Collaborative security lists

Patent metadata

Field	Value
Publication number	US-2018013774-A1
Application number	US-201515544343-A
Country	US
Kind code	A1
Filing date	Jan 30, 2015
Priority date	Jan 30, 2015
Publication date	Jan 11, 2018
Grant date	—

Abstract

Examples relate to collaborative security lists. The examples disclosed herein enable obtaining a first candidate entry suggested by a first user of a community to be included in a collaborative security list. The collaborative security list may comprise a list of entries known to be secure or a list of entries known to be insecure. The examples disclosed herein further enable providing a candidate security list comprising at least the first candidate entry to the community and obtaining, from a second user of the community, a first score indicating how confident the second user is that the first candidate entry is secure. The examples disclosed herein further enable determining whether to include the first candidate entry in the collaborative security list based on the first score.

First claim

1 . A method for collaborative security lists, the method comprising:
obtaining a first candidate entry suggested by a first user of a community to be included in a collaborative security list, the collaborative security list comprising a list of entries known to be secure or a list of entries known to be insecure; providing a candidate security list comprising at least the first candidate entry to the community; obtaining, from a second user of the community, a first score indicating how confident the second user is that the first candidate entry is secure; and determining whether to include the first candidate entry in the collaborative security list based on the first score.

2 . The method of claim 1 , further comprising:
obtaining a second candidate entry suggested by a third user of the community to be included in the collaborative security list; and providing the candidate security list comprising at least the first and second candidate entries to the community; obtaining, from the second user, a second score indicating how confident the second user is that the second candidate entry is secure; and determining whether to include the second candidate entry in the collaborative security list based on the second score.

3 . The method of claim 1 , further comprising:
obtaining, from a third user of the community, a third score indicating how confident the third user is that the first candidate entry is secure; and determining whether to include the first candidate entry in the collaborative security list based on a combined score of the first and third scores.

4 . The method of claim 3 , further comprising:
determining whether to include the first candidate entry in the collaborative security list based on user reputation scores associated with the second user and the third user.

5 . The method of claim 4 , further comprising:
determining a user reputation score associated with the second user based on at least one of: the number of candidate entries previously suggested by the second user, the number of candidate entries previously suggested by the second user and included in at least one collaborative security list, and a user profile associated with the second user.

6 . The method of claim 1 , wherein the first score is a vote or a numerical value.

7 . A non-transitory machine-readable storage medium comprising instructions executable by a processor of a computing device for collaborative security lists, the machine-readable storage medium comprising:
instructions to obtain a first user-level security list from a first user of a community, the first user-level security list comprising a list of entries known to the first user to be secure or a list of entries known to the first user to be insecure; instructions to obtain a second user-level security list from a second user of the community, the second user-level security list comprising a list of entries known to the second user to be secure or a list of entries known to the second user to be insecure; instructions to provide a candidate security list to a third user of the community, the candidate security list comprising at least the first user-level security list and the second user-level security list; instructions to obtain, from the third user, a candidate entry score on at least one candidate entry of the candidate security list; and instructions to determine whether to include the at least one candidate entry in a collaborative security list based on the candidate entry score.

8 . The non-transitory machine-readable storage medium of claim 7 , wherein the candidate security list comprises a set of candidate entries from log data.

9 . The non-transitory machine-readable storage medium of claim 7 , further comprising:
instructions to determine whether to include the at least one candidate entry in the collaborative security list based on a user reputation score associated with the third user.

10 . The non-transitory machine-readable storage medium of claim 7 , further comprising:
instructions to determine whether to include the at least one candidate entry in the collaborative security list based on sightings of the at least one candidate entry in event data.

11 . The non-transitory machine-readable storage medium of claim 7 , wherein at least one user of the community has veto power to reject the inclusion of the at least one candidate entry in the collaborative security list, further comprising:
in response to determining that the at least one candidate entry should be included in the collaborative security list, instructions to include the at least one candidate entry in the collaborative security list unless the inclusion is rejected by the at least one user.

12 . A system for collaborative security lists comprising:
a processor that: obtains a set of candidate entries suggested by a first user of a community to be included in a collaborative security list, the collaborative security list comprising a list of entries known to be secure or a list of entries known to be insecure; generates a candidate security list comprising at least the set of candidate entries; identifies a portion of the candidate security list that is related to a user profile of a second user of the community; presents, to the second user, the candidate security list having the portion of the candidate security list being visually different from the rest of the candidate security list; obtains, from the second user, a candidate entry score on at least one candidate entry of the candidate security list; and determines whether to include the at least one candidate entry in the collaborative security list based on the candidate entry score.

13 . The system of claim 12 , the processor that:
determines whether to include the at least one candidate entry in the collaborative security list based on a user reputation score of the second user and sightings of the at least one candidate entry in event data.

14 . The system of claim 12 , the processor that:
obtains, from the second user, context information related to the at least one candidate entry; and determines whether to include the at least one candidate entry in the collaborative security list based on the candidate entry score and the context information.

15 . The system of claim 12 , the processor that:
monitors event data; detects an event in the event data that matches at least one entry of the collaborative security list; and in response to the detection, allows the execution of the event or generates a security alert.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Sander Tomas
• Rao Prasad V
• Hein Brian Frederik Hosea Che

Classifications

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/101 Primary

  Access control lists [ACL] · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title