoint agent executing on a hardware processor of the endpoint device;

accessing, via a security analytics system, social media information for the sending entity from a social media network;

analyzing, via the security analytics system, the social media information of the sending entity pursuant to determining whether the received electronic communication is from a potentially untrustworthy entity;

determining whether the receiving entity and the sending entity have common contacts in the social media network;

determining a number of common contacts in the social media network the receiving entity and the sending entity have;

using a threshold criterion for the number of common contacts to determine whether the sending entity may be trusted;

assigning a confidence level that the received electronic communication is a communication from a potentially untrustworthy entity when the receiving entity and the sending entity have common contacts in the social media network, wherein the confidence level includes a common contact confidence level, the common contact confidence level being based on a degree of relationship with respect to the receiving entity between any common contacts of the receiving entity and the sending entity in the social media network;

identifying, via the security analytics system, the electronic communication as a reconnaissance communication using the confidence level that the electronic communication is from a potentially untrustworthy entity; and,

executing security mitigation operations on the received electronic communication when the electronic communication is identified as a reconnaissance communication.

11. The system of claim 10 , wherein analyzing the social media information of the sending entity comprises one or more of:

determining whether a social media profile exists on the social media network for the sending entity;

determining a number of contacts with which the sending entity is associated on the social media network;

determining whether the receiving entity and the sending entity are linked as contacts in the social media network;

determining a geographical region of the sending entity;

determining a social media participation score for the sending entity; and

determining how long the social media profile has been active.

12. The system of claim 10 , further comprising:

accessing social media information to determine a degree of relationship between the receiving entity and the sending entity; and

analyzing the degree of relationship between the receiving entity and sending entity pursuant to determining whether the received electronic communication is from a potentially untrustworthy entity.

13. The system of claim 10 , wherein analyzing the social media information comprises:

assigning a weighted confidence level that the received electronic communication is a communication from a potentially untrustworthy entity, wherein the weighted confidence level includes one or more of:

a first confidence level determined from a number of contacts with which the sending entity is associated;

a second confidence level based on whether the receiving entity and the sending entity are linked as contacts in the social media network;

a third confidence level based on whether the receiving entity and the sending entity have common contacts in the social media network;

a fourth confidence level based on how long a social media profile of the sending entity has existed in the social media network;

a fifth confidence level based on a geographic region associated with the social media profile of the sending entity;

a sixth confidence level based on an organization with which the sending entity is associated;

a seventh confidence level based on a social media participation score of the sending entity; and

determining a composite confidence level using one or more of the first, second, third, fourth, fifth, sixth, or seventh confidence levels.

14. The system of claim 13 , wherein

the composite confidence level is determined using weighted values for one or more of the first, second, third, and fourth confidence levels.

15. The system of claim 10 , wherein the electronic communication comprises an email; and

the analysis of the social media information of the sending entity is used to determine whether the email is a phishing email.

16. The system of claim 10 , further comprising:

executing the security mitigation operations on the received electronic communication when the analysis of the social media information of the sending entity indicates that the received electronic communication is from a potentially untrustworthy entity, wherein the security mitigation operations comprise one or more of:

quarantining the received electronic communication;

sand boxing the received electronic communication;

communicating a notification to a security administrator that a suspicious communication has been received by the receiving entity; and

communicating a notification to the receiving entity that a suspicious communication has been received for the receiving entity.

17. The system of claim 10 , further comprising:

executing one or more further detection operations in addition to analyzing the social media information of the sending entity to determine whether the received electronic communication is received from a potentially untrustworthy entity, wherein the one or more further detection operations include one or more operations comprising:

determining whether the received electronic communication includes malware;

determining whether the received electronic communication originated from an untrusted domain or sender;

determining whether the received communication includes a hyperlink to an unknown and/or untrusted domain or sender; and

determining whether the received electronic communication corresponds to a known reconnaissance communication campaign.

18. The system of claim 10 , further comprising:

if the received electronic communication is from a potentially untrustworthy entity, using the received electronic communication to assess a degree of risk associated with the receiving entity.

19. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

receiving, via a protected endpoint an electronic communication for a receiving entity from a sending entity, the protected endpoint comprising an endpoint device and an endpoint agent, the endpoint agent executing on a hardware processor of the endpoint device;

accessing, via a security analytics system, social media information for the sending entity from a social media network;

analyzing, via the security analytics system, the social media information of the sending entity pursuant to determining whether the received electronic communication is from a potentially untrustworthy entity;

determining whether the receiving entity and the sending entity have common contacts in the social media network;

determining a number of common contacts in the social media network the receiving entity and the sending entity have;

using a threshold criterion for the number of common contacts to determine whether the sending entity may be trusted;

assigning a confidence level that the received electronic communication is a communication from a potentially untrustworthy entity when the receiving entity and the sending entity have common contacts in the social media network, wherein the confidence level includes a common contact confidence level, the common contact confidence level being based on a degree of relationship with respect to the receiving entity between any common contacts of the receiving entity and the sending entity in the social media network;

identifying, via the security analytics system, the electronic communication as a reconnaissance communication using the confidence level that the received electronic communication is from a potentially untrustworthy entity; and,

executing security mitigation operations on the received electronic communication when the electronic communication is identified as a reconnaissance communication.

20. The non-transitory, computer-readable storage medium of claim 19 , wherein analyzing the social media information of the sending entity comprises one or more of:

determining whether a social media profile exists on the social media network for the sending entity;

determining a number of contacts with which the sending entity is associated on the social media network;

determining whether the receiving entity and the sending entity are linked as contacts in the social media network;

determining a degree of relationship between any common contacts of the receiving entity and the sending entity;

determining a geographical region of the sending entity;

determining a social media participation score for the sending entity; and

determining how long the social media profile has been active.

21. The non-transitory, computer-readable storage medium of claim 19 , wherein

the electronic communication comprises an email; and

the analysis of the social media information of the sending entity is used to determine whether the email is a phishing email.

22. The non-transitory, computer-readable storage medium of claim 19 , further comprising:

executing security mitigation operations on the received electronic communication when the analysis of the social media information of the sending entity indicates that the received electronic communication is from a potentially untrustworthy entity,

wherein the security mitigation operations comprise one or more of:

quarantining the received electronic communication;

sand boxing the received electronic communication;

communicating a notification to a security administrator that a suspicious communication has been received by the receiving entity; and

communicating a notification to the receiving entity that a suspicious communication has been received for the receiving entity.

Assignments (8)