Hygiene Score-Based Web Security Reputation System
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security software is ineffective in detecting targeted malware threats due to their low instance frequency and variability, making signature scanning and heuristic techniques impractical, especially as modern malware evolves to generate new malicious code for each visitor.
Innovation Solution
A method and system utilizing hygiene and reputation scores to assess the trustworthiness of clients and web sites, where client hygiene scores and secondary hygiene scores of web sites are used to calculate reputation scores for files, indicating their maliciousness, thereby guiding user behavior and security actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature scanning and heuristic techniques are used to detect malware, then mass-distributed malware can be detected and disabled, but targeted malware threats cannot be effectively detected due to their low instance frequency and variability
Solution Approach 1:
The patent transitions from analyzing malware in isolation (single dimension) to analyzing malware in the context of client hygiene scores and website reputation (multiple dimensions). By incorporating client behavior data and website trust metrics, the system creates a multi-dimensional assessment framework that effectively detects targeted threats that conventional single-dimension signature scanning cannot identify
Solution Approach 2:
The patent introduces hygiene scores and reputation scores as intermediary metrics between the malware itself and the detection system. These intermediary scores aggregate information from multiple sources (client behavior, website characteristics, malware prevalence) to provide a composite trust assessment that enables detection of targeted threats without requiring direct signature matching
2Measurement precision
If conventional security software uses signature scanning to detect malware, then detection is effective for known malware, but it becomes impractical when malware generates new malicious code for every visitor
Solution Approach 1:
The system enables clients to self-assess their hygiene status and receive reputation scores for files they encounter, eliminating the need for centralized signature distribution and updates. Each client independently evaluates file trustworthiness based on aggregated data from the community, allowing the system to adapt to new malware variants without requiring signature database updates
Solution Approach 2:
The patent shifts from static signature-based identification to dynamic reputation scoring based on changing parameters such as client hygiene scores, website reputation, and malware prevalence. This parameter-based approach allows the system to adapt to new malware variants by updating score calculations rather than requiring new signatures, reducing the complexity of signature maintenance
Data Source
AI summary
A reputation server is coupled to multiple clients via a network. Each client has a security module that detects malware at the client. The security module computes a hygiene score based on detected malware. The security module provides the hygiene score and an identifier of a visited web site to a reputation server. The security module also provides identifiers of files encountered at specified web sites to the reputation server. The reputation server computes secondary hygiene scores for web sites based on the hygiene scores of the clients that visit the web sites. The reputation server further computes reputation scores for files based on the secondary hygiene scores of sites that host the files. The reputation server provides the reputation scores to the clients. A reputation score represents an assessment of whether the associated file is malicious.