REPUTATION CHECKING OBTAINED FILES

• US 20120066346A1
• Filed: 09/13/2010
• Published: 03/15/2012
• Est. Priority Date: 09/13/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Virmani, Ritika, Colvin, Ryan C., Haber, Elliott Jeb, Stevens, Warren G., Kim, Jane T., Holbrook, Jess S., Bowers, Sarah J., Scarrow, John L., McKune, Jeffrey R.
• Granted Patent: US 9,235,586 B2
• Time in Patent Office: Days
• US Class Current: 709/219
• CPC Class Codes: G06F 16/164 File meta data generation
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting

Abstract

A Web browser of a computing device downloads or otherwise obtains a file. File information identifying the file is obtained and is sent to a remote reputation service. Client information identifying aspects of the computing device can also optionally be sent to the remote reputation service. In response to the file information (and optionally client information), a reputation indication for the file is received from the remote reputation service. A user interface for the Web browser to present at the computing device is determined, based at least in part on the reputation indication, and presented at the computing device.

Claims

1. A method in a Web browser of a computing device, the method comprising:

obtaining a file;

obtaining, based on the file, information identifying the file;

sending the information identifying the file to a remote reputation service;

receiving, from the remote reputation service, a reputation indication for the file;

determining, based at least in part on the reputation indication, a user interface for the Web browser to present at the computing device; and

presenting the user interface for the Web browser at the computing device.

2. A method as recited in claim 1, wherein the reputation indication includes a rating indicating whether the file is a low risk for being malware or a high risk for being malware, and the determining comprises determining that the user interface includes no warnings regarding the file if the file is a low risk for being malware, and determining that the user interface includes one or more warnings regarding the file if the file is a high risk for being malware.

3. A method as recited in claim 1, wherein the determining comprises determining, based at least in part on the reputation indication, that the user interface is to include a warning indicating that the file is rarely downloaded from the Web by other users.

4. A method as recited in claim 1, wherein the determining comprises determining, based at least in part on the reputation indication, that the user interface is to include a warning indicating that a version of a program in the file has been unreliable for other users.

5. A method as recited in claim 4, wherein the determining further comprises determining, based at least in part on the reputation indication, that the user interface is to include a link to a newer version of a program in the file.

6. A method as recited in claim 1, wherein the determining comprises determining, based at least in part on the reputation indication, that the user interface is to include a warning specific to the file.

7. A method as recited in claim 1, further comprising:

receiving, from a user of the computing device, a user action in response to the user interface; and

sending an indication of the user action to the remote reputation service for subsequent use by the remote reputation server in determining subsequent reputation indications for the file or for other files.

8. A method as recited in claim 1, wherein the information identifying the file comprises a hash value generated by applying a hash function to the file, and a digital signature of the file generated by a publisher of the file.

9. A method as recited in claim 1, wherein the information identifying the file comprises:

a hash value generated by applying a hash function to the file;

a uniform resource locator (URL) from which the file was obtained;

an identifier of a version of the file;

an indication of whether metadata associated with the file includes a valid digital signature of the file, and the valid digital signature of the file if the metadata associated with the file includes the valid digital signature of the file;

an identifier of an antivirus program analyzing the file; and

an indication of whether the antivirus program indicated that the file was clean or infected.

10. A method as recited in claim 1, wherein the reputation indication comprises:

a rating for the file that identifies which of one or more user interface components, if any, are to be included in the user interface;

an indication of different types of programs for which the remote reputation service maintains reputation information; and

an indication of whether antivirus results from an antivirus program analyzing the file are to be provided to the remote reputation service for subsequently obtained files.

11. A method as recited in claim 1, wherein the reputation indication comprises a rating, and wherein the determining comprises determining one or more user interface components that are associated with the rating as user interface components that are to be included in the user interface.

12. A method as recited in claim 1, wherein the determining comprises determining that the user interface includes no warnings regarding the file.

13. A method as recited in claim 1, wherein the determining comprises determining that the user interface is to include an indication that the file includes malware and thus is being deleted, the method further comprising deleting the file.

14. One or more computer storage media having stored thereon multiple instructions that implement a module of a Web browser and that, when executed by one or more processors of a computing device, cause the one or more processors to:

obtain, based on a file downloaded via a network, file information identifying the file;

send both the file information and client information identifying aspects of the computing device to a remote reputation service;

receive, from the remote reputation service, a reputation indication for the file; and

determine, based at least in part on the reputation indication, a user interface for the Web browser to present at the computing device.

15. One or more computer storage media as recited in claim 14, wherein to determine the user interface is to determine, based at least in part on the reputation indication, that the user interface is to include a link to a newer version of a program in the file.

16. One or more computer storage media as recited in claim 14, wherein the instructions further cause the one or more processors to:

receive, from a user of the computing device, a user action in response to the user interface being presented to the user; and

send an indication of the user action to the remote reputation service for subsequent use by the remote reputation server in determining reputation indications for the file.

17. One or more computer storage media as recited in claim 14, wherein:

the file information comprises;

a hash value generated by applying a hash function to the file,

a uniform resource locator (URL) from which the file was obtained,

an identifier of a version of the file,

an indication of whether metadata associated with the file includes a valid digital signature of the file, and the valid digital signature of the file if the metadata associated with the file includes the valid digital signature of the file; and

the client information comprises;

an identifier of an antivirus program analyzing the file; and

an indication of whether the antivirus program indicated that the file was clean or infected.

18. One or more computer storage media as recited in claim 14, wherein the reputation indication comprises:

a rating for the file that identifies which of one or more user interface components, if any, are to be included in the user interface; and

an indication of whether antivirus results from an antivirus program analyzing the file are to be provided to the remote reputation service for subsequently obtained files.

19. One or more computer storage media as recited in claim 14, wherein to determine the user interface is to determine that the user interface is to include no warnings regarding dangers of installing the file.

20. A method in a Web browser of a computing device, the method comprising:

downloading a file from a content server via the Internet;

obtaining, based on the file, information identifying the file, the information including;

a hash value generated by applying a hash function to the file,

a uniform resource locator (URL) from which the file was obtained,

an identifier of a version of the file, and

an indication of whether metadata associated with the file includes a valid digital signature of the file, and the valid digital signature of the file if the metadata associated with the file includes the valid digital signature of the file;

sending the information identifying the file to a remote reputation service;

receiving, from the remote reputation service, a rating for the file;

determining, based at least in part on the rating, a user interface for the Web browser to present at the computing device, the determining including;

determining that the user interface includes no warnings regarding the file if the rating for the file is first value, and

determining that the user interface includes one or more warnings regarding the file if the rating for the file is a second value; and

presenting the user interface for the Web browser at the computing device.