Method and system for protecting against unknown malicious activities by determining a reputation of a link

Patent metadata

Field	Value
Publication number	US-9317680-B2
Application number	US-90847710-A
Country	US
Kind code	B2
Filing date	Oct 20, 2010
Priority date	Oct 20, 2010
Publication date	Apr 19, 2016
Grant date	Apr 19, 2016

Abstract

A method and system for protecting against unknown malicious activities by determining a reputation of a link are disclosed. A reputation server queries a database including reputation information associated with a plurality of links to retrieve a reputation of a redirected link. The reputation information may indicate whether the links are associated with a malicious activity. The reputation of the redirected link may be associated with the original link to create a reputation of the original link.

First claim

What is claimed is:

1. A method for determining a reputation for a link, comprising:
receiving an original link and a redirected link at a reputation server from a client;
receiving a protection policy from the client, the protection policy including rules indicating whether the client should be prevented from navigating to the original link;
querying a database including reputation information associated with a plurality of links by a reputation server to retrieve a reputation of the redirected link, the reputation information indicating whether the links are associated with a malicious activity;
associating the reputation of the redirected link with the original link to create a reputation of the original link;
causing the reputation of the original link to be stored in the database, the reputation of the original link created from the reputation of the redirected link;
querying the database to retrieve the reputation of the original link upon a subsequent action by a client;
utilizing the reputation of the original link for the subsequent action;
calculating a policy intersection based on the reputation of the original link and the protection policy, the policy intersection indicating whether the original link is associated with the malicious activity; and
sending a notification to the client including the policy intersection for the original link indicating whether the original link is associated with the malicious activity.

2. The method of claim 1 , further comprising:
receiving a notification from the reputation server at a client including the reputation of the original link; and
calculating a policy intersection based on the reputation of the original link and a protection policy including rules indicating whether the client should be prevented from navigating to the original link; and
providing an indication to block access to the original link if the policy intersection indicates that the original link is associated with the malicious activity.

3. The method of claim 1 , further comprising updating the database with the reputation of the original link.

4. The method of claim 1 , further comprising:
querying the database to retrieve the reputation of the original link;
determining whether the reputation of the original link matches the reputation of the redirected link; and
updating the reputation of the original link to include the reputation of the redirected link if the reputations of the link and the redirected destination do not match.

5. The method of claim 1 , further comprising providing an indication to block access to the original link at the client if the reputation of the original link indicates that the original link is associated with the malicious activity.

6. The method of claim 1 , further comprising navigating to a final destination associated with the original link at the client if the notification indicates that the original link is not associated with the malicious activity.

7. The method of claim 1 , further comprising receiving the original link at the reputation server from a partner site hosted by a partner server based on a script operable to redirect the original link to point to the reputation server.

8. The method of claim 1 , wherein the redirected link is a final destination associated with the original link.

9. The method of claim 1 , wherein the redirected link is an intermediate destination associated with the original link.

10. The method of claim 1 , wherein the reputation information associated with the links comprises at least one of a rating, a reputation score and a content type.

11. A system for determining a reputation of a link, comprising:
a database including reputation information associated with a plurality of links, the reputation information indicating whether the links are associated with a malicious activity;
a processor;
a computer readable memory; and
processing instructions encoded in the computer readable memory, the processing instructions, when executed by the processor, operable to perform operations comprising:
querying the database to retrieve a reputation of a redirected link;
receiving an original link and the redirected link at the reputation server from a client;
receiving a protection policy from the client, the protection policy including rules indicating whether the client should be prevented from navigating to the original link;

associating the reputation of the redirected link with the original link to create a reputation of the original link;
storing the reputation of the original link to be stored in the database, the reputation of the original link created from the reputation of the redirected link;
querying the database to retrieve the reputation of the original link upon a subsequent action by a client;
utilizing the reputation of the original link for the subsequent action;
calculating a policy intersection based on the reputation of the original link and the protection policy, the policy intersection indicating whether the original link is associated with the malicious activity; and
sending a notification to the client including the policy intersection for the original link indicating whether the original link is associated with the malicious activity.

12. The system of claim 11 , wherein the processing instructions are further operable to perform operations comprising updating the database with the reputation of the original link.

13. The system of claim 11 , wherein the processing instructions are further operable to perform operations comprising:
querying the database to retrieve the reputation of the original link;
determining whether the reputation of the original link matches the reputation of the redirected link; and
updating the reputation of the original link to include the reputation of the redirected link if the reputations of the link and the redirected destination do not match.

14. The system of claim 11 , wherein the processing instructions are further operable to perform operations comprising receiving the original link at the reputation server from a partner site hosted by a partner server based on a script operable to redirect the original link to point to the reputation server.

15. The system of claim 11 , wherein the redirected link is a final destination associated with the original link.

16. The system of claim 11 , wherein the redirected link is an intermediate destination associated with the original link.

17. The system of claim 11 , wherein the reputation information associated with the links comprises at least one of a rating, a reputation score and a content type.

18. A non-transitory computer readable medium storing instructions for determining a reputation of a link, the instructions, when executed by a processor, configured to:
determine an original link and a redirected link associated with the original link encountered at a client;
retrieve a protection policy from a protection policy database associated with the client;
query a database including reputation information with the original link and the redirected link to determine whether the links are associated with a malicious activity;
associate the reputation of the redirected link with the original link to create a reputation of the original link;
cause the reputation of the original link to be stored in the database, the reputation of the original link created from the reputation of the redirected link;
query the database to retrieve the reputation of the original link upon a subsequent action by the client;
utilize the reputation of th

Assignees

• Carter Iii Russell Bertrand
• Lall Pravat Kumar
• Oitment Geoff
• Maha Davoud
• Hasan Javed
• Mcafee Inc

Inventors

• Carter Iii Russell Bertrand
• Lall Pravat Kumar
• Oitment Geoff
• Maha Davoud
• Hasan Javed

Classifications

• G06F2221/2119

  Authenticating web pages, e.g. with suspicious links · CPC title

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• G06F17/30864

  Physics · mapped topic

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• G06F21/51 Primary

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title