Content extractor and analysis system

• US 8,984,636 B2
• Filed: 07/29/2005
• Issued: 03/17/2015
• Est. Priority Date: 07/29/2005
• Status: Active Grant

• Current Assignee: Carbon Black, Inc. (Broadcom, Inc.)
• Original Assignee: BIT9 Incorporated
• Inventors: Brennan, Todd
• Primary Examiner(s): POWERS, WILLIAM S
• Application Number:
  US11/194,078
• Publication Number:
  US 20070028110A1
• Time in Patent Office: 3,518 Days
• Field of Search: 726/24, 726/26, 713/176, 713/191
• US Class Current: 726/24
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A security system provides a defense from known and unknown viruses, worms, spyware, hackers, and unwanted software. The system can implement centralized policies that allow an administrator to approve, block, quarantine, and log file activities. The system can extract content of interest from a file container, repackage the content of interest as another valid file type, perform hashes on the content of interest, associate the hash of the container with the hash of the repackaged content, transfer the repackaged content, and store the hash with other security-related information.

Claims

1. A computer-implemented method comprising:

receiving a first file by a computer;

extracting content of interest within the first file, wherein said content of interest is less than the entire first file;

wherein the content of interest includes one of an executable, script, archive, or installer;

repackaging the content of interest into one or more files of valid formatted type to produce a first reduced file;

applying a signature to the reduced file; and

storing the signature and associating the signature with the first file.

2. The method of claim 1, further comprising performing the acts of claim 1 with respect to a second file and comparing the signature of the first reduced file and a signature of the second reduced file to determine if they are the same.

3. The method of claim 2, wherein the signatures include one or more cryptographic hashes of the file contents of interest.

4. The method of claim 1, wherein the acts of claim 1 are performed on a host computer, and wherein the first reduced file is transferred to a server associated with the host computer for further content analysis.

5. The method of claim 1, wherein the content of interest includes a macro.

6. The method of claim 5, wherein the content of interest is repackaged as a word processing document.

7. The method of claim 1, wherein storing the signature further includes storing a date for when the reduced file or its signature was first seen.

8. The method of claim 1, wherein the first file is a presentation file with presentation slides.

9. The method of claim 1, further comprising sending the first reduced file as an email attachment.

10. The method of claim 9, wherein the email attachment is sent to a gateway with virus scanning capabilities for email attachments which scans the attachment.

11. The method of claim 1, wherein the content of interest is repackaged as a word processing document or an archive file.

12. The method of claim 1, wherein the signature includes one or more cryptographic hashes of the file contents of interest.

13. A computer system comprising:

a memory including meta-information regarding files, including, for each file, a signature of the contents and state information indicating whether and with what conditions certain specified file operations can be performed;

a host computer responsive to receiving a first file for extracting content of interest within the first file, wherein said content of interest is less than the entire first file,

wherein the content of interest includes one of an executable, script, archive, or installer,

repackaging the content of interest into one or more files of valid formatted type to produce a first reduced file,

applying a signature or hash to the first reduced file; and

storing the signature or hash and associating the signature or hash with the first file.

14. The system of claim 13, wherein the signature includes one or more cryptographic hashes of the file contents of interest.

15. The system of claim 13, wherein there is a plurality of host computers and a server associated with the plurality of host computers, the host computer providing the signature to the server for storage.

16. The system of claim 15, wherein:

the host computer receives the first file by detecting operations which could alter the content and/or name of a file;

the host computer looking up file meta-information by file name or signature of file name on a local meta-information store;

if the file name or signature is not found, providing a query to the server based on the hash of the contents of the first file;

if the file name or signature is found, accessing the meta-information to determine whether and with what conditions certain specified file operations can be performed.

17. The system of claim 16, wherein the signature includes one or more cryptographic hashes of the file contents.

18. The system of claim 16, wherein the host checks the server periodically to get meta-info updates.

19. The system of claim 18, wherein files are automatically transferred from host to server based on server meta-information.

20. The system of claim 15, further comprising automatically performing a further analysis of the file a defined period after the file is first seen.

21. The system of claim 13, wherein the meta-information includes, for each file, a file name, a signature of the first reduced file, and at least one of approved or banned or unknown state information indicating whether and with what conditions certain specified file operations can be performed.

22. The system of claim 21, wherein the meta-information has multiple approved or banned states for different operations, including execution and a write operation.

23. The system of claim 22, wherein the server stores meta-information in a data store and the host computers store a cache of the meta-information in the data store, the server causing updates to be provided to the host computer caches.

24. The system of claim 22, wherein the server stores content hashes, file names, approved and banned states, and a date the file or the hash of the file is first seen by the server.

25. The system of claim 24, wherein the server stores a pending state in which an operation is allowed pending further analysis to change the state to allowed or banned.

26. The system of claim 23, wherein the meta-information maintained in the server further includes a history of recent state changes and reason for changes and a time the meta-information last changed.