SERVER-ASSISTED ANTI-MALWARE CLIENT

• US 20140283065A1
• Filed: 03/15/2013
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Teddy, John, Bean, James Douglas, Dalcher, Gregory William, Hetzler, Jeff
• Granted Patent: US 9,614,865 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416

Abstract

A host-based antimalware client can interface with a server-based antimalware support server. A file is identified at a host device. It is determined whether local reputation data for the file is available at the host device for the file. A query is sent to an antimalware support system relating to the file. Particular reputation data is received from the antimalware support system corresponding to the query. It is determined whether to allow the file to be loaded on the host device based at least in part on the particular reputation data.

Claims

1. At least one machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

identify a file at a host device;

identify local reputation data at the host device for the file;

send a query to an antimalware support system relating to the file, wherein the query is to include the local reputation data;

receive particular reputation data from the antimalware support system corresponding to the query; and

determine whether to allow the file to be loaded on the host device based at least in part on the particular reputation data.

2. The storage medium of claim 1, wherein determining whether to allow the file to be loaded on the host device is further based, at least in part, on the local reputation data.

3. The storage medium of claim 1, wherein the particular reputation data describes behaviors of the file.

4. The storage medium of claim 1, wherein determining whether to allow the file to be loaded on the host device is based on one or more rules.

5. The storage medium of claim 4, wherein the one or more rules are rules of a particular domain of the antimalware support system.

6. The storage medium of claim 5, wherein the host device is of a particular type and at least one of the rules is for host devices of the particular type.

7. The storage medium of claim 1, wherein a copy of the file is to be sent with the query to the antimalware support system.

8. The storage medium of claim 1, wherein the instructions when executed on a machine, further cause the machine to generate a hash of the file, wherein the file is to be identified by the hash in the query.

9. The storage medium of claim 1, wherein the instructions when executed on a machine, further cause the machine to scan the file to identify one or more characteristics of the file to be included in the local reputation data.

10. The storage medium of claim 1, wherein the local reputation data includes a certificate of the file and determining whether to allow the file is further based at least in part on the certificate.

11. The storage medium of claim 10, further comprising determining whether the certificate is included in a listing of approved certificates for a domain.

12. The storage medium of claim 10, further comprising determining whether the certificate is a certificate of one of a set of trusted publishers identified for a domain.

13. A method comprising:

identifying a file at a host device;

determining whether local reputation data is available at the host device for the file;

sending a query to an antimalware support system relating to the file;

receiving particular reputation data from the antimalware support system corresponding to the query; and

determining whether to allow the file to be loaded on the host device based at least in part on the particular reputation data.

14. The method of claim 13, wherein the file comprises an executable file.

15. The method of claim 13, wherein local reputation data is determined to be available for the file at the host device, and the method further comprises determining that the local reputation data is insufficient to determine whether to allow the file to be loaded on the host device.

16. The method of claim 15, wherein at least a portion of the local reputation data for the file is included in the query.

17. The method of claim 13, wherein the particular reputation data includes a previously-determined reputation score for the file.

18. The method of claim 17, wherein the file is to be allowed to load on the host device when the reputation score is above a corresponding threshold score.

19. A system comprising:

at least one processor device;

at least one memory element; and

an antimalware client local to a host device and adapted when executed by the at least one processor device to;

identify a file at the host device;

scan the file to identify characteristics of the file;

maintain local reputation data at the host device to describe characteristics of the file;

send a query to an antimalware support system relating to the file, wherein the query is to include the local reputation data;

receive particular reputation data from the antimalware support system corresponding to the query; and

determine whether to allow the file to be loaded on the host device based at least in part on the particular reputation data.

20. The system of claim 19, further comprising the antimalware support system to determine additional reputation data for the file based on the query.

21-68. -68. (canceled)