Mcafee, Inc.

Musarubra US LLC

Kip Sign P1 LP

Christopher Smith

Don R Hanson, Ii

Sudeep Das

Edward T McDonald

Edward A Farrenkopf

David Maurits Bleckmann

Don R Hanson Ii

In an example, a threat intelligence controller is configured to operate on a data exchange layer (DXL). The threat intelligence controller acts as a DXL consumer of reputation data for a network object, which may be reported in various different types and from various different sources. Of the devices authorized to act as reputation data producers, each may have its own trust level. As the threat intelligence controller aggregates data from various providers, it may weight the reputation reports according to trust level. The threat intelligence engine thus builds a composite reputation for the object. When it receives a DXL message requesting a reputation for the object, it publishes the composite reputation on the DXL bus.

Threat intelligence on a data exchange layer

In an example, there is disclosed a system and method for providing a service-oriented architecture, including request/response, over a publish/subscribe framework. In one embodiment, a system is disclosed for adding layers upon a publish/subscribe messaging framework for sophisticated messaging such as point-to-point (request/response) and the ability to query for available services, in a reliable, scalable manner.

Service-oriented architecture

In an example, there is disclosed a data exchange layer (DXL) broker, including: a hardware platform including a processor and a memory; a DXL service store; a traditional internet protocol (IP) network stack; a DXL driver to operate a DXL layer on top of the traditional IP network stack; and instructions encoded within the memory to: enumerate a plurality of DXL endpoints connected to the DXL broker via the traditional IP network stack; store IP network routing information and DXL identification information for the DXL endpoints in the DXL service store; receive a DXL message for a DXL endpoint, the DXL message including DXL identification information for one of the plurality of DXL endpoints; and route the DXL message to the one of the plurality of DXL endpoints via the IP network routing information for the one of the plurality of DXL endpoints.

Efficient request-response routing over a data exchange layer

There is disclosed in one example a data exchange layer (DXL) broker, including: a network interface to communicatively couple to a data exchange layer (DXL), the DXL including an enterprise service bus (ESB) configured to provide one-to-one device communications over a publish-subscribe fabric; hardware including at least a processor; and instructions encoded on one or more computer-readable mediums to instruct the processor to provide DXL broker software configured to: receive a DXL request message via the DXL, the request message directed to a DXL service; determine that the DXL service is available; and forward the request message to a DXL endpoint via the DXL.

There is disclosed in one example, a computing apparatus, including: a hardware platform including a processor and a memory; a network interface; a data exchange layer (DXL) application programming interface (API), the DXL API including instructions to communicatively couple the apparatus to a DXL bus and provide a DXL abstraction layer on top of a TCP/IP-based communication network; and a reputation engine including instructions encoded within memory to instruct the processor to: receive a plurality of DXL messages from a first DXL endpoint; compute a composite reputation for the first DXL endpoint; receive from a second DXL endpoint a DXL message requesting a reputation for the first DXL endpoint; establish a private topic on the DXL bus between the computing apparatus and the second DXL endpoint; and publish the composite reputation to the private topic.

In an example, there is disclosed an efficient request/response routing over a publish/subscribe messaging framework. Upon receiving a request for a service, a DXL broker may identify zero or more DXL domain masters providing the service. If no DXL domain masters are available to provide the service, the DXL broker may send a response message, or publish a DXL message, indicating that the service is not available. If more than one DXL domain master provides the service, then the DXL broker may identify the best DXL domain master to service the request, and forward the request to that DXL domain master.

In an example, there is disclosed a monolithic reputation update on a data exchange layer (DXL). According to one embodiment, designating a set of objects as good or bad can be achieved via a single administrative action by leveraging persistent client initiated connections to the DXL framework. This may enable communication of the reputation updates across a heterogeneous infrastructure, including systems potentially unreachable by the server, such as those behind a firewall or NAT.

One-click reputation adjustment

An enterprise trust server (ETS) can include a user interface configured to initiate generation of a first file signature associated with a first file accessed from a file system associated with a computer system at a first time and generation of a second file signature associated with a second file accessed from the file system at a second time subsequent to the first time. The ETS also includes a file signature comparator configured to compare the first and second file signatures to determine a difference set of file signatures. The ETS can be configured to send a request comprising the difference set of file signatures to a trust repository and to receive a response that identifies a software product associated with the first and second files that changed between the first and second times based on the difference set of file signatures.

Growing community of inventors

Sherwood, OR, United States of America

Christopher Smith