Granted Patent B2

US 12,261,822 · App. 16/868,669 · Granted Mar 25, 2025

Inventors: Hal Lonas (Broomfield, CO); David Dufour (Broomfield, CO); Chip Witt (Broomfield, CO); Patrick Kar Yin Chang (San Jose, CA)

Assignee: OPEN TEXT INC.

H04L63/0227H04L63/14H04L63/1425H04L63/1441H04L41/069

Abstract

Claims (46)

1. A method of predicting network threats, the method comprising:

identifying a first online element as a threat vector from network activity log data based on reputation information of online elements using one or more computing devices, wherein the first online element comprises an internet protocol address;

analyzing relationship data for the threat vector, wherein the relationship data identifies associations between the threat vector and other online elements, wherein each of the other online elements are one of: a file, a uniform resource locator, and a software application;

identifying one or more of the other online elements as a predictive network threat based at least upon an association between the threat vector and the respective other online element, the identifying one or more of the other online elements comprising:

sending a request to a relationship management system, the request identifying the threat vector; and

receiving a response from the relationship management system identifying the respective other online elements; and

providing data regarding the threat vector and the one or more of the other online elements to a firewall device using the one or more computing devices, wherein the firewall blocks network activity associated with the threat vector and the one or more of the other online elements.

2. The method of claim 1 , wherein identifying the threat vector from network activity log data comprises:

receiving network activity log event data including at least one network event;

sending a request to a reputation management system; and

receiving a response from the reputation management system indicating whether the network event is a threat.

3. The method of claim 2 , wherein the response from the reputation management system contains the results of an investigation conducted by the reputation management system to evaluate whether the network event is a threat.

4. The method of claim 1 , wherein identifying one or more of the other online elements comprises identifying a first online element having a first type and a second online object having a second type, and wherein the relationship data identifies a first association between the first online object and the second online object.

5. The method of claim 4 , wherein identifying the second online object comprises:

sending a subsequent request to the relationship management system, the subsequent request identifying the first online object; and

receiving a response from the relationship management system identifying the second online object.

6. The method of claim 4 , wherein the second online object has no more than two degrees of separation from the threat vector.

7. The method of claim 1 , further comprising adding the threat vector and the one or more of the other online elements to a block list of the firewall, and operating the firewall to block network traffic associated with block list.

8. The method of claim 1 , further comprising:

at the firewall device, incorporating the data into a network block list.

9. The method of claim 8 , further comprising:

at the firewall device, operating to block network activity based on the network block list thereby blocking malicious network activity.

10. The method of claim 1 , wherein the firewall device collects data regarding network activity and records the data in the network activity log data.

11. A computing system comprising:

at least one processing device; and

at least one computer readable storage device storing data instructions that, when executed by the at least one processing device, cause the at least one processing device to:

identifying a first online element as a threat vector from network activity log data based on an associated with a malicious reputation, wherein the first online element comprises an internet protocol address;

analyzing relationship data for the threat vector, wherein the relationship data identifies associations between the threat vector and other online elements, wherein each of the other online elements are one of: a file, a uniform resource locator, and a software application;

identifying one or more of the other online elements as a predictive network threat based at least upon an association between the threat vector and the respective other online element, the identifying one or more of the other online elements comprising:

sending a request to a relationship management system, the request identifying the threat vector; and

receiving a response from the relationship management system identifying the respective other online elements; and

providing data regarding the threat vector and the one or more of the other online elements to a firewall device using the one or more computing devices, wherein the firewall blocks network activity associated with the threat vector and the one or more of the other online elements.

12. The computing system of claim 11 , wherein determining that the threat vector is associated with the malicious reputation comprises:

receiving the network activity including at least one network event;

sending a request to a reputation management system; and

receiving a response from the reputation management system indicating whether the network event is a threat.

13. The computing system of claim 12 , wherein the response from the reputation management system contains the results of an investigation conducted by the reputation management system to evaluate whether the network event is a threat.

14. The computing system of claim 11 , wherein the computer readable storage device storing data instructions that, when executed by the at least one processing device, cause the at least one processing device to:

wherein identifying one or more of the other online elements comprises identifying a first online element having a first type and a second online object having a second type, and wherein the relationship data identifies a first association between the first online object and the second online object.

15. The computing system of claim 14 , wherein identifying the second online object comprises:

sending a subsequent request to the relationship management system, the subsequent request identifying the second online object; and

receiving a response from the relationship management system identifying the second online object.

16. The computing system of claim 14 , wherein the second online object has no more than two degrees of separation from the threat vector.

17. The computing system of claim 11 , wherein the firewall device incorporates the data into a network block list.

18. The computing system of claim 17 , wherein the firewall device is operated to block network activity based on the network block list thereby blocking malicious network activity.

19. The computing system of claim 11 , wherein the firewall device collects data regarding network activity and records the data in the network activity log data.

Assignments (5)

Continuity (3)

References Cited (400)