Method and apparatus for determining a threat using distributed trust across a network

Patent metadata

Field	Value
Publication number	US-11882147-B2
Application number	US-202016913443-A
Country	US
Kind code	B2
Filing date	Jun 26, 2020
Priority date	Mar 15, 2017
Publication date	Jan 23, 2024
Grant date	Jan 23, 2024

Abstract

A system and method are disclosed wherein a risk score is generated by interrogating multiple sources of information across a network. The information is aggregated, such that every network action for individuals and organizations are turned into a unique behavioral model, which can be used as a unique identifier (“fingerprint”). This fingerprint is in turn used by a personalized Trust Guardian System to block, modify and/or allow network actions.

First claim

The invention claimed is:

1. A method comprising:
receiving a digital request from an unknown requestor device to perform a network action;
sending a query associated with the unknown requestor device to one or more computing devices among a trusted network of computing devices;
generating a dynamic risk graph model associated with the digital request based on a digital response to the query from the one or more computing devices;
updating the dynamic risk graph model utilizing a time-decay function by:
assigning the digital request to a risk category;
mapping the risk category to a risk category probability; and
applying the time-decay function to the risk category probability;

generating a trust score for the digital request to perform the network action by analyzing the updated dynamic risk graph model; and
based on the trust score, providing an indication to the one or more computing devices among the trusted network of computing devices to allow the unknown requestor device to perform the network action.

2. The method of claim 1 , wherein generating the trust score further comprises aggregating a set of trust scores corresponding to multiple digital responses to the query from multiple computing devices among the trusted network of computing devices.

3. The method of claim 1 , wherein generating the trust score further comprises comparing the network action associated with the digital request to a behavioral fingerprint.

4. The method of claim 3 , further comprising generating the behavioral fingerprint by utilizing a behavioral model to:
track network activity; and
generate activity probabilities associated with the tracked network activity.

5. The method of claim 1 , wherein sending the query associated with the unknown requestor device to the one or more computing devices among the trusted network of computing devices comprises validating the one or more computing devices utilizing a respective hash identifier and a corresponding public key.

6. The method of claim 1 , further comprising generating the query to send to the one or more computing devices among the trusted network of computing devices by generating one or more Open Trust Protocol questions related to the unknown requestor device.

7. The method of claim 1 , further comprising:
receiving an additional digital request from an additional unknown requestor device to perform an additional network action; and
sending an additional query associated with the additional unknown requestor device to at least one of the one or more computing devices among the trusted network of computing devices.

8. The method of claim 7 , further comprising:
generating an additional trust score for the additional digital request to perform the additional network action; and
based on the additional trust score, providing an indication to the at least one of the one or more computing devices to block the additional unknown requestor device from performing the network action.

9. A system comprising:
at least one processor; and
at least one non-transitory computer-readable storage medium storing instructions that, when executed by the at least one processor, cause the system to:
receive a digital request from an unknown requestor device to perform a network action;
send a query associated with the unknown requestor device to one or more computing devices among a trusted network of computing devices;
generate a dynamic risk graph model associated with the digital request based on a digital response to the query from the one or more computing devices;
update the dynamic risk graph model utilizing a time-decay function by:
assigning the digital request to a risk category;
mapping the risk category to a risk category probability; and
applying the time-decay function to the risk category probability;

generate a trust score for the digital request to perform the network action by analyzing the updated dynamic risk graph model; and
based on the trust score, provide an indication to the one or more computing devices among the trusted network of computing devices to allow the unknown requestor device to perform the network action.

10. The system of claim 9 , further comprising instructions that, when executed by the at least one processor, cause the system to generate the trust score by aggregating a set of trust scores corresponding to multiple digital responses to the query from multiple computing devices among the trusted network of computing devices.

11. The system of claim 9 , further comprising instructions that, when executed by the at least one processor, cause the system to generate the trust score by comparing the network action associated with the digital request to a behavioral fingerprint.

12. The system of claim 11 , further comprising instructions that, when executed by the at least one processor, cause the system to generate the behavioral fingerprint by utilizing a behavioral model to:
track network activity; and
generate activity probabilities associated with the tracked network activity.

13. The system of claim 9 , further comprising instructions that, when executed by the at least one processor, cause the system to send the query associated with the unknown requestor device to the one or more computing devices among the trusted network of computing devices by validating the one or more computing devices utilizing a respective hash identifier and a corresponding public key.

14. The system of claim 9 , further comprising instructions that, when executed by the at least one processor, cause the system to:
receive an additional digital request from an additional unknown requestor device to perform an additional network action; and
send an additional query associated with the additional unknown requestor device to at least one of the one or more computing devices among the trusted network of computing devices.

15. The system of claim 14 , further comprising instructions that, when executed by the at least one processor, cause the system to:
generate an additional trust score for the additional digital request to perform the additional network action; and
based on the additional trust score, provide an indication to the at least one of the one or more computing devices to block the additional unknown requestor device from performing the network action.

16. A non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause a computing device to:
receive a digital request from an unknown requestor device to perform a network action;
send a query associated with the unknown requestor device to one or more computing devices among a trusted network of computing devices;
generate a dynamic risk graph model associated with the digital request based on a digital response to the query from the one or more computing devices;
update the dynamic risk graph model utilizing a time-decay function by:
assigning the digital request to a risk category;
mapping the risk category to a risk category probability; and
applying the time-decay function to the risk category probability;

generate a trust score for the digital request to perform the network action by analyzing the updated dynamic risk graph model; and
based on the trust score, provide an indication to the one or more computing devices among the trusted network of computing devices to allow the unknown requestor device to perform the network action.

17. The non-transitory computer-readable medium of claim 16 , further comprising instructions that, when executed by the at least one proc

Assignees

• Lyft Inc

Inventors

• Adams Mark
• Meacham Daniel
• Meacham Simon

Classifications

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title