System, method, and computer program product for verifying an identification of program information as unwanted

• US 8,627,461 B2
• Filed: 03/04/2009
• Issued: 01/07/2014
• Est. Priority Date: 03/04/2009
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Barton, Christopher, Roberts, Guy William Welch, Muttik, Igor G., Hinchliffe, Alexander James
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Jamshidi, Ghodrat
• Application Number:
  US12/398,073
• Publication Number:
  US 20130276106A1
• Time in Patent Office: 1,770 Days
• Field of Search: 726 22- 25, 722/22
• US Class Current: 726/22
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

A system, method, and computer program product are provided for verifying an identification of program information as unwanted. In use, program information is identified as unwanted at a client. Furthermore, the identification of the program information as unwanted is verified, utilizing a communication between the client and a server.

Claims

1. A computer program product embodied on a non-transitory computer readable medium comprising instructions to cause one or more processors to:

determine, at a client, program information is unwanted and to associate an indication of the unwanted determination with the program information;

determine a risk factor associated with the determination of the program information as unwanted, wherein the risk factor indicates a degree of risk that the determination by the client will not be positively verified by a server;

compare the risk factor to a threshold value, the comparison indicating an unacceptable degree of risk that the determination by the client will not be positively verified by a server;

transmit the indication of the unwanted determination to the server based on the comparison; and

receive a verification of the unwanted determination from the server.

2. The computer program product of claim 1, wherein the program information includes a file.

3. The computer program product of claim 1, further comprising instructions to cause the one or more processors to conditionally perform a remedial action responsive to a positive verification.

4. The computer program product of claim 3, wherein the remedial action includes at least one of preventing access to the program information, quarantining the program information, and generating a notification on the client.

5. The computer program product of claim 3, wherein the remedial action is only performed if the program information is verified to be unwanted.

6. The computer program product of claim 1, further comprising instructions to cause the one or more processors to conditionally prevent a remedial action when the verification of the determination is negative.

7. The computer program product of claim 1, wherein the risk factor is a function of a type of analysis that resulted in the determination of the program information as unwanted.

8. The computer program product of claim 1, wherein the risk factor is a function of an age of a driver that resulted in the determination of the program information as unwanted.

9. A computer program product embodied on a non-transitory computer readable medium comprising instructions to cause one or more processors to:

receive a request from a client for verifying an identification by a client of program information as unwanted, wherein a degree of risk that the identification of program information as unwanted will not be positively verified by the server compares unfavorably to a threshold value, the comparison indicating an unacceptable degree of risk that the identification by the client will not be positively verified;

verify the identification of the program information as unwanted; and

send a response with an indication of a result of the verification.

10. The computer program product of claim 9, wherein the verification is performed utilizing a whitelist.

11. The computer program product of claim 10, further comprising instructions to cause the one or more processors to:

receive, from the client, an identifier associated with the determination of the program information as unwanted; and

search the whitelist for the identifier.

12. The computer program product of claim 9, further comprising instructions to cause the one or more processors to log information associated with the program information that is received from a plurality of clients.

13. The computer program product of claim 12, wherein the log information indicates a number of instances of the determination of the program information as unwanted across the plurality of clients.

14. A method, comprising:

receiving, at a server, a request from a client for verifying an identification of program information as unwanted, wherein a degree of risk that the identification of program information as unwanted will not be positively verified by the server compares unfavorably to a threshold value, the comparison indicating an unacceptable degree of risk that the determination by the client will not be positively verified by a server;

verifying whether the program information is unwanted, utilizing the server; and

sending a response with an indication of a result of the verification.

15. The method of claim 14, wherein the server logs information associated with the program information that is received from a plurality of clients.

16. The method of claim 15, wherein the logged information indicates a number of instances of the identification of the program information as unwanted across the plurality of clients.

17. A system, comprising:

a memory; and

a processor coupled to the memory, the processor adapted to execute instructions stored in the memory to—

receive a request from a client for verifying an identification by the client of program information as unwanted, wherein a degree of risk that the identification of program information as unwanted will not be positively verified by the server compares unfavorably to a threshold value, the comparison indicating an unacceptable degree of risk that the determination by the client will not be positively verified by a server;

verify the identification of the program information as unwanted; and

send a response with an indication of a result of the verification.

18. A system, comprising:

a memory; and

a processor coupled to the memory by a bus, the processor adapted to execute instructions stored in the memory to—

determine, at a client, program information is unwanted and associate an indication of the unwanted determination with the program information;

determine a risk factor associated with the determination of the program information as unwanted, wherein the risk factor indicates a degree of risk that the determination by the client will not be positively verified by a server;

compare the risk factor to a threshold value, the comparison indicating an unacceptable degree of risk that the determination by the client will not be positively verified by a server;

transmit the indication of the unwanted determination to the server based on the comparison; and

receive a verification of the unwanted determination from the server.