System and method for developing a risk profile for an internet service

Abstract

A method and system for controlling access to an Internet resource is disclosed herein. When a request for an Internet resource, such as a Web site, is transmitted by an end-user of a LAN, a security appliance for the LAN analyzes a reputation index for the Internet resource before transmitting the request over the Internet. The reputation index is based on a plurality of factors for the Internet resource. A client application's access to the Internet resource can be allowed or denied based on the reputation index of the Internet resource.

What is claimed is: 
     
         1 . A method for controlling access to web resources, the method comprising:
 receiving a request from a client application for an Internet resource;   prior to transmission of the request for the Internet resource over the Internet from a local area network, comparing a reputation index for the Internet resource to a threshold value to generate a comparison result, the reputation index generated from a plurality of factors for the Internet resource, the plurality of factors comprising a top-level domain, an age of domain registration, a traffic volume, a detection of malicious code, a domain registration location, and uniform resource locator (URL) redirection, and an IP address; and   allowing or denying the client application access to the Internet resource based on the comparison result.   
     
     
         2 . The method of  claim 1 , wherein the plurality of factors includes a private Internet protocol (IP) address factor. 
     
     
         3 . The method of  claim 2 , wherein the plurality of factors includes a government IP address factor. 
     
     
         4 . The method of  claim 1 , wherein the plurality of factors includes a country of service hosting, a country of an internet protocol address block, a popularity rank, a number of hosts, a plurality of run-time behaviors, a script block count, a picture count, and a response latency. 
     
     
         5 . The method for controlling access of  claim 1 , further comprising:
 maintaining a machine learning model representing the plurality of factors for a plurality of Internet resources and reputations for the plurality of Internet resources; and   generating the reputation index for the Internet resource, wherein generating the reputation index comprises processing the plurality of factors for the Internet resource using the machine learning model.   
     
     
         6 . The method of controlling access of  claim 5 , wherein the reputation index for the Internet resource is pre-generated prior to receiving the request from the client application for the Internet resource. 
     
     
         7 . The method of controlling access of  claim 6 , further comprising providing the reputation index for the Internet resource to the local area network prior to receiving the request from the client application for the Internet resource. 
     
     
         8 . The method of controlling access of  claim 5 , wherein the reputation index for the Internet resource is generated after receiving the request for the Internet resource from the client application. 
     
     
         9 . The method of controlling access of  claim 1 , wherein allowing access to the Internet resource comprises transmitting the request for the Internet resource over the Internet to a server and transmitting a responsive web page to the client application. 
     
     
         10 . The method of controlling access of  claim 1 , wherein denying access to the Internet resource comprises returning a web page from the local area network to the client application. 
     
     
         11 . A system for controlling access to web resources, the system comprising:
 a processor;   a memory storing instructions executable by the processor for:
 receiving, by the processor, a request from a client application for an Internet resource; 
 prior to transmission of the request for the Internet resource over the Internet from a local area network, comparing a reputation index for the Internet resource to a threshold value to generate a comparison result, the reputation index generated from a plurality of factors for the Internet resource, the plurality of factors comprising a top-level domain, an age of domain registration, a traffic volume, a detection of malicious code, a domain registration location, and uniform resource locator (URL) redirection, and an IP address; 
 allowing the client application access to the Internet resource based on the comparison result; and 
 denying the client application access to the Internet resource based on the comparison result. 
   
     
     
         12 . The system of  claim 11 , wherein the plurality of factors includes a private Internet protocol (IP) address factor. 
     
     
         13 . The system of  claim 12 , wherein the plurality of factors includes a government IP address factor. 
     
     
         14 . The system of  claim 11 , wherein the plurality of factors includes a country of service hosting, a country of an internet protocol address block, a popularity rank, a number of hosts, a plurality of run-time behaviors, a script block count, a picture count, and a response latency. 
     
     
         15 . The system of  claim 11 , further comprising instructions executable by the processor for:
 maintaining a machine learning model representing the plurality of factors for a plurality of Internet resources and reputations for the plurality of Internet resources; and   generating the reputation index for the Internet resource, wherein generating the reputation index comprises processing the plurality of factors for the Internet resource using the machine learning model.   
     
     
         16 . The system of  claim 15 , wherein the reputation index for the Internet resource is pre-generated prior to receiving the request from the client application for the Internet resource. 
     
     
         17 . The system of  claim 16 , wherein the processor comprises a first processor coupled between the local area network and the Internet and a second processor, and wherein the system further comprises instructions executable by the second processor for providing the reputation index for the Internet resource to the local area network prior to the first processor receiving the request from the client application for the Internet resource. 
     
     
         18 . The system of controlling access of  claim 15 , wherein the reputation index for the Internet resource is generated after the processor receives the request for the Internet resource from the client application. 
     
     
         19 . The system of  claim 11 , wherein allowing access to the Internet resource comprises transmitting the request for the Internet resource over the Internet to a server and transmitting a responsive web page to the client application. 
     
     
         20 . The system of  claim 19 , wherein denying access to the Internet resource comprises returning a web page from the local area network to the client application.