Predictive modeling for anti-malware solutions
Provided is predictive modeling for anti-malware solutions. The predictive modeling includes an identification manager component that generates profile data for a hostile source. The hostile source is identified based on a previous threat attributed to the hostile source. The predictive modeling also includes an evaluation component that determines a characteristic of an interaction between a source and an endpoint. Further, the predictive modeling includes a validation component that compares the characteristic of the interaction with the profile data and controls access to the source by the endpoint based on the comparison. In addition, anti-malware software is not deployed on the endpoint.
1. A system, comprising:
a processor coupled to a memory that incudes instructions, that when executed by the processor, cause the processor to:
collect data with respect to at least one identified hostile source from network traffic, wherein the at least one hostile source is identified based on a previous threat attributed to the at least one hostile source;
generate a profile from the data;
generate a central threat model based on the profile; and
control access of an endpoint external to the system to a source comprising a source present on the endpoint based on a comparison of one or more current characteristics associated with the access to the central threat model, wherein access is denied when at least one of the one or more current characteristics matches the central threat model.
2. The system of claim 1 , wherein the access is allowed when the one or more current characteristics do not match the central threat model.
3. The system of claim 1 , wherein a match comprises a similar characteristic present in the one or more current characteristics and the central threat model.
4. The system of claim 1 , wherein the instructions further cause the processor to determine one or more characteristics of the at least one hostile source from the data.
5. The system of claim 1 , wherein the instructions further cause the processor to determine Internet forensic information from the data.
6. The system of claim 1 , wherein the source further comprises a network.
7. The system of claim 1 , wherein the instructions further cause the processor to evaluate one or more characteristics associated with the endpoint in comparison to the central threat model.
8. The system of claim 1 , wherein the source listens to communications of the endpoint.
9. The system of claim 1 , wherein the source further comprises a network address.
10. A method, comprising:
executing, on a processor, instructions that cause the processor to perform operations comprising:
collecting data with respect to at least one identified hostile source from network traffic, wherein the at least one hostile source is identified based on a previous threat attributed to the at least one hostile source;
generating a profile from the data;
generating a central threat model based on the profile; and
controlling access of an endpoint, external to the processor, to a source comprising a source present on the endpoint based on a comparison of one or more current characteristics associated with the access to the central threat model, wherein access is denied when at least one of the one or more current characteristics matches the central threat model.
11. The method of claim 10 , the operations further comprising permitting access when the one or more current characteristics do not match the central threat model.
12. The method of claim 10 , the operations further comprising matching similar characteristics of the one or more current characteristics and the central threat model.
13. The method of claim 10 , the operations further comprising inferring one or more characteristics of the at least one hostile source from the data.
14. The method of claim 10 , the operations further comprising mining the data for Internet forensic information.
15. The method of claim 10 , the operations further comprising selectively controlling access of the endpoint based on a comparison of one or more characteristics associated with the endpoint and one or more characteristics of the profile, wherein access is denied when at least one of the one or more current characteristics matches the one or more characteristics of the profile.
16. A computer-readable storage device storing executable instructions that, in response to execution, cause a system comprising a processor to perform operations, comprising:
collecting data with respect to a hostile source from network traffic, wherein a previous threat is attributed to the hostile source;
generating a profile from the data;
generating a central threat model based on the profile; and
controlling access of an endpoint external to the system to a source comprising a source present on the endpoint based on a comparison of one or more current characteristics associated with the access to the central threat model, wherein access is denied when at least one of the one or more current characteristics matches the central threat model.
17. The computer-readable storage device of claim 16 , the operations further comprising matching similar characteristics of the one or more current characteristics and the central threat model.
18. The computer-readable storage device of claim 16 , the operations further comprising inferring one or more characteristics of the hostile source from the data.
19. The computer-readable storage device of claim 16 , the operations further comprising mining the data for Internet forensic information.