Dynamically Computing Reputation Scores for Objects

• US 20090007102A1
• Filed: 06/29/2007
• Published: 01/01/2009
• Est. Priority Date: 06/29/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Dadhia, Rajesh K., Field, Scott A.
• Granted Patent: US 8,584,094 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

Tools and techniques for dynamically computing reputation scores for objects are described herein. The tools may provide machine-readable storage media containing machine-readable instructions for receiving requests to dynamically compute reputation scores for the objects, for instantiating protected virtual environments in which to execute the objects, and for computing the reputation score based on how the object behaves when executing within the virtual environment.

Claims

1. At least one machine-readable storage medium comprising machine-readable instructions that, when executed by the machine, cause the machine to perform a method comprising:

receiving at least one request to dynamically compute a reputation score for at least one object; and

instantiating a protected virtual environment in which to execute the object; and

computing the reputation score for the object based on behavior of the object when executing within the virtual environment.

2. The machine-readable storage medium of claim 1, further comprising instructions for providing the reputation score to a requesting device.

3. A server for computing dynamic reputation score information for at least one object, comprising at least the machine-readable storage medium of claim 1.

4. A standalone device for computing dynamic reputation score information for at least one object, comprising at least the machine-readable storage medium of claim 1.

5. The machine-readable storage medium of claim 1, further comprising instructions for receiving a request to access the object, and further comprising instructions for generating the request to dynamically compute the reputation score for the object.

6. The machine-readable storage medium of claim 1, wherein the instructions for instantiating a protected virtual environment include instructions for instantiating a virtual machine associated with a physical machine.

7. The machine-readable storage medium of claim 1, further comprising instructions for determining whether to grant access to the object based on the reputation score of the object.

8. The machine-readable storage medium of claim 1, further comprising instructions for caching the reputation score.

9. The machine-readable storage medium of claim 1, further comprising instructions for searching a cache for a previously-computed reputation score for the object.

10. The machine-readable storage medium of claim 1, further comprising instructions for capturing an initial state of the virtual environment, before the object is executed in the virtual environment.

11. The machine-readable storage medium of claim 1, further comprising instructions for executing the object within the virtual environment.

12. The machine-readable storage medium of claim 1, further comprising instructions for inspecting at least one state of the virtual environment while the object is executing within the virtual environment.

13. The machine-readable storage medium of claim 1, further comprising instructions for checking for any unexpected behavior of the object when executing within the virtual environment.

14. The machine-readable storage medium of claim 13, wherein the instructions for checking for any unexpected behavior include instructions for analyzing at least one persistent storage location associated with the virtual environment.

15. The machine-readable storage medium of claim 13, wherein the instructions for checking for any unexpected behavior include instructions for analyzing at least one volatile storage location associated with the virtual environment.

16. The machine-readable storage medium of claim 13, wherein the instructions for checking for any unexpected behavior include instructions for searching the virtual environment for at least one malware signature resulting from executing the object.

17. The machine-readable storage medium of claim 13, wherein the instructions for checking for any unexpected behavior include instructions for searching the virtual environment for at least one network access resulting from executing the object.

18. The machine-readable storage medium of claim 13, wherein the instructions for checking for any unexpected behavior include instructions for searching the virtual environment for at least one installed file resulting from executing the object.

19. A system comprising:

at least one client device;

a server coupled to communicate with the at least one client device;

wherein the client device includes a client-side reputation module for requesting that the server compute the reputation score for the object; and

wherein the server includes a server-side reputation computation module for receiving the request from the client device, for instantiating a protected virtual environment in which to execute the object, and for dynamically computing the reputation score for the object based on behavior of the object when executing within the virtual environment.

20. The system of claim 19, wherein the client device includes a module for determining whether to grant access to the object based on the reputation score.