System, method and computer program product for obtaining a reputation associated with a file

• US 8,701,196 B2
• Filed: 03/31/2006
• Issued: 04/15/2014
• Est. Priority Date: 03/31/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Heron, George L., Bolin, Christopher S.
• Primary Examiner(s): Hailu, Teshome
• Application Number:
  US11/395,758
• Publication Number:
  US 20130247129A1
• Time in Patent Office: 2,937 Days
• Field of Search: 726/25, 726/22, 726/23, 726/24
• US Class Current: 726/25
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A reputation system, method and computer program product are provided. In use, a file associated with a first computer is identified. Thereafter, a reputation associated with the file stored at a second computer is obtained.

Claims

1. A method, comprising:

identifying a file associated with a first computer;

obtaining an overall reputation associated with the file stored at a second computer, wherein the overall reputation comprises at least one characteristic associated with the file that includes undesirable code identified through a scanning activity, and wherein the overall reputation is determined by receiving information on the reputation of the file from each of a plurality of computers and aggregating the information received from each of the plurality of computers to produce the overall reputation associated with the file, and wherein the information on the reputation of the file received from each of the plurality of computers is based upon a respective determination of a reputation of the file by each of the plurality of computers; and

identifying a policy, wherein an agent provisioned in the first computer prohibits downloading of the file based on whether the reputation complies with configurable reputation settings provided in the policy, and wherein the policy is configured for indicating that additional scanning is to be carried out based on the reputation of the file.

2. The method of claim 1, wherein the overall reputation associated with the file is determined automatically by inspecting a plurality of files associated with a plurality of sites on a network.

3. The method of claim 2, wherein a plurality of the reputations associated with the plurality of files are stored in a database at the second computer, from which the overall reputation is obtained.

4. The method of claim 1, wherein the overall reputation associated with the file is determined based on an identification of an undesirable characteristic during at least one of scanning and using the file.

5. The method of claim 1, wherein information on the overall reputation associated with the file is identified at a third computer during use of the file.

6. The method of claim 1, wherein the overall reputation is obtained by looking up the overall reputation in a central database.

7. A non-transitory computer-readable medium, comprising one or more instructions that when executed on a processor configure the processor to:

identify a file associated with a first computer;

obtain an overall reputation associated with the file stored at a second computer, wherein the overall reputation comprises at least one characteristic associated with the file that includes undesirable code identified through a scanning activity, and wherein the overall reputation is determined by receiving information on the reputation of the file from each of a plurality of computers and aggregating the information received from each of the plurality of computers to produce the overall reputation associated with the file, and wherein the information on the reputation of the file received from each of the plurality of computers is based upon a respective determination of a reputation of the file by each of the plurality of computers; and

identify a policy, wherein an agent provisioned in the first computer prohibits downloading of the file based on whether the reputation complies with configurable reputation settings provided in the policy, and wherein the policy is configured for indicating that additional scanning is to be carried out based on the reputation of the file.

8. The computer-readable medium of claim 7, wherein the reputation includes at least one of a good reputation and a bad reputation.

9. The computer-readable medium of claim 8, wherein the policy is set by an administrator and indicates that the access to the file with the bad reputation is prohibited based on the policy.

10. The computer-readable medium of claim 7, wherein the policy further indicates that the file should be executed in an isolated environment to determine if any undesirable characteristic is exhibited by the file.

11. The computer-readable medium of claim 7, wherein the policy further indicates that the file should be emulated to determine if any undesirable characteristic is exhibited by the file.

12. The computer-readable medium of claim 7, wherein the overall reputation associated with the file is determined automatically by inspecting a plurality of files associated with a plurality of sites on a network.

13. The computer-readable medium of claim 12, wherein a plurality of the reputations associated with the plurality of files are stored in a database at the second computer, from which the overall reputation is obtained.

14. The computer-readable medium of claim 7, wherein the overall reputation associated with the file is determined based on an identification of an undesirable characteristic during at least one of scanning and using the file.

15. The computer-readable medium of claim 7, wherein information on the overall reputation associated with the file is identified at a third computer during use of the file.

16. The computer-readable medium of claim 7, wherein the file is identified in response to an attempt to download the file over a network.

17. The computer-readable medium of claim 7, wherein the overall reputation is obtained by looking up the overall reputation in a central database.

18. An apparatus, comprising:

a processor operable to execute computer program instructions; and

a memory coupled to the processor and operable to store computer program instructions executable by the processor such that the system is configured to;

identify a file associated with a first computer;

obtain an overall reputation associated with the file stored at a second computer, wherein the overall reputation comprises at least one characteristic associated with the file that includes undesirable code identified through a scanning activity, and wherein the overall reputation is determined by receiving information on the reputation of the file from each of a plurality of computers and aggregating the information received from each of the plurality of computers to produce the overall reputation associated with the file, and wherein the information on the reputation of the file received from each of the plurality of computers is based upon a respective determination of a reputation of the file by each of the plurality of computers; and

identify a policy, wherein an agent provisioned in the first computer prohibits downloading of the file based on whether the reputation complies with configurable reputation settings provided in the policy, and wherein the policy is configured for indicating that additional scanning is to be carried out based on the reputation of the file.

19. The apparatus of claim 18, wherein the overall reputation associated with the file is determined automatically by inspecting a plurality of files associated with a plurality of sites on a network.

20. The apparatus of claim 19, wherein a plurality of the reputations associated with the plurality of files are stored in a database at the second computer, from which the overall reputation is obtained.

21. The apparatus of claim 18, wherein the overall reputation associated with the file is determined based on an identification of an undesirable characteristic during at least one of scanning and using the file.

22. A system, comprising:

a first computer configured to identify a file associated with the first computer; and

a second computer configured to provide an overall reputation associated with the file stored at the second computer to the first computer, wherein the overall reputation comprises at least one characteristic associated with the file that includes undesirable code identified through a scanning activity, and wherein the overall reputation is determined by receiving information on the reputation of the file from each of a plurality of computers and aggregating the information received from each of the plurality of computers to produce the overall reputation associated with the file, and wherein the information on the reputation of the file received from each of the plurality of computers is based upon a respective determination of a reputation of the file by each of the plurality of computers; and

wherein the first computer is further configured to identify a policy, wherein an agent provisioned in the first computer prohibits downloading of the file based on whether the reputation complies with configurable reputation settings provided in the policy, and wherein the policy is configured for indicating that additional scanning is to be carried out based on the reputation of the file.

23. The system of claim 22, wherein the overall reputation associated with the file is determined automatically by inspecting a plurality of files associated with a plurality of sites on a network.

24. The system of claim 23, wherein a plurality of the reputations associated with the plurality of files are stored in a database at the second computer, from which the overall reputation is obtained.

25. The system of claim 22, wherein the overall reputation associated with the file is determined based on an identification of an undesirable characteristic during at least one of scanning and using the file.