Patent Document ID: 9667647
Application ID: 14644575
Patent Status: 1

Claim One:
1. A method comprising: maintaining, by a monitoring unit executing on a network security device protecting a private network, a plurality of policies in a form of rules, wherein each policy of the plurality of policies is configurable by a network administrator of the private network via a browser-based interface provided by the monitoring unit and specifies (i) a perceived risky activity of a plurality of perceived risky activities potentially indicative of malware activity and (ii) a corresponding score, wherein the plurality of perceived risky activities include bad connection attempts, interactions with a hosts in particular geographic locations external to the private network, interactions with undesired websites external to the private network and failed Domain Name Server (DNS) resolution requests; observing, by the monitoring unit, activities relating to a plurality of monitored devices within the private network; for each of the observed activities, assigning, by the monitoring unit, a score to the observed activity based upon a matching policy of the plurality of polices; for each of the plurality of monitored devices, maintaining, by the monitoring unit, a current reputation score for the monitored device based upon the score and a historical score associated with the monitored device; and classifying, by the monitoring unit, a monitored device of the plurality of monitored devices as potentially being a malicious resource based upon the current reputation score for the monitored device.