Threat assessment based on coordinated monitoring of local communication clients
Embodiments are directed to managing communication over a network. A co-located assessment agent may monitor communication traffic and determine assets and interactions with communication clients associated with one or more remote services. Asset groups associated with the assets may be determined based on characteristics of the assets. Representative assets from each asset group may be determined. Risk scores associated with each asset in a same asset group as the representative assets may be determined based on the remote services associated with the representative assets and the interactions with the communication clients such that a first risk score is initially generated based on a catalog local to a communication client and a succeeding risk score may be generated remotely based on an assessment model. The assets may be modified based on the first risk score or the succeeding risk score and provided to communication clients for display to a user.
1. A method of managing communication over a network, wherein execution of the method by one or more processors, performs actions comprising:
employing a co-located assessment agent to monitor communication traffic and determine a plurality of assets and one or more interactions with one or more of a plurality of communication clients, wherein each asset is associated with one or more remote services and the one or more communication clients;
determining one or more asset groups associated with one or more of the plurality of assets based on one or more characteristics of the plurality of assets;
determining one or more representative assets from each asset group;
determining one or more risk scores associated with each asset in a same asset group as the one or more representative assets based on the one or more remote services associated with the one or more representative assets and the one or more interactions with the one or more communication clients, wherein a first value for each of the one or more risk scores is initially generated based on a catalog local to a communication client, and wherein a succeeding value of the first value is generated remotely based on an assessment model;
modifying the one or more assets based on one or more of the first value or the succeeding value of each associated risk score, wherein the one or more modified assets are provided to one or more communication clients for display to a user;
monitoring one or more user interactions with the plurality of modified assets, wherein a report is provided to the user based on the one or more user interactions; and
providing a user risk score based on an assessment of the user interactions, wherein the user risk score is employed to perform one or more actions including initiating just-in-time training.
2. The method of claim 1 , further comprising, automatically updating the one or more modified assets based on one or more updated risk scores, wherein the one or more updated modified assets are provided to the one or more communication clients for display to the user.
3. The method of claim 1 , wherein determining the one or more risk scores, further comprises:
providing one or more catalog entries based on the one or more representative assets, wherein the one or more catalog entries are obtained from an asset catalog; and
determining the one or more risk scores based on the one or more catalog entries.
4. The method claim 1 , wherein the one or more assets include one or more of Hyper Text Markup Language (HTML) anchor tags, or user-interface controls.
5. The method of claim 1 , further comprising:
determining one or more encoded assets from the plurality of assets based on one or more characteristics of the one or more encoded assets;
determining one or more decoders based on the one or more encoded assets; and
employing the one or more decoders to decode the one or more encoded assets, wherein the one or more decoded assets are associated with the one or more asset groups.
6. The method of claim 1 , wherein determining the one or more risk scores further comprises:
generating one or more initial risk scores based on an initial analysis of the one or more assets, wherein the one or more initial risk scores are immediately provided to the assessment agent;
generating one or more other risk scores based on an advanced analysis and the one or more assets; and
providing the one or more other risk scores to the assessment agent, wherein the one or more modified assets are modified again based on the one or more other risk scores.
7. The method of claim 1 , wherein modifying each of the plurality of assets, further comprises:
providing style information that corresponds to the one or more risk scores, wherein the one or more communication clients display the one or more plurality of assets based on the style information;
disabling one or more interactive features of one or more of the plurality of assets based on the one or more risk scores; and
stripping a Uniform Resource Locator (URL) from the one or more of the plurality of assets based on the one or more risk scores.
8. A system for managing communication over a network, comprising:
a network computer, that includes:
a transceiver that communicates over the network;
a memory that stores at least instructions; and
one or more processors that execute instructions that perform actions, including:
employing a co-located assessment agent to monitor communication traffic and determine a plurality of assets and one or more interactions with one or more of a plurality of communication clients, wherein each asset is associated with one or more remote services and the one or more communication clients;
determining one or more asset groups associated with one or more of the plurality of assets based on one or more characteristics of the plurality of assets;
determining one or more representative assets from each asset group;
determining one or more risk scores associated with each asset in a same asset group as the one or more representative assets based on the one or more remote services associated with the one or more representative assets and the one or more interactions with the one or more communication clients, wherein a first value for each of the one or more risk scores is initially generated based on a catalog local to a communication client, and wherein a succeeding value of the first value is generated remotely based on an assessment model;
modifying the one or more assets based on one or more of the first value or the succeeding value of each associated risk score, wherein the one or more modified assets are provided to one or more communication clients for display to a user;
monitoring one or more user interactions with the plurality of modified assets, wherein a report is provided to the user based on the one or more user interactions; and
providing a user risk score based on an assessment of the user interactions, wherein the user risk score is employed to perform one or more actions including initiating just-in-time training; and
a client computer, comprising:
a transceiver that communicates over the network;
a memory that stores at least instructions; and
one or more processors that execute instructions that perform actions, including:
hosting at least one of the plurality of communication clients.
9. The system of claim 8 , wherein the one or more processors of the client computer execute instructions that perform actions further comprising:
automatically updating the one or more modified assets based on one or more updated risk scores, wherein the one or more updated modified assets are provided to the one or more communication clients for display to the user.
10. The system of claim 8 , wherein determining the one or more risk scores, further comprises:
providing one or more catalog entries based on the one or more representative assets, wherein the one or more catalog entries are obtained from an asset catalog; and
determining the one or more risk scores based on the one or more catalog entries.
11. The system of claim 8 , wherein the one or more assets include one or more of Hyper Text Markup Language (HTML) anchor tags, or user-interface controls.
12. The system of claim 8 , wherein the one or more processors of the client computer execute instructions that perform actions further comprising:
determining one or more encoded assets from the plurality of assets based on one or more characteristics of the one or more encoded assets;
determining one or more decoders based on the one or more encoded assets; and
employing the one or more decoders to decode the one or more encoded assets, wherein the one or more decoded assets are associated with the one or more asset groups.
13. The system of claim 8 , wherein determining the one or more risk scores further comprises:
generating one or more initial risk scores based on an initial analysis of the one or more assets, wherein the one or more initial risk scores are immediately provided to the assessment agent;
generating one or more other risk scores based on an advanced analysis and the one or more assets; and
providing the one or more other risk scores to the assessment agent, wherein the one or more modified assets are modified again based on the one or more other risk scores.
14. The system of claim 8 , wherein modifying each of the plurality of assets, further comprises:
providing style information that corresponds to the one or more risk scores, wherein the one or more communication clients display the one or more plurality of assets based on the style information;
disabling one or more interactive features of one or more of the plurality of assets based on the one or more risk scores; and
stripping a Uniform Resource Locator (URL) from the one or more of the plurality of assets based on the one or more risk scores.
15. A processor readable non-transitory storage media that includes instructions for managing communication over a network, wherein execution of the instructions by one or more processors, performs actions, comprising:
employing a co-located assessment agent to monitor communication traffic and determine a plurality of assets and one or more interactions with one or more of a plurality of communication clients, wherein each asset is associated with one or more remote services and the one or more communication clients;
determining one or more asset groups associated with one or more of the plurality of assets based on one or more characteristics of the plurality of assets;
determining one or more representative assets from each asset group;
determining one or more risk scores associated with each asset in a same asset group as the one or more representative assets based on the one or more remote services associated with the one or more representative assets and the one or more interactions with the one or more communication clients, wherein a first value for each of the one or more risk scores is initially generated based on a catalog local to a communication client, and wherein a succeeding value of the first value is generated remotely based on an assessment model;
modifying the one or more assets based on one or more of the first value or the succeeding value of each associated risk score, wherein the one or more modified assets are provided to one or more communication clients for display to a user;
monitoring one or more user interactions with the plurality of modified assets, wherein a report is provided to the user based on the one or more user interactions; and
providing a user risk score based on an assessment of the user interactions, wherein the user risk score is employed to perform one or more actions including initiating just-in-time training.
16. The media of claim 15 , further comprising:
automatically updating the one or more modified assets based on one or more updated risk scores, wherein the one or more updated modified assets are provided to the one or more communication clients for display to the user.
17. The media of claim 15 , wherein determining the one or more risk scores, further comprises:
providing one or more catalog entries based on the one or more representative assets, wherein the one or more catalog entries are obtained from an asset catalog; and
determining the one or more risk scores based on the one or more catalog entries.
18. The media of claim 15 , further comprising:
determining one or more encoded assets from the plurality of assets based on one or more characteristics of the one or more encoded assets;
determining one or more decoders based on the one or more encoded assets; and
employing the one or more decoders to decode the one or more encoded assets, wherein the one or more decoded assets are associated with the one or more asset groups.
19. The media of claim 15 , wherein determining the one or more risk scores further comprises:
generating one or more initial risk scores based on an initial analysis of the one or more assets, wherein the one or more initial risk scores are immediately provided to the assessment agent;
generating one or more other risk scores based on an advanced analysis and the one or more assets; and
providing the one or more other risk scores to the assessment agent, wherein the one or more modified assets are modified again based on the one or more other risk scores.
20. The media of claim 15 , wherein modifying each of the plurality of assets, further comprises:
providing style information that corresponds to the one or more risk scores, wherein the one or more communication clients display the one or more plurality of assets based on the style information;
disabling one or more interactive features of one or more of the plurality of assets based on the one or more risk scores; and
stripping a Uniform Resource Locator (URL) from the one or more of the plurality of assets based on the one or more risk scores.
21. A network computer for managing communication over a network, comprising:
a transceiver that communicates over the network;
a memory that stores at least instructions; and
one or more processors that execute instructions that perform actions, including:
employing a co-located assessment agent to monitor communication traffic and determine a plurality of assets and one or more interactions with one or more of a plurality of communication clients, wherein each asset is associated with one or more remote services and the one or more communication clients;
determining one or more asset groups associated with one or more of the plurality of assets based on one or more characteristics of the plurality of assets;
determining one or more representative assets from each asset group;
determining one or more risk scores associated with each asset in a same asset group as the one or more representative assets based on the one or more remote services associated with the one or more representative assets and the one or more interactions with the one or more communication clients, wherein a first value for each of the one or more risk scores is initially generated based on a catalog local to a communication client, and wherein a succeeding value of the first value is generated remotely based on an assessment model;
modifying the one or more assets based on one or more of the first value or the succeeding value of each associated risk score, wherein the one or more modified assets are provided to one or more communication clients for display to a user;
monitoring one or more user interactions with the plurality of modified assets, wherein a report is provided to the user based on the one or more user interactions; and
providing a user risk score based on an assessment of the user interactions, wherein the user risk score is employed to perform one or more actions including initiating just-in-time training.
22. The network computer of claim 21 , wherein the one or more processors execute instructions that perform actions further comprising, automatically updating the one or more modified assets based on one or more updated risk scores, wherein the one or more updated modified assets are provided to the one or more communication clients for display to the user.
23. The network computer of claim 21 , wherein determining the one or more risk scores,
further comprises:
providing one or more catalog entries based on the one or more representative assets, wherein the one or more catalog entries are obtained from an asset catalog; and
determining the one or more risk scores based on the one or more catalog entries.
24. The network computer of claim 21 , wherein the one or more assets include one or more of Hyper Text Markup Language (HTML) anchor tags, or user-interface controls.
25. The network computer of claim 21 , wherein the one or more processors execute instructions that perform actions further comprising:
determining one or more encoded assets from the plurality of assets based on one or more characteristics of the one or more encoded assets;
determining one or more decoders based on the one or more encoded assets; and
employing the one or more decoders to decode the one or more encoded assets, wherein the one or more decoded assets are associated with the one or more asset groups.
26. The network computer of claim 21 , wherein determining the one or more risk scores
further comprises:
generating one or more initial risk scores based on an initial analysis of the one or more assets, wherein the one or more initial risk scores are immediately provided to the assessment agent;
generating one or more other risk scores based on an advanced analysis and the one or more assets; and
providing the one or more other risk scores to the assessment agent, wherein the one or more modified assets are modified again based on the one or more other risk scores.
27. The network computer of claim 21 , wherein modifying each of the plurality of assets,
further comprises:
providing style information that corresponds to the one or more risk scores, wherein the one or more communication clients display the one or more plurality of assets based on the style information;
disabling one or more interactive features of one or more of the plurality of assets based on the one or more risk scores; and
stripping a Uniform Resource Locator (URL) from the one or more of the plurality of assets based on the one or more risk scores.