Tracking and mitigation of an infected host device

A security platform may determine mapped attribute information associated with a plurality of host identifiers. The mapped attribute information may include information that identifies a set of related attributes. The security platform may determine, based on the mapped attribute information, that a host device is associated with at least two host identifiers of the plurality of host identifiers. The security platform may aggregate, based on the at two least host identifiers, threat information as aggregated threat information associated with the host device. The security platform may classify the host device as an infected device or a suspicious device based on the aggregated threat information.

BACKGROUND

Blocking may prevent a host device from communicating with another device based on an identifier used by a network and/or by access control to the network (e.g., an Internet protocol (IP) address, a media access control (MAC) address, a username, and/or the like). For example, blocking may prevent the host device from communicating with another host device when the host device is classified as being infected with a virus, having engaged in a suspicious activity (e.g., downloading malware, accessing a malicious server, or the like). Other security measures that may be used against such a host device include throttling the host device, subjecting the host device to greater scrutiny, slotting the host device for investigation, redirecting the host device, putting the host device into a walled garden, or otherwise restricting the host device in some way.

SUMMARY

According to some possible implementations, a security platform may include on or more processors to: determine mapped attribute information associated with a plurality of host identifiers, where the mapped attribute information may include information that identifies a set of related attributes; determine, based on the mapped attribute information, that a host device is associated with at least two host identifiers of the plurality of host identifiers; aggregate, based on the at two least host identifiers, threat information as aggregated threat information associated with the host device; and classify the host device as an infected device or a suspicious device based on the aggregated threat information.

According to some possible implementations, a non-transitory computer-readable medium may store instructions that, when executed by one or more processors, cause the one or more processors to: receive mapped attribute information associated with a plurality of host identifiers, wherein the mapped attribute information may include information that identifies a set of related attributes; determine, based on the mapped attribute information, that a host device is associated with at least two host identifiers of the plurality of host identifiers; aggregate, based on the at least two host identifiers, threat information as aggregated threat information associated with the host device; and perform an action based on aggregating the threat information.

According to some possible implementations, a method may include: determining, by a security platform, mapped attribute information associated with a plurality of host identifiers, wherein the mapped attribute information may include information that identifies a set of related attributes; determining, by the security platform and based on the mapped attribute information, that a host device is associated with at least two host identifiers of the plurality of host identifiers; aggregating, by the security platform and based on the at two least host identifiers, threat information as aggregated threat information associated with the host device; and classifying, by the security platform, the host device as an infected device or a suspicious device based on the aggregated threat information.

DETAILED DESCRIPTION

A host device may become infected by, for example, downloading malware, upon being compromised (e.g., due to stolen credentials, being remotely controlled, and/or the like). When mitigating a threat associated with the infection, an important concern is preventing the infected host device from infecting other host devices. A security platform (e.g., one or more devices that host a threat protection service and/or one or more other security services) may be configured to address this concern by implementing a blocking technique (e.g., based on an IP address, a MAC address, a username, and/or the like) at a network device associated with the infected host device. Here, upon determining that the host device is infected, the security platform may determine an attribute (e.g., an IP address, a MAC address, a username and/or the like) associated with the infected host device, and prevent the infected host device from communicating with one or more other host devices based on the attribute (e.g., by identifying and blocking communications associated with the attribute). Notably, while some implementations described herein describe use of a blocking technique against the infected host device, another type of action may be taken. Such actions include, but are not limited to, throttling the host device, subjecting the host device to greater scrutiny, slotting the host device for investigation, redirecting the host device, putting the host device into a walled garden, or otherwise restricting the host device in some way. In other words, the implementations described herein may be used in association with using one or security measures other than blocking.

In some implementations, the attribute may be a static attribute, a semi-static attribute (e.g., an attribute that may be static or dynamic in different circumstances), or a dynamic attribute. For example, the attribute may be an IP address, a hostname, a MAC address, a username (e.g., a lightweight directory access protocol (LDAP) username), a single sign-on username, and/or the like.

However, such a blocking technique may fail to provide protection when, for example, the blocking technique is based on an attribute that has or can be changed. For example, if the host device switches from one IP address to another IP address (i.e., is assigned different IP address at a later time), or if the IP address is spoofed, then a blocking technique that uses IP addresses as a basis for blocking may fail to provide protection. Generally, if the host device switches from one attribute to another attribute, then a blocking technique that uses the attribute as a basis for blocking may fail to provide protection.

Moreover, such a blocking technique may result in a clean host device (i.e., a host device that is not infected) being prevented from communicating with other host devices. For example, in the case of blocking based on an IP address, an IP address that was previously assigned to the infected host device may be reassigned to a clean host device (e.g., after the infected host device leaves a network associated with both host devices). In such a case, the clean host device may be prevented from communicating with other host devices as a result of the IP address being previously associated with the infected host device.

Furthermore, aggregating threat information associated with a given host device (e.g., information associated with one or more threat events based on which the given host device may be determined to be infected) may be difficult or impossible in a case where an attribute of the given host device is changed. Thus, a classification of the given host device as infected or suspicious may be based on threat information associated with a single instance of the attribute (e.g., a single IP address), which may reduce accuracy of and/or confidence in the classification.

Implementations described herein provide a security platform capable of aggregating threat information, associated with a host device, even when the host device has one or more that have or can be changed attributes. In some implementations, the security platform may aggregate the threat information based on mapped attribute information, associated with the host device, that identifies an association between at least two attributes of the host device.

In some implementations, based on the aggregated threat information, the security platform may perform an improved classification of the host device as infected or suspicious (e.g., as compared to a classification based on threat information associated with a single instance of an attribute and/or threat information associated with a single threat event), thereby improving network security. Additionally, or alternatively, the security platform may deprioritize (i.e., cease blocking) one or more attributes previously associated with the host device, thereby preventing communications of other host devices from being improperly blocked.

FIGS. 1A and 1Bare diagrams of an overview of an example implementation100described herein. As shown inFIG. 1A, assume that a host device (e.g., host device A (HDA)) is assigned a first attribute (e.g., a first IP address (IP1)), and is communicating with another device (e.g., such as a server included in a network, such as an intranet, the Internet, and/or the like) via a network device (e.g., a router, a gateway, a switch, etc.).

As shown inFIG. 1A, and by reference number105, the network device may detect a threat event associated with host device A. The threat event may include, for example, an event such as an instance of malware being downloaded by host device A, an instance of host device A accessing or attempting to access a server known to be malicious, an instance of host device A exhibiting behavior indicative of being infected, or the like.

As shown by reference number110, the network device may provide, to a security platform associated with providing a threat protection service, threat information associated with the threat event. The threat information may include, for example, information associated with one more threat events associated with host device A, such as attribute information associated with host device A (e.g., information associated with one or more attributes, such as an IP address (IP1)), information associated with the threat event (e.g., a timestamp, a hash value of a downloaded file that triggered the threat event, a score or a metric associated with the threat event, information that identifies a name of the threat event and/or a type of the threat event), or the like.

As shown by reference number115, the security platform (e.g., a threat protection service hosted on the security platform) may classify, based on the threat information, host device A as an infected device or a suspicious device. An infected device may include a host device that is to be blocked from communicating with other devices (e.g., other host devices, a server, a network device, or the like) due to being identified as a threat to other devices. A suspicious device may include a host device that is permitted to continue communicating with other devices, but that is to be monitored due to engaging in suspicious activity. In some implementations, the security platform may classify host device A as infected or suspicious based on a threat assessment algorithm configured on the security platform, as described below.

As further shown, based on classifying host device A as an infected device or a suspicious device, the security platform may store the threat information with a host identifier (e.g., an identification number or name) that corresponds to the attribute information. For example, the security platform may determine whether the security platform stores a host identifier that corresponds to the attribute information (e.g., whether a host identifier was already created for IP1) associated with the threat event. If no host identifier exists, then the security platform215may create a new host identifier (e.g., HID1) and associate the attribute information and the threat information with the new host identifier. Alternatively, if a host identifier exists for the attribute information, then the security platform215may associate the attribute information and the threat information with the existing host identifier.

As shown by reference number120, the security platform may provide, to one or more security services (e.g., security services1through M hosted by, for example, one or more security devices, the security platform, the network device, or the like), the attribute information associated with the host identifier (i.e., the attribute information associated with host device A at the time of the threat event). The security platform may provide, to the one or more security services, attribute information associated with a group of (i.e., multiple) host identifiers (e.g., HID2through HIDX), which may be associated with host device A and/or one or more other host devices, in a similar manner.

As shown inFIG. 1B, and by reference number125, based on the attribute information provided by the security platform, the one or more security services may provide, to the security platform, mapped attribute information associated with the group of host identifiers.

The mapped attribute information may include information that identifies two or more related attributes. For example, the mapped attribute information may include information that identifies a first attribute, associated with a first host identifier (e.g., IP1associated with HID1) and a second attribute related to the first attribute (e.g., a MAC address (MAC1) associated with IP1). Continuing with this example, the mapped attribute information may include information that identifies a third attribute associated with a second host identifier (e.g., IP6associated with HID6), and may include information that identifies the second attribute as being related to the third attribute (e.g., MAC1associated with the IP6). Notably, in this example, the same attribute (the second attribute) is associated with both the first and third attributes. Additional examples of mapped attribute information are described below. In some implementations, the one or more security services may determine the mapped attribute information during provisioning of the respective services.

As shown by reference number130, based on the mapped attribute information, the security platform may determine that host device A is associated with at least two host identifiers of the group of host identifiers (e.g., including HID and HID6, as shown inFIG. 1B). For example, when the mapped attribute information includes the example mapped attribute information described above, the security platform may determine that host device A is associated with the first attribute (e.g., IP1, a current IP address) and the third attribute (e.g., IP6, a previously assigned IP address) since both the first attribute and the third attribute are associated with the second attribute (e.g., MAC1).

As shown by reference number135, based on determining that host device A is associated with the at least two host identifiers, the security platform may aggregate threat information associated with the at two least host identifiers (e.g., based on threat information, associated with HID and HID6, stored or accessible by the security platform). As further shown, the security platform may again classify host device A as infected or suspicious based on the aggregated threat information (e.g., in a manner similar to that described above). In this way, a security platform may aggregate threat information, associated with a host device, based on at least two host identifiers associated with the host device. In some implementations, based on the aggregated threat information, the security platform may perform an improved classification of the host device as infected or suspicious (e.g., relative to not aggregating the threat information), thereby improving network security. Further, based on the aggregated threat information, the security platform may achieve improved monitoring and/or tracking of non-infected and/or compromised host devices, in some implementations.

Additionally, or alternatively, the security platform may deprioritize one or more attributes associated with one of the at least two host identifiers. For example, as further shown inFIG. 1Bby reference number135, since host device A is currently assigned IP1, the security platform may deprioritize IP addresses previously assigned to host device A (e.g., IP6). Thus, as shown by reference number140, when another device (e.g., host device B) is assigned an IP address that was previously assigned to host device A, improper blocking, associated with the attribute previously assigned to host device A, is prevented. In some implementations, the security platform may store and/or provide associated with a such a deprioritization for use for in analysis, historical analysis, forensics, and/or the like.

As indicated above,FIGS. 1A and 1Bare provided merely as an example. Other examples are possible and may differ from what was described with regard toFIGS. 1A and 1B.

FIG. 2is a diagram of an example environment200in which systems and/or methods, described herein, may be implemented. As shown inFIG. 2, environment200may include one or more host devices205-1through205-N (N≥1) (hereinafter referred to collectively as host devices205, and individually as host device205), a network device210, a security platform215hosted in a cloud computing environment220, one or more security devices225-1through225-M (M≥1) (hereinafter referred to collectively as security devices225, and individually as security device225), and a network230. Devices of environment200may interconnect via wired connections, wireless connections, or a combination of wired and wireless connections.

Host device205includes a device capable of communicating with another device (e.g., another host device205, a server device, a network device, or the like) via network device210. For example, host device205may include a user device, such as a mobile phone (e.g., a smart phone, a radiotelephone, etc.), a laptop computer, a tablet computer, a handheld computer, a desktop computer, a gaming device, a wearable communication device (e.g., a smart wristwatch, a pair of smart eyeglasses, etc.), or a similar type of device. As another example, host device205may include a server or a group of servers. As a further example, host device205may include an endpoint device or an edge device.

Network device210includes one or more devices (e.g., one or more traffic transfer devices) capable of processing and/or transferring traffic between host device205and another device (e.g., a device with which host device205is to communicate). For example, network device210may include a firewall, a router, a gateway, a switch, a hub, a bridge, a reverse proxy, a server (e.g., a proxy server), a security device, an intrusion detection device, a load balancer, or a similar device.

Security platform215includes one or more devices capable of aggregating threat information, associated with host device205, even when host device205has one or more attributes that have or can be changed. In some implementations, security platform215may be capable of determining whether host device205is infected or suspicious based on the aggregated threat information. For example, security platform215may include a server or a group of servers. In some implementations, security platform215may be hosted in cloud computing environment220. Notably, while implementations described herein describe security platform215as being hosted in cloud computing environment220, in some implementations, security platform215may not be cloud-based or may be partially cloud-based.

Cloud computing environment220includes an environment that delivers computing as a service, whereby shared resources, services, etc. may be provided to host security platform215. Cloud computing environment220may provide computation, software, data access, storage, and/or other services that do not require end-user knowledge of a physical location and configuration of a system and/or a device that delivers the services. As shown, cloud computing environment220may include a group of computing resources217associated with hosting security platform215.

Computing resource217includes one or more personal computers, workstation computers, server devices, or another type of computation and/or communication device. In some implementations, computing resource217may host security platform215. The cloud resources may include compute instances executing in computing resource217, storage devices provided in computing resource217, data transfer devices provided by computing resource217, etc. In some implementations, computing resource217may communicate with other computing resources217via wired connections, wireless connections, or a combination of wired and wireless connections.

As further shown inFIG. 2, computing resource217may include a group of cloud resources, such as one or more applications (APPs)217-1, one or more virtual machines (VMs)217-2, virtualized storage (VSs)217-3, one or more hypervisors (HYPs)217-4, or the like.

Application217-1includes one or more software applications that may be provided to or accessed by network device210. Application217-1may eliminate a need to install and execute the software applications on network device210. For example, application217-1may include software associated with security platform215and/or any other software capable of being provided via cloud computing environment220. In some implementations, one application217-1may send/receive information to/from one or more other applications217-1, via virtual machine217-2.

Hypervisor217-4provides hardware virtualization techniques that allow multiple operating systems (e.g., guest operating systems) to execute concurrently on a host computer, such as computing resource217. Hypervisor217-4may present a virtual operating platform to the guest operating systems, and may manage the execution of the guest operating systems. Multiple instances of a variety of operating systems may share virtualized hardware resources.

Security device225includes a device associated with providing one or more security services, such as a firewall service, a threat detection service, a malware blocking service, an intrusion detection service, or the like. For example, security device225may include a server, a group of servers, a network device (e.g., a firewall, an intrusion detection device, etc.), or the like. In some implementations, security device225may be capable of determining and providing attribute information, associated with one or more IP addresses, to security platform215, as described herein. In some implementations, security device225may be included in network device210. Additionally, or alternatively, security device225may be hosted in security platform215and/or cloud computing environment220.

FIG. 3is a diagram of example components of a device300. Device300may correspond to host device205, network device210, security platform215, and/or computing resource217. In some implementations, host device205, network device210, security platform215, and/or computing resource217may include one or more devices300and/or one or more components of device300. As shown inFIG. 3, device300may include a bus310, a processor320, a memory330, a storage component340, an input component350, an output component360, and a communication interface370.

FIG. 4is a flow chart of an example process400for providing attribute information, associated with a host device, based on classifying the host device as an infected device or a suspicious device. In some implementations, one or more process blocks ofFIG. 4may be performed by security platform215. In some implementations, one or more process blocks ofFIG. 4may be performed by another device or a group of devices separate from or including security platform215, such as network device210.

As shown inFIG. 4, process400may include determining threat information associated with a host device (block410). For example, security platform215may determine threat information associated with host device205.

The threat information may include information associated with one more threat events detected in association with an activity of host device205. A threat event may include, for example, an event such as an instance of malware being downloaded by host device205, an instance of host device205accessing or attempting to access a server known to be malicious, an instance of host device205exhibiting behavior indicative of being infected, or the like.

In some implementations, the threat information may include information that identifies one or more attributes of host device205, such as a dynamic attribute, a static attribute, a semi-static attribute, and/or the like. For example, the one or more attributes may include an IP address of host device205, a hostname of host device205, a MAC address associated with host device205, a username, a LDAP username associated with host device205, a single sign-on username associated with host device205, or the like.

Additionally, the threat information may include information associated with the threat event, such as a timestamp associated with the threat event, a hash value of a downloaded file that triggered the threat event, a score or a metric associated with the threat event (e.g., a malware score of a downloaded file), information that identifies a name of the threat event, information that identifies a type of the threat event, a description of the threat event, and/or the like.

In some implementations, security platform215may determine the threat information based on information provided by network device210and/or security device225. For example, network device210and/or security device225may be configured to detect one or more threat events, and may detect, based on the configuration, a threat event associated with host device205(e.g., when host device205is communicating with another device). Here, network device210and/or security device225may provide, to security platform215, the threat information associated with the detected threat event, and security platform215may determine the threat information accordingly.

In some implementations, security platform215may automatically determine the threat information (e.g., when network device210provides the threat information upon detecting the threat event). Thus, in some implementations, security platform215may determine the threat information in real-time or near real-time. Additionally, or alternatively, security platform215may determine the threat information based on sending (e.g., based on user input, automatically on a periodic basis, and/or the like) a request to network device210to provide the threat information, and may determine the threat information based on a response to the request. In some implementations, security platform215may store the threat information (e.g., for analysis at a later time, as described below).

In some implementations, security platform215may assign the threat information to a host identifier (e.g., an identification number, a name, and/or the like) based on the attribute information. For example, security platform215may manage a list of host identifiers, associated with host devices205of the network, where each host identifier is defined by at least one attribute (e.g., included in attribute information received as a result of a threat event). Here, security platform215may identify a particular host identifier based on the attribute information (e.g., when an IP address in the attribute information matches an IP address associated with the particular host identifier, when a MAC address in the attribute information matches a MAC address associated with the particular host identifier, and/or the like), and assign the threat information to the particular host identifier. Alternatively, security platform215may determine that no host identifier exists for the attribute, and may create a new host identifier and associate the attribute information with the new host identifier. In this way, security platform215may store threat information associated with one more threat events for each host identifier (i.e., each set of attributes).

As further shown inFIG. 4, process400may include classifying, based on the threat information, the host device as an infected device or a suspicious device (block420). For example, security platform215may classify, based on the threat information, that host device205as an infected device or a suspicious device.

An infected device may include a host device205that is to be blocked from communicating with other devices (e.g., other host devices205, a server, a network device, or the like) due to being identified as a threat to other devices. For example, host device205may be determined to be an infected device when security platform215determines that host device205has been infected with malware. Here, security platform215may block the infected host device205from communicating with the other devices in order to prevent the infection from spreading to the other devices.

A suspicious device may include a host device205that is permitted to continue communicating with other devices, but that is to be monitored due to engaging in suspicious activity. For example, host device205may be determined to be a suspicious device when security platform215determines that host device205has accessed or attempted to access a server that is known to be malicious. Here, security platform215may monitor the suspicious host device205for further suspicious and/or malicious activity in order to allow for another classification of the suspicious host device205.

In some implementations, security platform215may classify host device205as being an infected device or a suspicious device based on the threat information. For example, security platform215may be configured with a threat assessment algorithm that receives, as input, the threat information associated with host device205, and provides, as an output, a classification of host device205as an infected device or a suspicious device.

In some implementations, the threat assessment algorithm may include a model trained based on historical threat information (i.e., threat information received at an earlier time). For example, security platform215may train the model based on a machine learning algorithm, an artificial intelligence method, or the like. The model may be trained based on a training set of historical threat information and information indicating whether host devices205, associated with the historical threat information, were infected or suspicious, and may identify relationships between the historical threat information and the information indicating whether the associated host devices205were infected or suspicious. Based on the relationships, and based on the threat information, security platform215may classify host device205as an infected device or a suspicious device. In this way, security platform215trains a predictive model to classify host device205based on threat information, which enables security platform215identify and block infected devices, and monitor suspicious devices, thereby improving network security.

Additionally, or alternatively, security platform215may classify host device205as an infected device or a suspicious device based on a threat threshold configured on security platform215. For example, in some implementations, security platform215may determine (e.g., as an output of a threat assessment algorithm) a threat score associated with host device205, such as a numerical value (e.g., from 1 to 10), a letter grade (e.g., from A to F), a color level (e.g., red, yellow, or green), or the like. Here, security platform215may compare the threat score to one or more threat thresholds, accessible by security platform215, and classify host device205as an infected device or a suspicious device based on the comparison. For example, if the threat score satisfies a first threat threshold (e.g., when the threat score is greater than or equal to the first threat threshold), then security platform215may classify host device205as an infected device. Similarly, if the threat score does not satisfy the first threat threshold (e.g., when the threat score is less than the threat threshold), but satisfies a second threat threshold, then security platform215may classify host device205as a suspicious device. Similarly, if the threat score does not satisfy the second threat threshold, then security platform215may classify host device205as a clean device (e.g., a device that is not infected or suspicious).

In some implementations, security platform215may classify host device205based on threat information associated with one or more threat scores (e.g., threat scores associated with one or more threat events). For example, security platform215may classify host device205based on a sum of the one or more threat scores, an average of the one or more threat scores, a weighted average of the one or more threat scores, a median of the one or more threat scores, or the like. In some implementations, security platform215may determine a confidence metric that indicates a confidence level associated with classifying the host device205as an infected device or a suspicious device.

In some implementations, security platform215may classify host device205as an infected device or a suspicious device in another manner, such as based on information provided by one or more other devices (e.g., when network device210is configured to determine a threat score, when security device225is configured to determine a threat score, etc.).

In some implementations, when security platform215classifies host device205as an infected device, security platform215may implement a blocking technique based on an attribute of host device205in order to prevent host device205from communicating with other devices.

As further shown inFIG. 4, process400may include providing attribute information, associated with the host device, based on classifying the host device as an infected device or a suspicious device (block430). For example, security platform215may provide the attribute information, associated with host device205, based on classifying host device205as an infected device or a suspicious device.

In some implementations, security platform215may provide the attribute information, associated with host device205, in order to provide one or more other security services (e.g., hosted by one or more security devices225, security platform215, cloud computing environment220, network device210, or the like) with access to the attribute information of host device205(e.g., such that the one or more security services may be informed regarding the status of host device205as being infected or suspicious).

In some implementations, the attribute information may include information that identifies one or more attributes of multiple host devices205that have been classified as infected or suspicious. For example, security platform215may provide the attribute information as a feed including a list of attributes associated with host devices205classified as infected or suspicious, and the one or more security services may subscribe to receive the feed. In some implementations, security platform215may update the feed with updated and/or additional attribute information (e.g., when security platform215classifies another host device205as infected or malicious based on additional threat information).

In some implementations, security platform215may (e.g., automatically) provide the attribute information when security platform215classifies host device205as an infected device or a suspicious device (e.g., in real-time or near real-time). For example, security platform215may update a feed including a list of attributes, as described above. Additionally, or alternatively, security platform215may provide the attribute information based on a request provided by a security service. In some implementations, the security service may access the attribute information via an application program interface (API) associated with security platform215.

FIG. 5is a flow chart of an example process500for aggregating threat information, associated with a host device, based on at least two host identifiers associated with the host device, and classifying the host device based on the aggregated threat information. In some implementations, one or more process blocks ofFIG. 5may be performed by security platform215. In some implementations, one or more process blocks ofFIG. 5may be performed by another device or a group of devices separate from or including security platform215, such as network device210.

As shown inFIG. 5, process500may include determining mapped attribute information associated with a group of host identifiers (block510). For example, security platform215may determine mapped attribute information associated with a group of host identifiers.

In some implementations, the mapped attribute information may include information that identifies two or more related attributes. For example, the mapped attribute information may include information that identifies a first attribute (e.g., an IP address) and a second attribute (e.g., a MAC address) related to the first attribute. As another example, the mapped attribute information may include information that identifies a first attribute (e.g., a first IP address), a second attribute (e.g., a hostname), and a third attribute (e.g., a MAC address) related to the first and second attributes.

In some implementations, security platform215may determine the mapped attribute information based on information provided by one or more security services. For example, a security service (e.g., subscribed to receive the attribute information feed provided by security platform215, as described above) may receive the attribute information provided by security platform215. The security service may, during provisioning of a security service, monitor, receive, obtain, and/or determine information associated with attributes of host device205, and determine the mapped attribute information based on the information determined during the provisioning of the security service and the attribute information provided by security platform215.

For example, the security service may receive attribute information, provided by security platform215as described above, that includes an IP address. Here, the security service may determine, during provisioning of the security service, a MAC address that is related to (e.g., is associated with a same host device205) the IP address. In this example, the mapped attribute information includes information that identifies the IP address and the MAC address associated with the IP address. The security service may provide the mapped attribute information to security platform215.

In some implementations, security platform215may determine the mapped attribute information based on requesting the mapped attribute information. For example, security platform215may send (e.g., automatically on a periodic basis, based on user input), to one or more security services, a request to provide any mapped attribute information that corresponds to any attribute included in the attribute information feed, and may determine the mapped attribute information based on a response to the request. Additionally, or alternatively, security platform215may automatically determine the mapped attribute information (e.g., when a security service is configured to provide mapped attribute information for attributes include in the attribute feed automatically).

In this way, when a particular host device205is associated with a different instances of an attribute (e.g., when host device205has been assigned multiple IP addresses over a period of time), security platform215may determine mapped attribute information that identifies one more other attributes (e.g., a MAC address) related to (i.e., that map to) the attribute.

As further shown inFIG. 5, process500may include determining, based on the mapped attribute information, that at least two host identifiers are associated with a same host device (block520). For example, security platform215may determine, based on the mapped attribute information, that at least two host identifiers are associated with a same host device205.

In some implementations, security platform215may determine that at least two host identifiers are associated with a same host device205based on the mapped attribute information and the host identifiers managed by security platform215. For example, security platform215may determine that a same host device205is associated with two host identifiers when the mapped attribute information indicates that a first attribute (e.g., a first IP address), associated with a first host identifier, is associated with a second attribute (e.g., a particular MAC address), and that a third attribute (e.g., a second IP address), associated with a second host identifier, is also associated with the second attribute.

As another example, security platform215may determine that a same host device205is associated with three host identifiers when the mapped attribute information indicates that a first attribute (e.g., a first IP address), associated with a first host identifier, is associated with a second attribute (e.g., a particular MAC address), that a third attribute (e.g., a second IP address), associated with a second host identifier, is associated with the second attribute, and that a fourth attribute (e.g., a hostname), associated with a third host identifier, is associated with the second attribute.

As another example, security platform215may determine that a same host device205is associated with two host identifiers when the mapped attribute information indicates that a first attribute (e.g., an IP address), associated with a first host identifier, is associated with a second attribute (e.g., a particular MAC address), and that a third attribute (e.g., a hostname), associated with a second host identifier, is also associated with the second attribute.

As yet another example, security platform215may determine that a same host device205is associated with two host identifiers when the mapped attribute information indicates that a first attribute (e.g., a first IP address), associated with a first host identifier, is associated with a second attribute (e.g., an LDAP username), that the second attribute is associated with a third attribute (e.g., a MAC address), and that a fourth attribute (e.g., a second IP address), associated with a second host identifier, is associated with the third attribute.

In some implementations, security platform215may generate an attribute match score, associated with at least two host identifiers, that indicates a probability or likelihood that the at least two host identifiers are associated with a same host device205. The attribute match score may include, for example, a numerical value, a percentage, a letter grade, a color level, or the like. In some implementations, the attribute match score may be determined based on a number and/or type of attributes used to determine that the at least two host identifiers are associated with a same host device205(e.g., where the score increases as the number of matched attributes increases). In some implementations, the attribute match score be weighted to favor a particular attribute. For example, generation of the attribute match score may be weighted to favor an attribute match associated with an attribute that is typically static or semi-static, such as a MAC address match associated with the at least two host identifiers (e.g., when matching MAC addresses may be more indicative of association with a same host device205than another attribute, such as a single sign-on username).

Conversely, generation of the attribute match score may be weighted to disfavor (e.g., provide comparatively less weight or no weight) an attribute match associated with an attribute that is relatively dynamic, such as an IP address match associated with the at least two host identifiers (e.g., when matching IP addresses may be less indicative of association with a same host device205than another attribute, such as a MAC address). In this case, security platform215may be configured to require one or more additional attribute matches (e.g., at least two attribute matches, a particular combination of attribute matches, and/or the like) in order to boost the attribute match score before determining that the at least two host identifiers are associated with a same host device205.

In some implementations, security platform215may determine that host device205is associated with at least two host identifiers based on an attribute threshold configured on security platform215. For example, in some implementations, security platform215may determine an attribute match score for attributes associated with at least two host identifiers. Here, security platform215may compare the attribute match score to an attribute match threshold, accessible by security platform215, and determine that host device205is associated with the at least two host identifiers based on the comparison. For example, if the attribute match score satisfies the attribute match threshold (e.g., when the attribute match score is greater than or equal to the attribute match threshold), then security platform215may determine that host device205is associated with the at least two host identifiers associated with the attribute match score. Conversely, if the attribute match score does not satisfy the attribute match threshold (e.g., when the attribute match score is less than the attribute match threshold), then security platform215may determine that host device205is not associated with the at least two host identifiers associated with that attribute match score.

In some implementations, security platform215may determine a confidence metric (e.g., percentage from 0% to 100%, a probability, or the like) that indicates a confidence level associated with the determining of whether host device205is associated with at least two host identifiers. In some implementations, the confidence metric may be based on a number of attributes used to determine that the at least two host identifiers are associated with a same host device205, a type of attribute used to determine that the at least two host identifiers are associated with a same host device205, and/or the like.

As further shown inFIG. 5, process500may include aggregating threat information, associated with the host device, based on the at least two host identifiers (block530). For example, security platform215may aggregate threat information, associated with host device205, based on the at least two host identifiers.

In some implementations, security platform215may aggregate the threat information based on threat information stored or accessible by security platform215. For example, as described above, upon classifying host device205as an infected device or suspicious device, security platform215may store threat information, associated with host device205, such that the threat information is associated with a host identifier. In this example, security platform215may determine threat information, corresponding to the at least two host identifiers, based on the threat information stored or accessible by security platform215(e.g., by searching the stored threat information for entries corresponding to the at least two host identifiers). In some implementations, the aggregated threat information may include threat information associated with at least two (e.g., 2, 10, 100, or the like) host identifiers. In some implementations, security platform215may aggregate the threat information under a single host identifier by, for example, associating the threat information with one host identifier of the at least two host identifiers (e.g., rather than continuing to associate threat information with different host identifiers).

In some implementations, security platform215may (e.g., automatically) aggregate the threat information based on determining that host device205is associated with the at least two host identifiers. Additionally, or alternatively, security platform215may aggregate the threat information based on user input and/or based on information provided by another device (e.g., network device210).

As further shown inFIG. 5, process500may include classifying the host device based on the aggregated threat information (block540). For example, security platform215may classify host device205based on the aggregated threat information.

In some implementations, security platform215may classify host device205in a manner similar to that described above with regard toFIG. 4. In some implementations, based on the aggregated threat information, the classification of host device205as infected or suspicious may be improved (e.g., as compared to a classification based on threat information associated with a single threat event and/or a single instance of an attribute), thereby improving network security.

Additionally, or alternatively, security platform215may deprioritize one or more attributes associated with at least one of the at least two host identifiers. For example, if security platform215classifies host device205as an infected device, then security platform215may be configured to initiate or continue blocking associated with host device205. In this example, security platform215may identify an IP address that is currently assigned to host device205, and may deprioritize (i.e., cease blocking or refrain from blocking) one or more IP addresses that were previously assigned to host device205. In this way, security platform215may prevent communications of other host devices205(e.g., host devices205assigned the one or more IP addresses at a later time) from being improperly blocked.

In some implementations, security platform215may perform an action based on aggregating the threat information. For example, security platform215may classify the host device based on the aggregated threat information, as described above. As another example, security platform215may (e.g., automatically, periodically, based on user input, and/or the like) report the aggregated threat information (e.g., provide a report including the aggregated threat information to, for example, a network administrator), provide the aggregated threat information for display to a user, store the aggregated threat information in a database, and/or the like.

Implementations described herein provide a security platform capable of aggregating threat information, associated with a host device, even when the host device has one or more attributes that have or can be changed. In some implementations, the security platform may aggregate the threat information based on mapped attribute information, associated with the host device, that identifies an association between at least two attributes of the host device.

In some implementations, based on the aggregated threat information, the security platform may perform an improved classification of the host device as infected or suspicious (e.g., as compared to a classification based on threat information associated with a single instance of an attribute and/or threat information associated with a single threat event), thereby improving network security. Additionally, or alternatively, the security platform may deprioritize (i.e., cease blocking) one or more attributes previously associated with the host device, thereby preventing communications of other host devices from being improperly blocked.