High-level reputation scoring architecture

Patent metadata

Field	Value
Publication number	US-2016366176-A1
Application number	US-201615178827-A
Country	US
Kind code	A1
Filing date	Jun 10, 2016
Priority date	Jun 11, 2015
Publication date	Dec 15, 2016
Grant date	—

Abstract

A method for improving enterprise network security may include accessing a plurality of reputation scoring sources for a corresponding plurality of reputation scores, determining an aggregate reputation score based on the plurality of reputation scores, and, in response to a domain name service request, generating a response including information indicative of the aggregate reputation score.

First claim

1 . A system for providing enhanced enterprise network protection, the system comprising processing circuitry configured to:
access a plurality of reputation scoring sources for a corresponding plurality of reputation scores; determine an aggregate reputation score based on the plurality of reputation scores; and in response to a domain name service request, generate a response including information indicative of the aggregate reputation score.

2 . The system of claim 1 , wherein accessing the plurality of reputation scores comprises accessing commercial reputation scoring services.

3 . The system of claim 1 , wherein accessing the plurality of reputation scores comprises accessing at least one classified governmental source.

4 . The system of claim 1 , wherein accessing the plurality of reputation scores comprises accessing commercial reputation scoring services and at least one classified governmental source.

5 . The system of claim 1 , wherein the aggregate reputation score comprises a weighted average of the plurality of reputation scores.

6 . The system of claim 1 , wherein the processing circuitry is further configured to block access to a website from an organization's network based on the aggregate reputation score.

7 . The system of claim 1 , wherein the processing circuitry is further configured to issue a warning relative to access to a website based on the aggregate reputation score.

8 . The system of claim 1 , wherein generating the response including the information indicative of the aggregate reputation score comprises generating the response in response to the aggregate reputation score being above a threshold.

9 . The system of claim 1 , wherein the information indicative of the aggregate reputation score is provided in a TXT resource record.

10 . The system of claim 9 , wherein data fields in the TXT resource record further identify a source of the aggregate reputation score, a reason for generating the aggregate reputation score, and an expiration period of the aggregate reputation score.

11 . A method for providing enhanced enterprise network protection, the method comprising:
accessing a plurality of reputation scoring sources for a corresponding plurality of reputation scores; determining an aggregate reputation score based on the plurality of reputation scores; and in response to a domain name service request, generating a response including information indicative of the aggregate reputation score.

12 . The method of claim 11 , wherein accessing the plurality of reputation scores comprises accessing commercial reputation scoring services.

13 . The method of claim 11 , wherein accessing the plurality of reputation scores comprises accessing at least one classified governmental source.

14 . The method of claim 11 , wherein accessing the plurality of reputation scores comprises accessing commercial reputation scoring services and at least one classified governmental source.

15 . The method of claim 11 , wherein the aggregate reputation score comprises a weighted average of the plurality of reputation scores.

16 . The method of claim 11 , further comprising blocking access to a website from an organization's network based on the aggregate reputation score.

17 . The method of claim 11 , further comprising issuing a warning relative to access to a website based on the aggregate reputation score.

18 . The method of claim 11 , wherein generating the response including the information indicative of the aggregate reputation score comprises generating the response in response to the aggregate reputation score being above a threshold.

19 . The method of claim 11 , wherein the information indicative of the aggregate reputation score is provided in a TXT resource record.

20 . The method of claim 19 , wherein data fields in the TXT resource record further identify a source of the aggregate reputation score, a reason for generating the aggregate reputation score, and an expiration period of the aggregate reputation score.

Assignees

• Northrop Grumman Systems Corp

Inventors

• Bennison James E

Classifications

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title