Statistical analytic method for the determination of the risk posed by file based content

• US 10,360,388 B2
• Filed: 06/27/2017
• Issued: 07/23/2019
• Est. Priority Date: 11/26/2014
• Status: Active Grant

• Current Assignee: Glasswall (Ip) Limited
• Original Assignee: Glasswall (Ip) Limited
• Inventors: Hutton, Samuel Harrison
• Primary Examiner(s): Ho, Dao Q
• Application Number:
  US15/634,654
• Publication Number:
  US 20170293764A1
• Time in Patent Office: 756 Days
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A system and method for calculating a risk assessment for an electronic file is described. A database of checks, organized into categories, can be used to scan electronic files. The categories of checks can include weights assigned to them. An analyzer can analyze electronic files using the checks. Issues identified by the analyzer can be weighted using the weights to determine a risk assessment for the electronic file.

Claims

1. A system, comprising:

a computer;

a processor in the computer;

a memory in the computer;

a database stored in the memory, the database including;

a plurality of checks organized into a plurality of categories, each of the plurality of checks used to check whether an electronic file conforms to some purported file format for the electronic file and therefore is known to be good; and

for each of the plurality of categories, a weight assigned to the category, the weights assigned to the plurality of categories including default weights assigned to the plurality of categories;

a receiver to receive the electronic file and to receive second weights from a user to assign to the plurality of categories to override the default weights assigned to the plurality of categories;

the processor executing an analyzer to analyze the electronic file using the plurality of checks in the database; and

a threat calculator to calculate a risk assessment for the electronic file using a result from the analyzer and the weights assigned to the plurality of categories after the electronic file has been analyzed by the analyzer,

wherein the analyzer analyzes the electronic file and the threat calculator calculates the risk assessment for the electronic file whether or not the electronic file is known to be good.

2. The system according to claim 1, wherein:

the database further includes for each of the plurality of checks, a third weight assigned to the check; and

the threat calculator is operative to calculate the risk assessment for the electronic file using the result from the analyzer and the third weights assigned to the plurality of checks.

3. The system according to claim 1, wherein the receiver is operative to receive the weights assigned to the plurality of categories from the user.

4. The system according to claim 1, wherein:

the analyzer is operative to analyze a first corpus of files with known non-conformities to produce a first result and to analyze a second corpus of safe files to produce a second result; and

the system further comprises a statistical analyzer to statistically review the first result and the second result and to adjust the default weights assigned to the plurality of categories so that a first calculated risk assessment for the first corpus of files is higher than a second calculated risk assessment for the second corpus of files.

5. The system according to claim 1, further comprising a statistical analyzer to use the result from the analyzer adjust the weights.

6. The system according to claim 1, wherein the system is operative to deliver the electronic file to a second user based at least in part on the calculated risk assessment being greater than a pre-determined threshold.

7. The system according to claim 1, further comprising an electronic sandbox, the electronic file placed in the electronic sandbox based at least in part on the risk assessment for the file not exceeding a pre-determined threshold.

8. The system according to claim 7, wherein the system is operative to deliver the electronic file to a second user based at least in part on an observed operation of the electronic sand box indicating that the electronic file is not a threat.

9. A method, comprising:

receiving an electronic file;

analyzing the electronic file using a plurality of checks to determine whether the electronic file conforms to an expected format and therefore is known to be good, the plurality of checks organized into a plurality of categories, wherein the electronic file is analyzed using the plurality of checks whether or not the electronic file is known to be good;

determining a weight for each of the plurality of categories, including receiving a default weight to assign to each of the plurality of categories;

receiving second weights from a user to assign to the plurality of categories to override the default weights assigned to the plurality of categories; and

calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories after the electronic file has been analyzed by the analyzer, wherein the final risk assessment of the electronic file is calculated whether or not the electronic file is known to be good.

10. The method according to claim 9, wherein:

analyzing the electronic file using a plurality of checks to determine whether the electronic file conforms to an expected format includes analyzing the electronic file using a second plurality of checks from one of the plurality of categories;

determining a weight for each of the plurality of categories includes determining a third weight for each of the second plurality of checks from the one of the plurality of categories; and

calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories includes calculating the final risk assessment of the electronic file using the plurality of checks from the one of the plurality of categories and the third weights assigned to each of the plurality of checks.

11. The method according to claim 9, further comprising receiving the weight assigned to each of the plurality of categories from a user.

12. The method according to claim 9, wherein determining a weight for each of the plurality of categories further includes adjusting the default weight assigned to each of the plurality of categories according to instruction from a user.

13. The method according to claim 9, wherein receiving a default weight to assign to each of the plurality of categories includes:

receiving a first corpus of files with known non-conformities and a second corpus of safe files;

scanning the first corpus of files to produce a first result and the second corpus of files to produce a second result;

statistically analyzing the first result and the second result; and

using the analysis of the first result and the second result to adjust the default weight assigned to each of the plurality of categories so that a first calculated risk assessment for the first corpus of files is higher than a second calculated risk assessment for the second corpus of files.

14. The method according to claim 9, further comprising using the final risk assessment of the electronic file to adjust the weights assigned to each of the plurality of categories.

15. The method according to claim 9, wherein calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories includes:

calculating a threat score for the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories;

comparing the threat score with a threshold score; and

based at least in part on the threat score exceeding the threshold score;

determining that the electronic file is likely not a threat; and

delivering the electronic file to a user.

16. The method according to claim 15, wherein calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories further includes, based at least in part on the threat score not exceeding the threshold score, determining that the electronic file is likely a threat.

17. The method according to claim 16, wherein determining that the electronic file is likely a threat includes:

placing the electronic file in a sandbox;

detonating the electronic file in the sandbox; and

observing the operation of the sandbox after detonating the electronic file.

18. The method according to claim 17, wherein determining that the electronic file is likely a threat further includes, based at least in part on the observed operation of the sandbox indicating that the electronic file is not a threat, delivering the electronic file to the user.

19. A tangible non-transitory computer-readable medium storing instructions that, when executed by a machine, result in:

receiving an electronic file;

analyzing the electronic file using a plurality of checks to determine whether the electronic file conforms to an expected format and therefore is known to be good, the plurality of checks organized into a plurality of categories, wherein the electronic file is analyzed using the plurality of checks whether or not the electronic file is known to be good;

determining a weight for each of the plurality of categories, including receiving a default weight to assign to each of the plurality of categories;

receiving second weights from a user to assign to the plurality of categories to override the default weights assigned to the plurality of categories; and

calculating a final risk assessment of the electronic file using the plurality of categories and the weights assigned to each of the plurality of categories after the electronic file has been analyzed by the analyzer, wherein the final risk assessment of the electronic file is calculated whether or not the electronic file is known to be good.