METHOD AND APPARATUS FOR IDENTIFYING AND CHARACTERIZING ERRANT ELECTRONIC FILES

• US 20100293621A1
• Filed: 07/12/2010
• Published: 11/18/2010
• Est. Priority Date: 04/30/1999
• Status: Active Grant

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: Hoshiko LLC (Raoul Management LLC)
• Inventors: Shuster, Gary Stephen
• Granted Patent: US 8,261,366 B2
• Time in Patent Office: Days
• US Class Current: 726/30
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/148 File search processing
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

A computer system includes a server having a memory connected thereto. The server is adapted to be connected to a network to permit remote storage and retrieval of data files from the memory. A file identification application is operative with the server to identify errant files stored in the memory. The file identification application provides the functions of: (1) selecting a file stored in said memory; (2) generating a unique checksum corresponding to the stored fire; (3) comparing said unique checksum to each of a plurality of previously generated checksums, wherein the plurality of previously generated checksums correspond to known errant files; and (4) marking the file for deletion from the memory if the unique checksum matches one of the plurality of previously generated checksums.

Claims

1. A computer implemented method for identifying and characterizing stored electronic files, the method comprising:

under control of one or more configured computer systems;

selecting a file from a computer storage medium;

generating a checksum associated with the selected file according to at least one of;

generating the checksum for graphics files based on vector graphics analysis;

or

dividing a graphical image file into blocks and comparing relationships between the blocks;

comparing the checksum associated with the selected file to one or more checksums associated with one or more of a plurality of unauthorized files;

determining that the checksum associated with the selected file matches one of the plurality of checksums associated with the unauthorized files; and

characterizing the file as an unauthorized file.

2. The computer-implemented method of claim 1, wherein generating the checksum for graphics files based on vector graphics analysis comprises reducing a graphics file to its vector graphics components.

3. The computer-implemented method of claim 2, wherein the reduced graphics file is employed for generation of the checksum.

4. The computer-implemented method of claim 1, further comprising comparing the relationships between the zones into which the image is divided.

5. The computer-implemented method of claim 4, wherein comparing the relationships between the zones comprises comparing the relative ratios of selected colors within the zones.

6. The computer-implemented method of claim 1, wherein dividing the graphical image into blocks comprises dividing the graphical image into quadrants.

7. A computer system, comprising:

a server having a memory connected thereto, the server being adapted to be connected to a network to permit remote storage and retrieval of data files from the memory; and

a file identification application operative with the server to identify unauthorized files stored in the memory, the file identification application providing the functions of;

selecting a file from a computer storage medium;

generating a checksum associated with the selected file according to at least one of;

generating the checksum for graphics files based on vector graphics analysis;

or

dividing a graphical image file into blocks and comparing relationships between the blocks;

comparing the checksum associated with the selected file to at least one checksum associated with one or more of a plurality of unauthorized files;

determining that the checksum associated with the selected file matches one of the plurality of checksums associated with the unauthorized files; and

characterizing the file as an unauthorized file.

8. The system of claim 7, wherein generating the checksum for graphics files based on vector graphics analysis comprises reducing a graphics file to its vector graphics components.

9. The system of claim 8, wherein the reduced graphics file is employed for generation of the checksum.

10. The system of claim 7, further comprising comparing the relationships between the zones into which the image is divided.

11. The system of claim 10, wherein comparing the relationships between the zones comprises comparing the relative ratios of selected colors within the zones.

12. The system of claim 7, wherein dividing the graphical image into blocks comprises dividing the graphical image into quadrants.

13. A tangible computer-readable storage medium having instructions stored thereon, the instructions comprising:

instructions for selecting a file from a plurality of files stored in a computer storage medium, wherein selecting the file is performed according to at least one of;

instructions for selecting the file based on the size of the file by determining whether an aggregate size of plural identically-sized files exceeds a predetermined threshold;

instructions for selecting the file based on whether content of the file matches a file type indicated by a name of the file;

or

instructions for selecting the file based upon whether the file comprises data beyond an end of data marker for the file; and

instructions for categorizing the selected file as an unauthorized file based on a comparison of an identification value associated with the selected file with one or more identification values associated with one or more of a plurality of unauthorized files.

14. A computer-implemented method for identifying and characterizing stored electronic files, the method comprising:

under control of one or more configured computer systems;

selecting a file from a plurality of files stored in a computer storage medium, wherein selecting the file is performed according to at least one of;

selecting the file based upon an determination that the filename of the selected file is shared by at least one other file within the plurality of files;

selecting the file based upon a determination that the filename of the selected file contains a suspect tag;

selecting the file based upon a determination that the file is not linked to an HTML file within the same directory as the file stored in the computer storage medium;

or

selecting the file based upon a determination that the selected file contains a hypertext link to a suspect site;

generating an identification value associated with the selected file, wherein the identification value is representative of at least a portion of the content of the file;

comparing the generated identification value to one or more identification values associated with respective unauthorized files;

determining that the identification value matches one of the plurality of identification values associated with the unauthorized files; and

characterizing the file as an unauthorized file.

15. The computer-implemented method of claim 14, wherein the filename of the selected file is determined to be shared by the at least one other file if the filename of the selected file is identical to a filename of the at least one other file.

16. The computer-implemented method of claim 14, wherein determining that the filename of the selected file is be shared by the at least one other file comprises identifying that the filename of the selected file is identical to a filename of the at least one other file after deletion of all numbers from each of the respective filenames.

17. The computer-implemented method of claim 14, wherein determining that the filename of the selected file is determined to be shared by the at least one other file comprises identifying that the filename of the selected file is identical to a filename of the at least one other file after deletion of one or more selected alpha-numeric strings from each of the respective filenames.

18. The computer-implemented method of claim 14, wherein determining that the filename of the selected file is determined to be shared by the at least one other file comprises identifying that the filename of the selected file differs from the at least one other file by no more than a selected number of characters.

19. The computer-implemented method of claim 14, further comprising obtaining predetermined suspect tags.

20. The computer-implemented method of claim 19, wherein the suspect tags are obtained from one or more of Internet newsgroups and Web sites.