Benign file list generation

• US 10,642,977 B1
• Filed: 12/17/2018
• Issued: 05/05/2020
• Est. Priority Date: 12/17/2018
• Status: Active Grant

• Current Assignee: Beijing Didi Infinity Technology And Development Co.Ltd.
• Original Assignee: DiDi Research America, LLC
• Inventors: Ren, Liwei, Wang, Qiaoyue
• Primary Examiner(s): Zee, Edward
• Application Number:
  US16/221,799
• Time in Patent Office: 505 Days
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system

Abstract

Exception lists may be generated by combining a standard list and a client list. Standard benign file information identifying a set of standard benign files may be obtained. A set of standard signatures for the set of standard benign files may be obtained. Client benign file information identifying a set of client benign files for a client may be obtained. A set of client signatures for the set of client benign files for the client may be obtained. A client exception list for the client may be generated based on the set of standard signatures and the set of client signatures.

Claims

1. A system for generating a list of benign files, comprising one or more processors and one or more non-transitory computer-readable memories coupled to the one or more processors and configured with instructions executable by the one or more processors to cause the system to perform operations comprising:

obtaining standard benign file information identifying a set of standard benign files;

obtaining a set of standard signatures for the set of standard benign files;

adding the standard benign file information to global benign file information identifying a set of global benign files, wherein the global benign file information is associated with a set of global signatures;

obtaining first client benign file information identifying a first set of client benign files for a first client;

determining, for one client benign file of the first set of client benign files, whether the global benign file information identifies the one client benign file;

adding, in response to determining that the global benign file information does not identify the one client benign file, a new signature corresponding to the one client benign file to the set of global signatures;

modifying the global benign file information to associate the one client benign file with an identifier of the first client;

obtaining a set of first client signatures for the first set of client benign files for the first client; and

generating a first client exception list for the first client based on the set of standard signatures and the set of first client signatures.

2. The system of claim 1, wherein obtaining the standard benign file information includes obtaining the standard benign file information from an organization that creates security standards.

3. The system of claim 1, wherein at least one signature in the first client exception list is determined based on core information extracted from a corresponding file, wherein the core information extracted from the corresponding file matches core information extracted from a similar file.

4. The system of claim 1, the operations further comprising:

obtaining second client benign file information identifying a second set of client benign files for a second client;

obtaining a set of second client signatures for the second set of client benign files for the second client; and

generating a second client exception list for the second client based on the set of standard signatures and the set of second client signatures.

5. The system of claim 1, wherein the set of first client signatures is obtained based on the set of global signatures and the identifier of the first client.

6. The system of claim 1, the operations further comprising:

obtaining a malware list based on a set of signatures for a set of malware files;

receiving, for a signature contained in both the malware list and the first client exception list, a selection to remove the signature from either the malware list or the first client exception list; and

removing the signature based on the selection.

7. The system of claim 1, the operations further comprising:

providing the first client exception list to the first client.

8. A method for generating a list of benign files, the method comprising:

obtaining standard benign file information identifying a set of standard benign files;

obtaining a set of standard signatures for the set of standard benign files;

adding the standard benign file information to global benign file information identifying a set of global benign files, wherein the global benign file information is associated with a set of global signatures;

obtaining first client benign file information identifying a first set of client benign files for a first client;

determining, for one client benign file of the first set of client benign files, whether the global benign file information identifies the one client benign file;

adding, in response to determining that the global benign file information does not identify the one client benign file, a new signature corresponding to the one client benign file to the set of global signatures;

modifying the global benign file information to associate the one client benign file with an identifier of the first client;

obtaining a set of first client signatures for the first set of client benign files for the first client; and

generating a first client exception list for the first client based on the set of standard signatures and the set of first client signatures.

9. The method of claim 8, wherein obtaining the standard benign file information includes obtaining the standard benign file information from an organization that creates security standards.

10. The method of claim 8, wherein at least one signature in the first client exception list is determined based on core information extracted from a corresponding file, wherein the core information extracted from the corresponding file matches core information extracted from a similar file.

11. The method of claim 8, further comprising:

obtaining second client benign file information identifying a second set of client benign files for a second client;

obtaining a set of second client signatures for the second set of client benign files for the second client; and

generating a second client exception list for the second client based on the set of standard signatures and the set of second client signatures.

12. The method of claim 8, wherein the set of first client signatures is obtained based on the set of global signatures and the identifier of the first client.

13. The method of claim 8, further comprising:

obtaining a malware list based on a set of signatures for a set of malware files;

receiving, for a signature contained in both the malware list and the first client exception list, a selection to remove the signature from either the malware list or the first client exception list; and

removing the signature based on the selection.

14. The method of claim 8, further comprising:

providing the first client exception list to the first client.