Device reputation management

摘要

A device reputation server recognizes malicious devices used in prior attacks and prevents further attacks by the malicious devices. Server computers require a digital fingerprint of any client devices prior to providing any service to such client devices. Logging of network activity include the digital fingerprint of the device perpetrating the attack. When an attack is detected or discovered, the attacked server reports the attack and the digital fingerprint of the perpetrating device to a device reputation server. The device reputation server uses the report to improve future assessments of the reputation of the device associated with the reported digital fingerprint.

主权项

1. A method for determining the trustworthiness of a remotely located, subject device, the method comprising:
receiving data representing one or more attacks by one or more perpetrating devices; receiving a request for a reputation of the subject device through a computer network; determining whether the subject device is one of the perpetrating devices; retrieving data representing one or more of the attacks that are associated with the subject device; quantifying a measure of trustworthiness of the subject device from the data representing one or more of the attacks that are associated with the subject device; and sending data representing the measure of trustworthiness of the subject device in response to the request.