Patent ID: 8561167

Claim:
A computer implemented method operable to assign a reputation to a web-based entity associated with a hypertext transfer protocol communication, comprising: receiving, at a local reputation engine, a hypertext transfer protocol communication at an edge protection device; identifying, at the local reputation engine, an entity associated with the received hypertext transfer protocol communication; querying, from the local reputation engine, a global reputation server using a query for a reputation indicator associated with the entity; receiving, at a local reputation engine, the reputation indicator from the global reputation server; and taking an action with respect to the hypertext transfer protocol communication based upon the received reputation indicator associated with the entity; wherein: a reputation of the entity is based upon previous communications received from the entity, the previous communications being previous communications of two or more of the following communication types: a hypertext transfer protocol communication, an instant message, a file transfer protocol communication, simple object access protocol messages, real-time transport protocol packages, a short message service communication, multimedia message service communication, or a voice over internet protocol communication; and wherein the reputation is determined from: collecting, at each of a plurality of other local reputation engines, the previous communications that are respectively received by the local reputation engine; determining, at each of the plurality of other local reputation engines, identifiers for each of the previous communications, each identifier for each previous communication identifying a sending entity associated with the previous communication, and sending entities include the entity associated with the received hypertext transfer protocol communication; determining, at each of the plurality of other local reputation engines, attributes for each of the previous communications, the attributes indicative of a reputation of the sending entity associated with a previous communication; determining, at each of the plurality of other local reputation engines, a local reputation of the sending entities from the identifiers and the attributes from the previous communications, wherein at least some of the reputations are based on the similarity of attributes associated with two or more identifiers; and aggregating the local reputations at the global reputation server to generate respective reputation indicators, each local reputation produced by an associated local reputation engine, and the local reputation weighted based on a confidence value associated with the respective local reputation engine, wherein the confidence value is based at least in part on historical performance data for the local reputation engine, the historical performance data comprising statistics based at least in part on numbers of entities incorrectly classified by the local reputation engine.