Method and apparatus for identifying and characterizing errant electronic files

• US 10,235,442 B2
• Filed: 01/18/2016
• Issued: 03/19/2019
• Est. Priority Date: 04/30/1999
• Status: Expired due to Term

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Inventors: Shuster, Gary Stephen
• Primary Examiner(s): Lewis, Lisa C
• Application Number:
  US14/997,981
• Publication Number:
  US 20160217199A1
• Time in Patent Office: 1,156 Days
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/148 File search processing
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

A computer system includes a server having a memory connected thereto. The server is adapted to be connected to a network to permit remote storage and retrieval of data files from the memory. A file identification application is operative with the server to identify errant files stored in the memory. The file identification application provides the functions of: (1) selecting a file stored in said memory; (2) generating a unique checksum corresponding to the stored fire; (3) comparing said unique checksum to each of a plurality of previously generated checksums, wherein the plurality of previously generated checksums correspond to known errant files; and (4) marking the file for deletion from the memory if the unique checksum matches one of the plurality of previously generated checksums.

Claims

1. A computer-implemented method for generating a library of checksum values, the method comprising:

under control of one or more configured computer systems;

storing, in a computer storage medium, a checksum library for assessing suspect files;

identifying a source of known illicit files;

accessing a candidate file stored by a physical storage device for the source;

determining that the candidate file appears within proximity of a minimum threshold number of the known illicit files for the source;

generating a candidate checksum for the candidate file stored by the physical storage device for the source, wherein the known illicit files do not include the candidate file;

determining that the checksum library does not include the candidate checksum; and

adding the candidate checksum to the checksum library stored in the computer storage medium.

2. The computer-implemented method of claim 1, further comprising:

receiving a criterion identifying a file characteristic; and

identifying the source of known illicit files using the criterion.

3. The computer-implemented method of claim 2, wherein receiving the criterion comprises receiving at least one of:

a minimum file size; and

a file type.

4. The computer-implemented method of claim 1, wherein the candidate file comprises a graphics file, and wherein generating the candidate checksum comprises at least one of:

generating the candidate checksum for the graphics file based on vector graphics analysis;

or

dividing the graphics file into blocks and comparing relationships between the blocks.

5. The computer-implemented method of claim 1, wherein adding the candidate checksum to the checksum library comprises:

associating a file name of the candidate file with the candidate checksum; and

associating a file length of the candidate file with the candidate checksum.

6. The computer-implemented method of claim 1, wherein:

generating the candidate checksum for the candidate file comprises;

generating a first checksum of the candidate file using a first number of bytes from a first file location of the candidate file, and

generating a second checksum of the candidate file using a second number of byes from a second file location of the candidate file; and

wherein adding the candidate checksum to the checksum library comprises adding the first checksum and the second checksum to the checksum library.

7. The computer-implemented method of claim 1, wherein accessing the candidate file of the source comprises establishing a network connection with at least one of a web server or a newsgroup server.

8. The computer-implemented method of claim 1, wherein accessing the candidate file of the source comprises:

accessing a first directory of the source, the first directory including the candidate file; and

wherein determining that the candidate file appears within the proximity of a minimum threshold number of the known illicit files for the source is based on a second directory of the source, the second directory including the known illicit files, wherein the first directory is a different location than the second directory.

9. The computer-implemented method of claim 1, further comprising:

obtaining a suspect file from a second file source;

generating a checksum for the suspect file;

determining the checksum for the suspect file corresponds to the candidate checksum in the checksum library; and

characterizing the suspect file as an unauthorized file.

10. A computer system, comprising:

a computer storage device configured to store a checksum library for assessing suspect files;

a server adapted to be connected to a network to permit retrieval of files from a file source; and

a file identification application operative with the server to generate the checksum library, the file identification application providing the functions of;

identifying the file source as a source of known illicit files;

accessing a candidate file stored by a physical storage device for the file source;

determining that the candidate file appears within proximity of a minimum threshold number of the known illicit files for the source;

generating a candidate checksum for the candidate file from the file source, wherein the known illicit files do not include the candidate file;

determining that the checksum library does not include the candidate checksum; and

adding the candidate checksum to the checksum library stored in the computer storage device.

11. The computer system of claim 10, wherein the file identification application further provides the functions of:

receiving a criterion identifying a file characteristic; and

identifying the source of known illicit files for processing using the criterion.

12. The computer system of claim 11, wherein the file identification application receiving the criterion comprises the file identification application receiving at least one of:

a minimum file size; and

a file type.

13. The computer system of claim 10, wherein the candidate file comprises a graphics file, and wherein the file identification application generating the candidate checksum comprises the file identification application providing at least one of the functions of:

generating the candidate checksum for the graphics file based on vector graphics analysis;

or

dividing the graphics file into blocks and comparing relationships between the blocks.

14. The computer system of claim 10, wherein the file identification application adding the candidate checksum to the checksum library comprises the file identification application providing the functions of:

associating a file name of the candidate file with the candidate checksum; and

associating a file length of the candidate file with the candidate checksum.

15. The computer system of claim 10, wherein:

the file identification application generating the candidate checksum comprises the file identification application providing the functions of;

generating a first checksum of the candidate file using a first number of bytes from a first file location of the candidate file, and

generating a second checksum of the candidate file using a second number of byes from a second file location of the candidate file; and

wherein adding the candidate checksum to the checksum library comprises adding the first checksum and the second checksum to the checksum library.

16. The computer system of claim 10, wherein the server is adapted to establish a connection via the network with the file source, wherein the file source comprises at least one of a web server or a newsgroup server.

17. The computer system of claim 10, wherein the server is adapted to access the candidate file from the file source by:

accessing a first directory of the file source, the first directory including the candidate file; and

wherein determining that the candidate file appears within the proximity of a minimum threshold number of the known illicit files for the source is based on a second directory of the file source, the second directory including the known illicit files, wherein the first directory is a different location than the second directory.

18. The computer system of claim 10, wherein the server is further adapted to obtain a suspect file from a second file source, and wherein the file identification application is further adapted for providing the functions of:

generating a checksum for the suspect file;

determining the checksum for the suspect file corresponds to the candidate checksum in the checksum library; and

characterizing the suspect file as an unauthorized file.

19. A physical storage device having instructions stored thereon, the instructions comprising:

instructions for storing, in a computer storage medium, a checksum library for assessing suspect files;

instructions for identifying a source of known illicit files;

instructions for accessing a candidate file stored by a physical storage device for the source;

instructions for determining that the candidate file appears within proximity of a minimum threshold number of the known illicit files for the source;

instructions for generating a candidate checksum for the candidate file stored by the physical storage device for the source, wherein the known illicit files do not include the candidate file;

instructions for determining that the checksum library does not include the candidate checksum; and

instructions for adding the candidate checksum to the checksum library stored in the computer storage medium.