Individualized Time-to-Live for Reputation Scores of Computer Files

• US 20110067101A1
• Filed: 09/15/2009
• Published: 03/17/2011
• Est. Priority Date: 09/15/2009
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Wright, Adam, Hoagland, James, Seshadri, Vijay, Glick, Adam L., Ramzan, Zulfikar
• Granted Patent: US 8,800,030 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

An individualized time-to-live (TTL) is determined for a reputation score of a computer file. The TTL is determined based on the reputation score and the confidence in the reputation score. The confidence can be determined based on attributes such as the reputation score, an age of the file, and a prevalence of the file. The reputation score is used to determine whether the file is malicious during a validity period defined by the TTL, and discarded thereafter.

Claims

1. A computer-implemented method for generating an individualized time-to-live (TTL) for a reputation score of a file, comprising:

receiving a request from a client system, the request comprising an identifier of the file;

generating a reputation score of the file, the reputation score representing an assessment of a trustworthiness of the file;

determining a TTL for the reputation score based on the reputation score, the TTL describing a validity period for the reputation score; and

transmitting the reputation score and the TTL to the client system in response to the request.

2. The computer-implemented method of claim 1, further comprising:

determining a confidence score for the reputation score, the confidence score measuring a likelihood of the reputation score reflecting actual trustworthiness of the file, wherein determining the TTL for the reputation score further comprises determining the TTL based on the reputation score and the confidence score.

3. The computer-implemented method of claim 2, wherein a validity period described by a TTL for a reputation score associated with a high confidence score is longer than a validity period described by a TTL for a reputation score associated with a low confidence score.

4. The computer-implemented method of claim 2, wherein the confidence score for a reputation score on or near extreme ends of its spectrum is higher than the confidence score for a reputation score not at the extreme ends.

5. The computer-implemented method of claim 2, wherein determining the confidence score for the reputation score comprises:

determining an age of the file, wherein the confidence score for a reputation score associated with an old file is higher than the confidence score for a reputation score associated with a young file.

6. The computer-implemented method of claim 2, wherein determining the confidence score for the reputation score comprises:

determining a prevalence of the file among client systems, wherein the confidence score for a reputation score associated with a prevalent file is higher than the confidence score for a reputation score associated with a less prevalent file.

7. The computer-implemented method of claim 1, wherein the reputation score is utilized by the client system to determine whether the file is malicious during the validity period described by the TTL.

8. A computer system for generating an individualized time-to-live (TTL) for a reputation score of a file, comprising:

a computer-readable storage medium comprising executable computer program code for;

a communication module for receiving a request from a client system, the request comprising an identifier of the file;

a reputation score generation module for generating a reputation score of the file, the reputation score representing an assessment of a trustworthiness of the file; and

a TTL determination module for determining a TTL for the reputation score based on the reputation score, the TTL describing a validity period for the reputation score;

wherein the communication module is further configured for transmitting the reputation score and the TTL to the client system in response to the request.

9. The computer system of claim 8, further comprising:

a confidence determination module for determining a confidence score for the reputation score, the confidence score measuring a likelihood of the reputation score reflecting actual trustworthiness of the file, wherein determining the TTL for the reputation score further comprises determining the TTL based on the reputation score and the confidence score.

10. The computer system of claim 9, wherein a validity period described by a TTL for a reputation score associated with a high confidence score is longer than a validity period described by a TTL for a reputation score associated with a low confidence score.

11. The computer system of claim 9, wherein the confidence score for a reputation score on or near extreme ends of its spectrum is higher than the confidence score for a reputation score not at the extreme ends.

12. The computer system of claim 9, wherein determining the confidence score for the reputation score comprises:

determining an age of the file, wherein the confidence score for a reputation score associated with an old file is higher than the confidence score for a reputation score associated with a young file.

13. The computer system of claim 9, wherein determining the confidence score for the reputation score comprises:

determining a prevalence of the file among client systems, wherein the confidence score for a reputation score associated with a prevalent file is higher than the confidence score for a reputation score associated with a less prevalent file.

14. The computer system of claim 8, wherein the reputation score is utilized by the client system to determine whether the file is malicious during the validity period described by the TTL.

15. A computer-readable storage medium encoded with executable computer program code for generating an individualized time-to-live (TTL) for a reputation score of a file, the computer program code comprising program code for:

receiving a request from a client system, the request comprising an identifier of the file;

generating a reputation score of the file, the reputation score representing an assessment of a trustworthiness of the file;

determining a TTL for the reputation score based on the reputation score, the TTL describing a validity period for the reputation score; and

transmitting the reputation score and the TTL to the client system in response to the request.

16. The computer-readable storage medium of claim 15, wherein the computer program code further comprises program code for:

determining a confidence score for the reputation score, the confidence score measuring a likelihood of the reputation score reflecting actual trustworthiness of the file, wherein determining the TTL for the reputation score further comprises determining the TTL based on the reputation score and the confidence score.

17. The computer-readable storage medium of claim 16, wherein a validity period described by a TTL for a reputation score associated with a high confidence score is longer than a validity period described by a TTL for a reputation score associated with a low confidence score.

18. The computer-readable storage medium of claim 16, wherein the confidence score for a reputation score on or near extreme ends of its spectrum is higher than the confidence score for a reputation score not at the extreme ends.

19. The computer-readable storage medium of claim 16, wherein determining the confidence score for the reputation score comprises:

determining an age of the file, wherein the confidence score for a reputation score associated with an old file is higher than the confidence score for a reputation score associated with a young file.

20. The computer-readable storage medium of claim 16, wherein determining the confidence score for the reputation score comprises:

determining a prevalence of the file among client systems, wherein the confidence score for a reputation score associated with a prevalent file is higher than the confidence score for a reputation score associated with a less prevalent file.