Webroot Inc.

Hal Lonas

Christopher K Harris

David Dufour

Trung Tran

Huy Dang Ho

Ron Hegli

Patrick Kar Yin Chang

Thomas W Helvey

Chip Witt

A method and system for controlling access to an Internet resource is disclosed herein. When a request for an Internet resource, such as a Web site, is transmitted by an end-user of a LAN, a security appliance for the LAN analyzes a reputation index for the Internet resource before transmitting the request over the Internet. The reputation index is based on a reputation vector which includes a plurality of factors for the Internet resource such as country of domain registration, country of service hosting, country of an internet protocol address block, age of a domain registration, popularity rank, internet protocol address, number of hosts, to-level domain, a plurality of run-time behaviors, JavaScript block count, picture count, immediate redirect and response latency. If the reputation index for the Internet resource is at or above a threshold value established for the LAN, then access to the Internet resource is permitted. If the reputation index for the Internet resource is below a threshold value established for the LAN, then access to the Internet resource is denied.

System and method for developing a risk profile for an internet resource

Examples of the present disclosure describe systems and methods of providing real-time scanning of IP addresses. In aspects, input may be received by a real-time IP scanning system. The system may generate one or more work orders based on the input. A scanner associated with the system may access a work order and attempt to communicate with one or more devices identified by the work order. If the attempted communication with a device is successful, a protocol analyzer may be used to provide a predefined payload to the device. If the response from the device matches an expected string, the device may be determined to be a safe and/or legitimate device. If the response from the device does not match an expected string, the device may be determined to be a malicious device.

Real-time scanning of IP addresses

Examples of the present disclosure describe systems and methods of determining online identity reputation. In aspects, an online identity of an entity may engage in online interactions. The content provided by the online identity may be accessed and analyzed to determine interaction characteristics and reputation metrics for the online identity. Based on the reputation metrics, the online identity and/or entity (and content therefrom) may be filtered from further online interactions. In some aspects, interaction data may be stored in a data store. An interaction mapping component having access to the data store may analyze the data store data to determine mappings between online identities, entities and interactions. In at least one aspect, an opt-in certificate system may also be provided. The opt-in system may provide an online identity or entity a certificate to securely validate identity.

Online identity reputation

Embodiments disclosed herein relate to systems and methods for providing a smart cache. In embodiments, a variable time to live (TTL) may be calculated and associated with data as it is stored in a cache. The variable TTL may be calculated based upon reputation and/or category information related to the source of the data. The reputation and/or category information may include TTL modifiers for adjusting the TTL for data from a particular data source that is stored in the cache. In further embodiments, a feedback method may be employed to update reputation and/or category information for a particular data source.

Smart caching based on reputation information

A firewall monitors network activity and stores information about that network activity in a network activity log. The network activity is analyzed to identify a potential threat. The potential threat is further analyzed to identify other potential threats that are related to the potential threat, and are likely to pose a future risk to a protected network. A block list is updated to include the potential threat and the other potential threats to protect the protected network from the potential threat and the other potential threats.

Network threat prediction and blocking

Examples of the present disclosure describe systems and methods for generating dynamic sensors. In aspects, a device may be detected on a network. If the device is not recognized by the network, a generic container may be created. If the device is recognized by the network, a device-specific container may be created, and device-specific threat protection and/or a device-specific machine model may be loaded into the container. In either case, a threat intelligence model and/or an ecosystem-specific machine model may also be loaded into the container. The container may then be deployed to one or more networks. In aspects, the container may be used to analyze network traffic to sense potential threats for ecosystems comprising varying devices and topologies.

Dynamic sensors

A method and system a method for compressing and searching a plurality of strings. The method includes inputting a plurality of strings into a compression engine. The method also includes converting each of the plurality of strings into a new, prefix-preserving compressed string, using the compression engine. For every string P that is a strict prefix of a string S, P's resulting compressed string is a strict prefix of S's resulting compressed string.

Growing community of inventors

Carlsbad, CA, United States of America

Hal Lonas