System, method, and computer program product for populating a list of known wanted data

• US 8,527,978 B1
• Filed: 03/31/2008
• Issued: 09/03/2013
• Est. Priority Date: 03/31/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Sallam, Ahmed Said
• Primary Examiner(s): Bullock, Jr., Lewis A
• Assistant Examiner(s): Huynh, Tina
• Application Number:
  US12/059,937
• Publication Number:
  US 20130247024A1
• Time in Patent Office: 1,982 Days
• Field of Search: 713161-179, 717168-178, 726 11- 13
• US Class Current: 717/168
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57

Abstract

A system, method, and computer program product are provided for populating a list of known wanted data. In use, an update to data is identified. In addition, a list of known wanted data is populated with the data, in response to the update.

Claims

1. A computer program product embodied on a non-transitory tangible computer readable medium for performing operations, comprising:

using a profiling agent to monitor a plurality of update services that are associated with multiple update providers, wherein the profiling agent includes a proxy interface;

identifying an update for a computer using the proxy interface, wherein the proxy interface is configured to monitor operations performed by an operating system and one or more applications of the computer for identifying the update;

downloading the update;

populating a list of known wanted data with at least a portion of update data provided in the update, wherein the list reflects an aggregation of multiple update data sets from the multiple update providers and the list is based, at least in part, on the operating system and applications of the computer, and wherein the portion of the update data are reflective of data predetermined to exclude malware, and wherein the known wanted data includes a whitelist;

populating the list of known wanted data with metadata that indicates a version of the update data, a digital signature used to sign a portion of the update data, and a location from which the portion of the update data was received;

installing the update;

tracking copied files by the profiling agent; and

updating a whitelist database with the digital signature generated by the profiling agent.

2. The computer program product of claim 1, wherein the portion of the update data includes an executable file.

3. The computer program product of claim 2, wherein the file includes an operating system file.

4. The computer program product of claim 2, wherein the file includes an application filed.

5. The computer program product of claim 1, wherein the portion of the update data is updated by a setup program.

6. The computer program product of claim 1, wherein the update is identified based on a call to a service to install the update.

7. The computer program product of claim 1, wherein the update is identified based on a call to a service to download the update.

8. The computer program product of claim 7, wherein the service includes an object interface.

9. The computer program product of claim 1, wherein the proxy interface includes a plurality of components, each component monitoring different operations.

10. The computer program product of claim 9, wherein the components include at least one of a file system component, a registry component, a process component, and a network component.

11. The computer program product of claim 1, wherein the metadata includes at least one of a format type of the portion of the update data, and a time of the update.

12. A method, comprising:

using a profiling agent to monitor a plurality of update services that are associated with multiple update providers, wherein the profiling agent includes a proxy interface;

identifying an update for a computer using the proxy interface, wherein the proxy interface is configured to monitor operations performed by an operating system and one or more applications of the computer for identifying the update;

downloading the update;

populating a list of known wanted data with at least a portion of update data provided in the update, wherein the list reflects an aggregation of multiple update data sets from the multiple update providers and the list is based, at least in part, on the operating system and applications of the computer, and wherein the portion of the update data are reflective of data predetermined to exclude malware, and wherein the known wanted data includes a whitelist;

populating the list of known wanted data with metadata that indicates a version of the update data, a digital signature used to sign a portion of the update data, and a location from which the portion of the update data was received;

installing the update;

tracking copied files by the profiling agent; and

updating a whitelist database with the digital signature generated by the profiling agent.

13. A system, comprising:

a processor;

a memory; and

a profiling agent, wherein the system is configured for;

using the profiling agent to monitor a plurality of update services that are associated with multiple update providers, wherein the profiling agent includes a proxy interface;

identifying an update for a computer using the proxy interface, wherein the proxy interface is configured to monitor operations performed by an operating system and one or more applications of the computer for identifying the update;

downloading the update;

populating a list of known wanted data with at least a portion of update data provided in the update, wherein the list reflects an aggregation of multiple update data sets from the multiple update providers and the list is based, at least in part, on the operating system and applications of the computer, and wherein the portion of the update data are reflective of data predetermined to exclude malware, and wherein the known wanted data includes a whitelist;

populating the list of known wanted data with metadata that indicates a version of the update data, a digital signature used to sign a portion of the update data, and a location from which the portion of the update data was received;

installing the update;

tracking copied files by the profiling agent; and

updating a whitelist database with the digital signature generated by the profiling agent.

14. The system of claim 13, wherein the processor is coupled to the memory via a bus.