Advanced threat protection cross-product security controller

Patent metadata

Field	Value
Publication number	US-11556641-B2
Application number	US-202016985920-A
Country	US
Kind code	B2
Filing date	Aug 5, 2020
Priority date	Oct 22, 2015
Publication date	Jan 17, 2023
Grant date	Jan 17, 2023

Abstract

A system for securing electronic devices includes a processor, non-transitory machine readable storage medium communicatively coupled to the processor, security applications, and a security controller. The security controller includes computer-executable instructions on the medium that are readable by the processor. The security application is configured to determine a suspicious file from a client using the security applications, identify whether the suspicious file has been encountered by other clients using the security applications, calculate a time range for which the suspicious file has been present on the clients, determine resources accessed by the suspicious file during the time range, and create a visualization of the suspicious file, a relationship between the suspicious file and the clients, the time range, and the resources accessed by the suspicious file during the time range.

First claim

What is claimed is:

1. At least one non-transitory machine-readable storage medium, comprising computer-executable instructions carried on the machine readable medium, the instructions readable by a hardware processor, the instructions, when read and executed, for causing the hardware processor to:
determine at least one uniform resource locator (URL) contacted by a file;
search for at least one other file that contacted the at least one URL;
determine that the file is suspicious based on both the file and the at least one other file having contacted the at least one URL;
receive an indication that a user wants to block the file from contacting the at least on URL; and
block the file from contacting the at least one URL.

2. The at least one non-transitory machine-readable storage medium of claim 1 , wherein the instructions, when read and executed, also cause the hardware processor to display information regarding a reputation of the at least one URL.

3. The at least one non-transitory machine-readable storage medium of claim 1 , wherein the instructions, when read and executed, also cause the hardware processor to display a source of the file.

4. The at least one non-transitory machine-readable storage medium of claim 1 , wherein the instructions, when read and executed, also cause the hardware processor to display a frequency at which the at least one URL was accessed over a plurality of time periods.

5. The at least one non-transitory machine-readable storage medium of claim 1 , wherein the instructions, when read and executed, also cause the hardware processor to display a hash of the file.

6. The at least one non-transitory machine-readable storage medium of claim 1 , wherein the instructions, when read and executed, also cause the hardware processor to display a result of blocking the URL.

7. A system comprising:
a memory;
a hardware processor coupled to the memory and configured to:
determine at least one uniform resource locator (URL) contacted by a file;
search for at least one other file that contacted the at least one URL;
determine that the file is suspicious based on both the file and the at least one other file having contacted the at least one URL;
receive an indication that a user wants to block the file from contacting the at least on URL; and
block the file from contacting the at least one URL.

8. The system of claim 7 , wherein the hardware processor is also configured to display information regarding a reputation of the at least one URL.

9. The system of claim 7 , wherein the hardware processor is also configured to display a source of the file.

10. The system of claim 7 , wherein the hardware processor is also configured to display a frequency at which the at least one URL was accessed over a plurality of time periods.

11. The system of claim 7 , wherein the hardware processor is also configured to display a hash of the file.

12. The system of claim 7 , wherein the hardware processor is also configured to display a result of blocking the URL.

13. A method comprising:
determining at least one uniform resource locator (URL) contacted by a file using a hardware processor;
search for at least one other file that contacted the at least one URL;
determine that the file is suspicious based on both the file and the at least one other file having contacted the at least one URL;
receiving an indication that a user wants to block the file from contacting the at least on URL; and
blocking the file from contacting the at least one URL.

14. The method of claim 13 , further comprising displaying information regarding a reputation of the at least one URL.

15. The method of claim 13 , further comprising displaying a source of the file.

16. The method of claim 13 , further comprising displaying a frequency at which the at least one URL was accessed over a plurality of time periods.

17. The method of claim 13 , further comprising displaying a hash of the file.

18. The method of claim 13 , further comprising displaying a result of blocking the URL.

Assignees

• Musarubra Us Llc

Inventors

• Pearcy Derek
• Heinrich Jessica
• Bishop Michael
• Fiorentino Cristian
• Gaskins Jessica
• Borkowsky Martina

Classifications

• G06F21/562 Primary

  Static detection · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title