System and method of assigning reputation scores to hosts

Patent metadata

Field	Value
Publication number	US-12192078-B2
Application number	US-202418593403-A
Country	US
Kind code	B2
Filing date	Mar 1, 2024
Priority date	Jun 5, 2015
Publication date	Jan 7, 2025
Grant date	Jan 7, 2025

Abstract

A method provides for receiving network traffic from a host having a host IP address and operating in a data center, and analyzing a malware tracker for IP addresses of hosts having been infected by a malware to yield an analysis. When the analysis indicates that the host IP address has been used to communicate with an external host infected by the malware to yield an indication, the method includes assigning a reputation score, based on the indication, to the host. The method can further include applying a conditional policy associated with using the host based on the reputation score. The reputation score can include a reduced reputation score from a previous reputation score for the host.

First claim

What is claimed is:

1. A method comprising:
receiving network traffic from a first host in a network;
extracting connection data from the network traffic representing a first network flow from the first host to a second host, the first host connecting with an additional host through the second host, the additional host being compromised, the connection data including an IP address associated with the first host, wherein the first host is in a data center at one of virtual layer, hypervisor layer and physical layer;
assessing the connection data using a machine learning process to determine a reputation score for the first host;
utilizing the reputation score to assign the first host to a group having a group policy; and
restricting traffic from the second host to the first host according to the group policy.

2. The method of claim 1 , wherein the second host comprises a firewall.

3. The method of claim 2 , wherein the first host comprises a device located outside the firewall.

4. The method of claim 1 , wherein the machine learning process utilizes data from one or more malware trackers.

5. The method of claim 1 , wherein the machine learning process utilizes data obtained from a whois database.

6. A system comprising:
one or more processors; and
a computer-readable storage medium storing instructions which, when executed by the one or more processors, cause the one or more processors to:
receive network traffic from a first host in a network;
extract connection data from the network traffic representing a first network flow from the first host to a second host, the first host connecting with an additional host through the second host, the additional host being compromised, the connection data including an IP address associated with the first host, wherein the first host is in a data center at one of virtual layer, hypervisor layer and physical layer;
assess the connection data using a machine learning process to determine a reputation score for the first host;
utilize the reputation score to assign the first host to a group having a group policy; and
restrict traffic from the second host to the first host according to the group policy.

7. The system of claim 6 , wherein the second host is a firewall.

8. The system of claim 7 , wherein the first host is a device located outside of the firewall.

9. The system of claim 7 , wherein the machine learning process utilizes data from one or more malware trackers.

10. The system of claim 7 , wherein the machine learning process utilizes data obtained from a whois database.

11. A non-transitory computer-readable medium having stored thereon instructions which, when executed by one or more processors, cause the one or more processors to:
receive network traffic from a first host in a network;
extract connection data from the network traffic representing a first network flow from the first host to a second host, the first host connecting with an additional host through the second host, the additional host being compromised, the connection data including an IP address associated with the first host, wherein the first host is in a data center at one of virtual layer, hypervisor layer and physical layer;
assess the connection data using a machine learning process to determine a reputation score for the first host;
utilize the reputation score to assign the first host to a group having a group policy; and
restrict traffic from the second host to the first host according to the group policy.

12. The non-transitory computer-readable medium of claim 11 , wherein the second host is a firewall.

13. The non-transitory computer-readable medium of claim 12 , wherein the first host is a device located outside of the firewall.

14. The non-transitory computer-readable medium of claim 11 , wherein the machine learning process utilizes data from one or more malware trackers.

15. The non-transitory computer-readable medium of claim 11 , wherein the machine learning process utilizes data obtained from a whois database.

Assignees

• Cisco Tech Inc

Inventors

• Gupta Sunil Kumar
• Yadav Navindra
• Watts Michael Standish
• Parandehgheibi Ali
• Gandham Shashidhar
• Kulshreshtha Ashutosh
• Deen Khawar

Classifications

• G06T11/26

  Drawing of charts or graphs · CPC title

• H04L43/08

  Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters · CPC title

• H04L41/12

  Discovery or management of network topologies · CPC title

• H04L41/0893

  Assignment of logical groups to network elements · CPC title

• H04L67/01

  Protocols · CPC title