Patent ID: 8381289

Claim:
A computer system for generating a host reputation score for a host connected to a network, the computer system comprising: a memory; a processor; a reporting module stored on the memory and executable by the processor to: receive information identifying a plurality of hosts connected to the network and information describing communications between a plurality of entities executing on a plurality of clients and the plurality of hosts; receive information identifying one or more of the plurality of entities executing on the plurality of clients as malware threats; and provide generated host reputation scores to the plurality of clients; and a host reputation module stored on the memory and executable by the processor to: identify malware entities executing on the plurality of clients that communicate with the host based at least on the information identifying the plurality of hosts, the information describing communications between the plurality of entities executing on the plurality of clients and the plurality of hosts, and the information identifying one or more of the plurality of entities as malware threats; determine a number of the malware entities executing on the plurality of clients that communicate with the host; and generate the host reputation score for the host based at least on the number of the malware entities executing on the plurality of clients that communicate with the host wherein the host reputation score for the host indicates a likelihood that the host is malicious.