SYSTEM AND METHOD FOR SELECTIVELY GROUPING AND MANAGING PROGRAM FILES

• US 20130246423A1
• Filed: 01/24/2011
• Published: 09/19/2013
• Est. Priority Date: 01/24/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: David P. Reese Jr
• Inventors: Bhargava, Rishi, Reese, David P. Jr.
• Granted Patent: US 9,075,993 B2
• Time in Patent Office: Days
• US Class Current: 707/737
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/1734 Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method in one embodiment includes determining a frequency range corresponding to a subset of a plurality of program files on a plurality of hosts in a network environment. The method also includes generating a first set of counts including a first count that represents an aggregate amount of program files in a first grouping of one or more program files of the subset, where each of the one or more program files of the first grouping includes a first value of a primary attribute. In specific embodiments, each program file is unknown. In further embodiments, the primary attribute is one of a plurality of file attributes provided in file metadata. Other specific embodiments include either blocking or allowing execution of each of the program files of the first grouping. More specific embodiments include determining a unique identifier corresponding to at least one program file of the first grouping.

Claims

1. A method, comprising:

determining a frequency range corresponding to a subset of a plurality of program files on a plurality of hosts in a network environment, each program file of the subset having a respective frequency included within the frequency range;

generating a first set of counts including a first count representing an aggregate amount of program files in a first grouping of one or more program files of the subset,

wherein each of the one or more program files of the first grouping includes a first value of a primary attribute.

2. The method of claim 1, wherein each of the plurality of program files is an unknown program file.

3. The method of claim 1, further comprising:

determining a unique identifier corresponding to at least one program file of the first grouping; and

determining a file path count representing an aggregate amount of one or more unique file paths associated with the unique identifier, each of the one or more unique file paths included on at least one of the plurality of hosts.

4. The method of claim 3, further comprising:

identifying a first file path of the one or more unique file paths; and

determining a host count representing an aggregate amount of one or more hosts in the plurality of hosts, the one or more hosts associated with the unique identifier and the first file path.

5. The method of claim 4, further comprising:

identifying the one or more hosts associated with the unique identifier and the first file path.

6. The method of claim 1, further comprising:

displaying the frequency range on a user interface; and

displaying the first set of counts on the user interface in response to the frequency range being selected.

7. The method of claim 1, further comprising:

generating a second set of counts including a second count representing an aggregate amount of program files in a second grouping of one or more program files of the first grouping;

wherein each of the one or more program files of the second grouping includes a second value of a secondary attribute.

8. The method of claim 7, wherein the primary and secondary attributes are different file attributes provided in file metadata of the plurality of program files.

9. The method of claim 7, further comprising:

blocking execution of each program file of one of the first or second groupings.

10. The method of claim 7, further comprising:

allowing execution of each program file of one of the first or second groupings.

11. The method of claim 1, wherein the first set of counts includes a third count representing an aggregate amount of a third grouping of one or more program files of the subset,

wherein each of the one or more program files of the third grouping includes a third value of the primary attribute, wherein the first value and the third value are not equivalent, and wherein none of the one or more program files of the first grouping are equivalent to any of the one or more program files of the third grouping.

12. The method of claim 1, further comprising determining a plurality of frequencies corresponding respectively to the plurality of program files, wherein each of the plurality of frequencies is determined by calculating all occurrences of a respective one of the plurality of program files in the plurality of hosts.

13. An apparatus, comprising:

a program file grouping module;

a memory element for storing a program file inventory of a plurality of program files on a plurality of hosts in a network environment; and

a processor operable to execute instructions associated with the program file grouping module and the memory element, including;

determining a frequency range corresponding to a subset of the plurality of program files, each program file of the subset having a respective frequency included within the frequency range; and

generating a first set of counts including a first count representing an aggregate amount of program files of a first grouping of one or more program files of the subset,

wherein each of the one or more program files of the first grouping includes a first value of a primary attribute.

14. The apparatus of claim 13, wherein the primary attribute is one of a plurality of extrinsic file attributes.

15. The apparatus of claim 13, wherein the processor is operable to perform further instructions, comprising:

generating a second set of counts including a second count representing an aggregate amount of program files in a second grouping of one or more program files of the first grouping;

wherein each of the one or more program files of the second grouping includes a second value of a secondary attribute.

16. The apparatus of claim 15, wherein the processor is operable to perform further instructions, comprising:

blocking execution of each program file of one of the first or second groupings.

17. The apparatus of claim 13, wherein the first set of counts includes a third count representing an aggregate amount of program files of a third grouping of one or more program files of the subset,

wherein each of the one or more program files of the third grouping includes a third value of the primary attribute, wherein the first value and the third value are not equivalent, and wherein none of the one or more program files of the first grouping are equivalent to any of the one or more program files of the third grouping.

18. Logic encoded in one or more non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

determining a frequency range corresponding to a subset of a plurality of program files on a plurality of hosts in a network environment, each program file of the subset having a respective frequency included within the frequency range;

generating a first set of counts including a first count representing an aggregate amount of program files in a first grouping of one or more program files of the subset,

wherein each of the one or more program files of the first grouping includes a first value of a primary attribute.

19. The logic of claim 18, the processor being operable to perform further operations comprising:

generating, in succession, one or more additional sets of counts, each additional set of counts including a respective count representing an aggregate amount of program files of a respective grouping of one or more program files of a respective previous grouping,

wherein each of the respective counts is associated with a distinct value of a different file attribute.

20. The logic of claim 19, the processor being operable to perform further operations comprising:

blocking execution of each program file of the first grouping or one of the respective groupings.