Rating communicating entities based on the sharing of insecure content

[0001] This disclosure pertains generally to computing device security, and more specifically to rating communicating entities based on the sharing of insecure content, and protecting users from shared insecure content.

[0002] Mobile computing device users face a growing threat to security and privacy on the internet, from computer viruses and other forms of malware. Social apps with communication features such as chat and direct messaging are often used to spread malicious content, often without the knowledge of the users involved. The same is true of other communication apps, such as email and text.

[0003] With so many social networking apps, messaging apps, email apps, etc., a user is often added to multiple groups. Not all of the members of a given group are necessarily in the user's contacts, nor does the user necessarily know all of the members of the given group. Many users share/forward different content within such groups. With or without the knowledge of the sharing users, some of the content distributed within groups is insecure/malicious. Group members are thus prone to the risk of accidentally being part of such sharing/forwarding, or of being victimized by such content. Many users are not knowledgeable about computer security, and are often not careful about the security or privacy aspects of such shared content. Users in groups are thus vulnerable to having their devices infected by shared malicious content, and often unknowingly serve as a medium for spreading these infections to other users.

[0004] For example, there could be group members who, due to a general lack of computer security awareness, continue to forward communications with lucky draw or other offer links, which tend to be malicious, breached and/or fake. Clicking on such links is a security risk to the receiving user. Accidently forwarding such links puts the user's contacts at risk. Typically, insecure content is forwarded and otherwise shared by certain group members. A user who is a member of a group that includes such members is unknowingly prone to these risks.

[0005] It would be desirable to address these issues.

[0006] A user of a computing device is protected from insecure content disseminated by communicating entities (e.g., other users) that are members of at least one group of which the user is a member. In one embodiment, the computing device is in the form of a mobile computing device such as a smartphone or tablet, and some or all of the functionality described herein is performed by an app running thereon. Communications received by the computing device and originating from communicating entities that are members of one or more of the same group(s) as the user are tracked. For example, communications received by the computing device via a plurality of user-level communication applications can be monitored (e.g., messaging apps, email apps, contacts apps, social networking apps, etc.).

[0007] A corresponding unique identifier is maintained for each communicating entity which is a member of at least one group of which the user is a member. Additional data concerning these communicating entities may also be maintained. Such data can be gleaned from, for example, one or more user-level communication applications. For each communicating entity which is a member of one or more of the same group(s) as the user, an associated security rating is configured. Each security rating comprises a quantification of a security risk of receiving communication from the associated communicating entity. In some embodiments, security ratings are initialized to a default value, such as zero.

[0008] A security analysis is performed on content received by the computing device from communicating entities that are members of one or more of the same group(s) as the user. This can take the form of, for example, intercepting communications received by the computing device from these communicating entities, and scanning content of the intercepted communications. Different forms of security analysis can be used in different embodiments, such as scanning files using a set of signatures of known malicious code, comparing links embedded in content to known or suspected malicious websites, analyzing content for patterns associated with spam or phishing, running active content in a sandbox and subjecting the running active content to heuristic or other type of analysis, etc.

[0009] Security ratings associated with given communicating entities are adjusted, responsive to given security analyses of content received by the computing device from these associated communicating entities, where such an analysis identifies one or more given security concerns. Different adjustments to security ratings can be made in response to different incidents, with the adjustments being quantitatively proportional to different seriousness levels associated with the associated security analyses of received content.

[0010] Responsive to the security rating associated with a specific communicating entity exceeding a predefined threshold, one or more security actions can be taken to prevent the user of the computing device from being exposed to communication from that communicating entity. For example, actions that can be taken include blocking communications from the specific communicating entity, redacting communications from the specific communicating entity, auto-deleting messages or files from the specific communicating entity, automatically removing the user from at least one group of which the specific communicating entity is a member, transmitting warning notification(s) to the user, the specific communicating entity, other members of groups of which the communicating entity is a member, etc. In one embodiment, machine learning driven by telemetry received from multiple endpoints is used to set the predetermined threshold.

[0011] The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.

[0016] The Figures depict various embodiments for purposes of illustration only. One skilled in the art will readily recognize from the following discussion that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles described herein.

[0017] FIG. 1 is a block diagram illustrating an exemplary network architecture 100 in which a communicating entity rating manager 101 can be implemented. The illustrated network architecture 100 comprises multiple clients 103A, 103B and 103N, as well as multiple servers 105A and 105N. In FIG. 1, a communicating entity rating manager 101 is illustrated as residing on each client 103A-N. It is to be understood that this is an example only, and in various embodiments various functionalities of this system 101 can be instantiated on a client 103, a server 105, or can be distributed between multiple clients 103 and/or servers 105.

[0018] Clients 103 and servers 105 can be implemented using computer systems 210 such as the one illustrated in FIG. 2 and described below. The clients 103 and servers 105 are communicatively coupled to a network 107, for example via a network interface 248 or modem 247 as described below in conjunction with FIG. 2. Clients 103 are able to access applications and/or data on servers 105 using, for example, a web browser or other client software (not shown). Clients 103 can be in the form of desktop/laptop computers, or mobile computing devices, comprising portable computer systems capable of connecting to a network 107 and running applications (e.g., smartphones, tablet computers, wearable computing devices, etc.).

[0019] Although FIG. 1 illustrates three clients 103 and two servers 105 as an example, in practice many more (or fewer) clients 103 and/or servers 105 can be deployed. In one embodiment, the network 107 is in the form of the Internet. Other networks 107 or network-based environments can be used in other embodiments.

[0020] FIG. 2 is a block diagram of a computer system 210 suitable for implementing a communicating entity rating manager 101. Both clients 103 and servers 105 can be implemented in the form of such computer systems 210. As illustrated, one component of the computer system 210 is a bus 212. The bus 212 communicatively couples other components of the computer system 210, such as at least one processor 214, system memory 217 (e.g., random access memory (RAM), read-only memory (ROM), flash memory), an input/output (I/O) controller 218, an audio output interface 222 communicatively coupled to an external audio device such as a speaker 220, a display adapter 226 communicatively coupled to an external video output device such as a display screen 224, one or more interfaces such as Universal Serial Bus (USB) ports 228, serial ports 230, etc., a keyboard controller 233 communicatively coupled to a keyboard 232, a storage interface 234 communicatively coupled to at least one hard disk 244 (or other form(s) of data storage media), a host bus adapter (HBA) interface card 235A configured to connect with a Fibre Channel (FC) network 290, an HBA interface card 235B configured to connect to a SCSI bus 239, an optical disk drive 240 configured to receive an optical disk 242, a mouse 246 (or other pointing device) coupled to the bus 212 e.g., via a USB port 228, a modem 247 coupled to bus 212, e.g., via a serial port 230, and one or more wired and/or wireless network interface(s) 248 coupled, e.g., directly to bus 212.

[0021] Other components (not illustrated) may be connected in a similar manner (e.g., document scanners, digital cameras, printers, etc.). Conversely, all of the components illustrated in FIG. 2 need not be present (e.g., smartphones and tablets typically do not have optical disk drives 240, external keyboards 242 or external pointing devices 246, although various external components can be coupled to mobile computing devices via, e.g., USB ports 228). The various components can be interconnected in different ways from that shown in FIG. 2.

[0022] The bus 212 allows data communication between the processor 214 and system memory 217, which, as noted above may include ROM and/or flash memory as well as RAM. The RAM is typically the main memory into which the operating system and application programs are loaded. The ROM and/or flash memory can contain, among other code, the Basic Input-Output system (BIOS) which controls certain basic hardware operations. Application programs can be stored on a local computer readable medium (e.g., hard disk 244, optical disk 242) and loaded into system memory 217 and executed by the processor 214. Application programs can also be loaded into system memory 217 from a remote location (i.e., a remotely located computer system 210), for example via the network interface 248 or modem 247. In FIG. 2, the communicating entity rating manager 101 is illustrated as residing in system memory 217. The workings of the communicating entity rating manager 101 are explained in greater detail below in conjunction with FIGS. 3-5.

[0023] The storage interface 234 is coupled to one or more hard disks 244 (and/or other standard storage media). The hard disk(s) 244 may be a part of computer system 210, or may be physically separate and accessed through other interface systems.

[0024] The network interface 248 and or modem 247 can be directly or indirectly communicatively coupled to a network 107 such as the Internet. Such coupling can be wired or wireless.

[0025] FIG. 3 illustrates the operation of a communicating entity rating manager 101, according to some embodiments. As described above, the functionalities of the communicating entity rating manager 101 can reside on a client 103, a server 105, or be distributed between multiple computer systems 210, including within a cloud-based computing environment in which the functionality of the communicating entity rating manager 101 is provided as a service over a network 107.

[0026] FIG. 3 illustrates a specific multiple module instantiation of a communicating entity rating manager 101, according to some embodiments. It is to be understood that although the communicating entity rating manager 101 is illustrated as a single entity, the illustrated communicating entity rating manager 101 represents a collection of functionalities, which can be instantiated as a single or multiple modules as desired (an instantiation of specific, multiple modules of the communicating entity rating manager 101 according to one embodiment is illustrated in FIG. 3). It is to be understood that the modules of the communicating entity rating manager 101 can be instantiated (for example as object code or executable images) within the system memory 217 (e.g., RAM, ROM, flash memory) of any computer system 210, such that when the processor 214 of the computer system 210 processes a module, the computer system 210 executes the associated functionality. As used herein, the terms “computer system,” “computer,” “client,” “client computer,” “server,” “server computer” and “computing device” mean one or more computers configured and/or programmed to execute the described functionality. Additionally, program code to implement the functionalities of the communicating entity rating manager 101 can be stored on computer-readable storage media. Any form of tangible computer readable storage medium can be used in this context, such as magnetic or optical storage media. As used herein, the term “computer readable storage medium” does not mean an electrical signal separate from an underlying physical medium.

[0027] FIG. 4 illustrates steps executed by the communicating entity rating manager 101, according to some embodiments. For clarity of description, the subject matter illustrated in FIGS. 3 and 4 is described together below.

[0028] In the embodiment illustrated in FIG. 3, a communicating entity rating manager 101 runs on a mobile computing device 300, such as a smartphone or tablet, which is connected to a network 107. In one embodiment, the communicating entity rating manager 101 is implemented in the form of an app 301 which runs on the mobile computing device 300 (e.g., an Android app, an iOS app, etc.). In some embodiments, the communicating entity rating manager 101 is instantiated as part of or otherwise in conjunction with an endpoint mobile security app 301, which may in turn interface with a backend/cloud based security system (not illustrated). Although FIG. 3 illustrates the communicating entity rating manager 101 executing on a mobile computing device 300, it is to be understood that in other embodiments the communicating entity rating manager 101 can be present on other types of computer systems 210 (e.g., desktops, rack mounted servers, etc.).

[0029] Various apps 301 are installed on the mobile computing device 300 on which the communicating entity rating manager 101 is present. Among these various apps 301 are typically some which the user of the mobile computing device 300 can use to communicate with other users, such as, for example, social media apps, direct messaging apps, texting apps, email apps, contacts apps, etc. For each such user-level communication app 301, a group member tracking module 303 of the communicating entity rating manager 101 tracks 401 the members of associated groups to which the user of the mobile computing device 300 belongs (e.g., groups within given social media platforms, text or email distribution lists, categories of contacts, etc.). A group can be defined at any level of granularity, from a small or medium number of users (e.g., two, three, ten, twenty, thirty) who form some sort of association within a social media or similar context (e.g., members of a club, interest group, friendship circle, extended family, etc.) to large distribution lists with dozens, hundreds or thousands of members (e.g., multiple users classified as alumni of a given school, members of a given organization, etc.), to de facto groups such as all entries in the user's contacts, social media friends, friends of friends, etc.

[0030] The communicating entity rating manager 101 can use different techniques in different embodiments in order to read the data of the corresponding communication apps 301 and track the members of the groups. For example, the communicating entity rating manager 101 can request and receive corresponding permissions (e.g., at install time) from the user of the mobile computing device 300 (e.g., read contacts, read external data, etc.). In other example embodiments, the communicating entity rating manager 101 can scan communications, read notifications, use various system or app-level APIs, etc.

[0031] An identification maintaining module 307 of the communicating entity rating manager 101 maintains 403 an identification 309 of each member of the various groups of which the user of the mobile computing device 300 is a member. The format of the maintained identifications 309 can vary between embodiments, but constitutes some form of unique identifier such as a username, identification number, actual name, phone number, email address, etc. In some embodiments, the identification maintaining module 307 also maintains related or additional data concerning group members, such as their actual names, addresses, etc. In some embodiments, the identification maintaining module 307 gleans information concerning given group members from multiple sources (e.g., name and alias from a social media app, email and phone number from contacts app, etc.). The identification maintaining module 307 can store the maintained identifications 309 and other information concerning the group members in a database 311 (as illustrated in FIG. 3) or other suitable storage configuration (e.g., a flat file, linked list, b-tree, etc.).

[0032] For each identified group member, a security rating configuring module 313 of the communicating entity rating manager 101 configures 405 a corresponding security rating 315. The security ratings 315 can be initialized to a default value (e.g., zero), but are updated based on content transmitted by the group members, as described in detail below. The specific format of a security rating 315 can vary between embodiments, but is in the form of a quantification of the security risk of receiving communications from the given group member.

[0033] When group members share, transmit or otherwise provide content to the user of the mobile computing device 300, a content analysis performing module 317 of the communicating entity rating manager 101 analyzes 407 the content to determine whether it is secure. For example, the content analysis performing module 317 can intercept the communication, and scan the content. In different embodiments, different forms of security analysis can be applied to the scanned content. For example, files can be scanned using a set of signatures of known malicious code. Links embedded in the content can be compared to known or suspected malicious websites. The content of messages can be analyzed for patterns associated with spam or phishing. Active content can be run in a sandbox and subject to heuristic or other forms of security analysis.

[0034] It is to be understood that these are just examples of the types of analysis that can be performed on received content. As noted above, in some embodiments the communicating entity rating manager 101 can be implemented as part of or otherwise in conjunction with an endpoint mobile security app 301. The endpoint mobile security app 301 can in turn be in communication with a backend (e.g., cloud based) security system. In such embodiments, all of the malicious code detection mechanisms and other security analysis techniques of the mobile security app 301 and/or security system are available to the communicating entity rating manager 101 for use in this context.

[0035] Where the analysis of the content of a specific communication from a given group member to the user identifies a security concern, the security rating adjusting module 318 adjusts 409 the corresponding security rating 315 accordingly. Depending upon the severity of the identified security concern, the security rating 315 for the associated group member can be adjusted to indicate an increased risk level associated with communications from that group member. The exact amount by which to adjust a security rating 315 based on different detected incidents is a variable design parameter. For example, a communicating entity 305 sending a message containing a link to an unknown website could be classified as a minor concern, a communicating entity 305 sending an email containing a link to a phishing site of medium concern, and a communicating entity 305 distributing known malicious files to be of high concern, resulting in corresponding adjustments being made to the communicating entity's security rating 315 (e.g., the adjustments can be quantitatively proportional to the given seriousness level). In practice, more (or fewer) seriousness levels may be utilized by the communicating entity rating manager 101. In addition to the type of content, the nature of the communication (e.g., originated by the communicating entity 305, forwarded from a third party, sent only to the user, sent to the entire group, etc.) can also be utilized in adjusting the security rating 315 of the communicating entity 305.

[0036] Over time, the security ratings 315 of various group members that communicate with the user of the mobile computing device 300 are adjusted based on any suspicious/malicious transmissions. The specific content and communication characteristics described above are just examples of possible types of identified security concerns based on content/communication analysis, with example adjudications of their seriousness described according to one embodiment. What adjustments to make to security rating 315 of communicating entities 305 in response to identifications of content and other factors concerning communication are a variable design parameter.

[0037] In response to a security rating 315 for a communicating entity 305 exceeding a predetermined threshold, a security action taking module 319 of the communicating entity rating manager 101 takes 411 a corresponding security action, to protect the user of the mobile computing device 300 from the group member. In different embodiments, different security actions can be taken in this context, such as, for example, blocking communications from the group member, redacting communications from the group member (e.g., removing/deactivating links, active content, etc.), auto-deleting messages or files from the group member, transmitting a warning notification back to the group member, transmitting warning notifications to other members of the group, warning the user of the mobile computing device 300, automatically removing the user from the group, etc. Which specific security action(s) to take is a variable design parameter. By taking security actions in response to detecting group members whose activities over time are adjudicated to be sufficiently suspect and/or risky, the communicating entity rating manager 101 not only protects the user of the mobile computing device 300 from being a victim of such communicating entities 305, but also protects the user from unwittingly spreading such malicious shared content.

[0038] The specific value of the predetermined threshold at which to take one or more security actions is also a variable design parameter, and can be adjusted up or down in different embodiments, e.g., by the user of the mobile computing device 300, by the communicating entity rating manager 101, by the backend security system (e.g., using machine learning driven by telemetry received from multiple endpoints), etc.

[0039] As will be understood by those familiar with the art, the invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Likewise, the particular naming and division of the portions, modules, agents, managers, components, functions, procedures, actions, layers, features, attributes, methodologies, data structures, and other aspects are not mandatory or significant, and the mechanisms that implement the invention or its features may have different names, divisions and/or formats. The foregoing description, for purpose of explanation, has been described with reference to specific embodiments. However, the illustrative discussions above are not intended to be exhaustive or limiting to the precise forms disclosed. Many modifications and variations are possible in view of the above teachings. The embodiments were chosen and described in order to best explain relevant principles and their practical applications, to thereby enable others skilled in the art to best utilize various embodiments with or without various modifications as may be suited to the particular use contemplated.