SERVER-ASSISTED ANTI-MALWARE CLIENT

• US 20140283066A1
• Filed: 03/15/2013
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Teddy, John D., Bean, James Douglas, Woodruff, Andrew Arlin, Dalcher, Gregory William, Hetzler, Jeff
• Granted Patent: US 9,311,480 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

An antimalware support system is provided to support one or more host-based antimalware clients. A query is received from a particular host device that identifies a file detected by an antimalware tool local to the particular host device. Reputation data is determined for the file, and a response to the query is sent to the particular host device. The query response includes the reputation data determined for the file.

Claims

1. At least one machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

receive a query from a particular host device;

identify a file detected by an antimalware tool local to the particular host device;

determine particular reputation data for the file; and

send a response to the query to the particular host device, wherein the response includes the particular reputation data

2. The storage medium of claim 1, wherein determining the particular reputation data includes identifying predetermined reputation data for the file.

3. The storage medium of claim 2, wherein the predetermined reputation data is based on an encounter of the file by another host device.

4. The storage medium of claim 1, wherein the query includes identification of a certificate of the file and at least one behavior of the file.

5. The storage medium of claim 1, wherein the instructions, when executed on a machine, further cause the machine to determine a security score for the file based at least in part on information included in the query.

6. The storage medium of claim 5, wherein the security score is further based on predetermined reputation data for the file provided by one or more other host devices.

7. The storage medium of claim 5, wherein the security score is further based on intelligence data received from a remote threat intelligence system.

8. The storage medium of claim 5, wherein determining the security score includes applying a set of rules against reputation data describing aspects of the file, wherein the set of rules is specific to a domain.

9. The storage medium of claim 1, wherein determining the reputation data includes initiating a scan of the file, wherein the reputation data includes results of the scan.

10. The storage medium of claim 9, wherein initiating the scan includes selecting one or more particular scanners from a plurality of remote scanners for use in the scanning of the file.

11. The storage medium of claim 10, wherein selecting the one or more particular scanners is based, at least in part, on the particular reputation data.

12. A method comprising:

receiving a query from a particular host device;

identifying a file detected by an antimalware tool local to the particular host device;

determining particular reputation data for the file; and

sending a response to the query to the particular host device, wherein the response includes the particular reputation data.

13. The method of claim 12, wherein the query includes local reputation data collected by the antimalware tool.

14. The method of claim 13, wherein the local reputation data includes identification of a certificate of the file.

15. The method of claim 13, wherein the local reputation data includes behaviors of the file detected by the antimalware tool.

16. The method of claim 13, further comprising:

maintaining, in a data store for a domain, records describing a plurality of files, wherein the records are based on information obtained from a plurality of host devices in the domain including the particular host device; and

supplementing information for a record of the data store corresponding to the file based on the local reputation data.

17. The method of claim 16, wherein at least a portion of the information obtained from the plurality of host devices was received in connection with a query by another one of the plurality of host devices.

18. The method of claim 12, wherein the query includes a hash of the file.

19. A system comprising:

at least one processor device;

at least one memory element; and

an antimalware support server adapted when executed by the at least one processor device to;

receive a query from a particular host device;

identify a file detected by an antimalware tool local to the particular host device;

determine particular reputation data for the file; and

send a response to the query to the particular host device, wherein the response includes the particular reputation data

20. The system of claim 19, further comprising a plurality of host devices including the particular host device.

21. The system of claim 19, wherein the antimalware tool is adapted to detect a portion of a set of characteristics of the file and attempt to decide whether to allow the file to load on the particular host device based at least on the portion of the set of characteristics.

22. The system of claim 21, wherein the query is based on a determination that the portion of the set of characteristics is insufficient to decide whether to allow the file to load on the particular host device.

23. The system of claim 22, wherein the response to the query describes additional characteristics of the particular host device and the antimalware tool is to attempt to decide whether to allow the file further based on the additional characteristics.

24-54. -54. (canceled)