Threat intelligence on a data exchange layer
There is disclosed in one example, a computing apparatus, including: a hardware platform including a processor and a memory; a network interface; a data exchange layer (DXL) application programming interface (API), the DXL API including instructions to communicatively couple the apparatus to a DXL bus and provide a DXL abstraction layer on top of a TCP/IP-based communication network; and a reputation engine including instructions encoded within memory to instruct the processor to: receive a plurality of DXL messages from a first DXL endpoint; compute a composite reputation for the first DXL endpoint; receive from a second DXL endpoint a DXL message requesting a reputation for the first DXL endpoint; establish a private topic on the DXL bus between the computing apparatus and the second DXL endpoint; and publish the composite reputation to the private topic.
1. A computing apparatus, comprising:
a hardware platform comprising a processor and a memory;
a network interface;
a data exchange layer (DXL) application programming interface (API), the DXL API including instructions to communicatively couple the apparatus to a DXL bus and provide a DXL abstraction layer on top of a TCP/IP-based communication network; and
a reputation engine comprising instructions encoded within memory to instruct the processor to:
receive a plurality of DXL messages from a first DXL endpoint;
compute a composite reputation for the first DXL endpoint;
receive from a second DXL endpoint a DXL message requesting a reputation for the first DXL endpoint;
establish a private topic on the DXL bus between the computing apparatus and the second DXL endpoint; and
publish the composite reputation to the private topic.
2. The computing apparatus of claim 1 , wherein the reputation engine is further to instruct the processor to:
aggregate reputation data for a network object via a plurality of DXL messages;
compute a composite reputation for the network object;
receive from a DXL endpoint a DXL request message, via a private topic of the plurality of private topics, for a reputation for the network object; and
provide the composite reputation via a DXL message through the DXL broker and the one-to-many publish-subscribe fabric.
3. The computing apparatus of claim 2 , wherein the DXL message to provide the composite reputation has the same private topic as the DXL request message.
4. The computing apparatus of claim 2 , wherein the private topic belongs to a class of object reputation topics.
5. The computing apparatus of claim 2 , wherein aggregating the reputation data for the network object comprises:
querying a plurality of DXL endpoints;
identifying at least one of the queried DXL endpoints as being an authorized DXL reputation source; and
including, in the aggregating, reputation data from the at least one of the queried DXL endpoints identified as being an authorized DXL reputation source.
6. The computing apparatus of claim 5 , wherein aggregating the reputation data for the network object further comprises:
identifying at least one of the queried DXL endpoints as not being an authorized DXL reputation source; and
blocking object reputation data from the at least one queried DXL endpoint identified as not being an authorized DXL reputation source.
7. The computing apparatus of claim 2 , wherein aggregating the reputation data for the network object further comprises:
computing a weighted permission score for a scored DXL endpoint;
determining that the weighted permission score is sufficient to permit the scored DXL endpoint to act as a DXL reputation source; and
including, in the aggregation, reputation data from the scored DXL endpoint.
8. The computing apparatus of claim 2 , wherein aggregating the reputation data for the network object further comprises computing a reputation score for the network object based at least in part on a determination that a plurality of DXL endpoints have identified the network object as suspicious but not known malicious, and broadcasting a DXL message that the network object is to be blocked.
9. The computing apparatus of claim 2 , wherein aggregating the reputation data for the network object comprises computing a reputation score for the network object based at least in part on a determination that a plurality of DXL endpoints have identified the network object as suspicious but not known malicious, and broadcasting a DXL message that the network object is to be quarantined.
10. The computing apparatus of claim 2 , wherein aggregating the reputation data for the network object comprises computing a reputation score for the network object based at least in part on a determination that a plurality of DXL endpoints have identified the network object as suspicious but not known malicious, and broadcasting a DXL message that the network object is to be subjected to additional analysis.
11. The computing apparatus of claim 2 , wherein aggregating the reputation data for the network object comprises determining that at least one DXL endpoint has blocked the network object, and broadcasting a message that all DXL endpoints should block the network object.
12. The computing apparatus of claim 2 , wherein aggregating the reputation data for the network object comprises determining that the network object lacks a known reputation, and assigning a new reputation to the network object.
13. The computing apparatus of claim 12 , wherein assigning the new reputation comprises performing deep analysis on the object.
14. The computing apparatus of claim 12 , wherein assigning the new reputation comprises determining that the network object has been encountered multiple times within a time span, and assigning the network object a suspicious score.
15. The computing apparatus of claim 1 , further comprising a NoSQL-based reputation store.
16. One or more tangible, non-transitory computer-readable media having stored thereon executable instructions to instruct a processor to:
overlay a data exchange layer (DXL) abstraction layer on a TCIP/IP network stack, the DXL abstraction layer to communicatively couple to a DXL bus;
receive via the DXL bus a DXL message from a first DXL endpoint requesting a reputation for an object, wherein the message comprises a private DXL topic for point-to-point communication;
compute a composite reputation for the object comprising aggregating reputation data from a plurality of other DXL endpoints; and
publish the composite reputation via a DXL message.
17. The one or more tangible, non-transitory computer-readable media of claim 16 , wherein publishing the composite reputation comprises publishing the composite reputation with the private DXL topic.
18. The one or more tangible, non-transitory computer-readable media of claim 16 , wherein publishing the composite reputation comprises publishing the composite reputation via a public DXL topic.
19. A method of providing a composite reputation on a data exchange layer (DXL), comprising:
communicatively coupling to a DXL bus, comprising providing an abstraction layer overlaid on a traditional internet protocol (IP) network;
receiving from a first DXL endpoint a first DXL message requesting a reputation for a network object;
computing a composite reputation for the second DXL endpoint comprising aggregating reputation data received via DXL messages from a plurality of DXL endpoints that have previously encountered the network object; and
providing the composite reputation to the first DXL endpoint.
20. The method of claim 19 , further comprising providing the composite reputation to a plurality of other DXL endpoints via a DXL public topic.