Patent ID: 8214497

Claim:
A computer implemented method operable to assign a reputation to a communications entity associated with a received communication, the method comprising: dispersing a plurality of agents within a widely distributed network, each of the agents being associated with a respective security device operable to protect an associated network from communications that violate a policy associated with the associated network; collecting data associated with communications from a plurality of entities originating communications, the plurality of entities including a reputable entity with a reputable reputation, a non-reputable entity with a non-reputable reputation and an unknown entity with an unknown reputation, wherein collecting data comprises using the plurality of agents to collect data associated with the communications; aggregating the collected data; analyzing the aggregated data to identify attributes respectively associated with the communications from the plurality of entities; correlating the attributes to identify relationships between each of the plurality of entities, each identified relationship between entities is associated with a strength based on similarities between the attributes of communications from the entities; attributing, by one or more data processors, a portion of reputable qualities from the reputable entity to the reputation of the unknown entity based on the strength of the relationship between the reputable entity and the unknown entity; attributing, by the one or more data processors, a portion of non-reputable qualities from the non-reputable entity to the reputation of the unknown entity based on the strength of the relationship between the non-reputable entity and the unknown entity; updating the reputation of the unknown entity based upon the portion of reputable qualities attributed to the unknown entity from the reputable entity and the portion of non-reputable qualities attributed to the unknown entity from the non-reputable entity, wherein the reputation of the unknown entity comprises indications of a reputation of the unknown entity in a plurality of categories representing types of activity in which the unknown entity or related entities have engaged; and communicating data specifying the updated reputation information of the unknown entity to one or more of the plurality of agents.