Providing file information to a client responsive to a file download stability prediction

• US 9,124,472 B1
• Filed: 07/25/2012
• Issued: 09/01/2015
• Est. Priority Date: 07/25/2012
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Schneider, Scott, Wilhelm, Jeffrey
• Primary Examiner(s): Harrell, Robert B
• Application Number:
  US13/558,177
• Time in Patent Office: 1,133 Days
• Field of Search: 709/217
• US Class Current: 1/1
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A client sends a file information request to a security server, where the file information request identifies a URL from which the client is attempting to download a file. Upon receiving the request, the security server determines the stability information of the identified URL and provides the requested file information for the file provided by the URL. The security server determines the stability information of a URL by analyzing the file identifiers and URLs identified in downloaded file reports received from multiple clients. The determination of the stability information of a URL may be based on a variety of factors, such as stability of a URL over time, a textual analysis of the URL, and the set of files provided by the URL. A user of the client can review the file information and decide whether to expend the resources to download the file.

Claims

1. A computer-implemented method of providing file information to a client, comprising:

receiving a file information request from a client, the file information request identifying a uniform resource locator (URL) from which the client is attempting to download a file;

determining stability information for the URL from which the client is attempting to download the file, the stability information indicating whether the URL provides a same file each time the URL is used, wherein determining stability information for the URL comprises;

receiving downloaded file reports from a plurality of clients, the downloaded file reports identifying URLs and files downloaded from the URLs by the clients; and

analyzing the received downloaded file reports to determine stability information for the URLs, wherein the URL is determined to be stable responsive to the downloaded file reports indicating that the URL has provided the same file to the plurality of clients; and

responsive to the stability information for the URL indicating that the URL is stable, providing file information for the file to the client in response to the request.

2. The method of claim 1, wherein determining stability information for the URL comprises:

determining whether the URL has provided the same file to a plurality of clients; and

responsive to determining that the URL has provided the same file to a plurality of clients, generating stability information indicating that the URL is stable.

3. The method of claim 2, further comprising:

identifying files provided by the URL to the plurality of clients during a specified time period; and

generating the stability information responsive at least in part to whether the URL provided the same file to the plurality of clients during the specified time period.

4. The method of claim 1, wherein the client is adapted to present the file information to a user of the client by modifying a display of a web page in which the URL appears.

5. The method of claim 1, wherein determining stability information for the URL comprises:

identifying a number of different files provided to a plurality of clients by the URL;

determining stability information indicating that the URL is stable responsive to the number of different files provided by the URL being below a threshold.

6. The method of claim 1, wherein determining stability information for the URL comprises:

identifying different files provided to a plurality of clients by the URL;

parsing the different files into a plurality of internal components of the files; and

determining the stability information for the URL responsive to stability of the internal components of the files.

7. The method of claim 1, wherein the provided file information comprises reputation information indicating a likelihood that the file contains malware, wherein the reputation information is generated based on downloaded file reports received from a plurality of clients, and the downloaded file reports include observed reputation information for files downloaded by the plurality of clients.

8. A non-transitory computer-readable storage medium storing executable computer program instructions for providing file information to a client, the computer program instructions comprising instructions for:

receiving a file information request from a client, the file information request identifying a uniform resource locator (URL) from which the client is attempting to download a file;

determining stability information for the URL from which the client is attempting to download the file, the stability information indicating whether the URL provides a same file each time the URL is used, wherein determining stability information for the URL comprises;

receiving downloaded file reports from a plurality of clients, the downloaded file reports identifying URLs and files downloaded from the URLs by the clients; and

analyzing the received downloaded file reports to determine stability information for the URLs, wherein the URL is determined to be stable responsive to the downloaded file reports indicating that the URL has provided the same file to the plurality of clients; and

responsive to the stability information for the URL indicating that the URL is stable, providing file information for the file to the client in response to the request.

9. The computer-readable storage medium of claim 8, wherein the computer program instructions for determining stability information for the URL comprise instructions for:

determining whether the URL has provided the same file to a plurality of clients; and

responsive to determining that the URL has provided the same file to a plurality of clients, generating stability information indicating that the URL is stable.

10. The computer-readable storage medium of claim 9, further comprising computer program instructions for:

identifying files provided by the URL to the plurality of clients during a specified time period; and

generating the stability information responsive at least in part to whether the URL provided the same file to the plurality of clients during the specified time period.

11. The computer-readable storage medium of claim 8, wherein the computer program instructions for determining stability information for the URL comprise instructions for:

performing a textual analysis of the URL; and

determining stability information basing at least in part on results of the textual analysis.

12. The computer-readable storage medium of claim 8, wherein the computer program instructions for determining stability information for the URL comprise instructions for:

identifying a number of different files provided to a plurality of clients by the URL;

determining stability information indicating that the URL is stable responsive to the number of different files provided by the URL being below a threshold.

13. The computer-readable storage medium of claim 8, wherein the computer program instructions for determining stability information for the URL comprise instructions for:

identifying different files provided to a plurality of clients by the URL;

parsing the different files into a plurality of internal components of the files; and

determining the stability information for the URL responsive to stability of the internal components of the files.

14. The computer-readable storage medium of claim 8, wherein the provided file information comprises reputation information indicating a likelihood that the file contains malware.

15. A system for providing file information to a client, the system comprising:

a non-transitory computer-readable storage medium storing executable computer program modules comprising;

a stability information module for receiving a file information request from a client, the file information request identifying a uniform resource locator (URL) from which the client is attempting to download a file;

an analysis module for determining stability information for the URL from which the client is attempting to download the file, the stability information indicating whether the URL provides a same file each time the URL is used, wherein

determining stability information for the URL comprises;

receiving downloaded file reports from a plurality of clients, the downloaded file reports identifying URLs and files downloaded from the URLs by the clients; and

analyzing the received downloaded file reports to determine stability information for the URLs, wherein the URL is determined to be stable responsive to the downloaded file reports indicating that the URL has provided the same file to the plurality of clients;

a reporting module for providing file information for the file to the client in response to the request responsive to the stability information for the URL indicating that the URL is stable; and

a processor for executing the computer program modules.

16. The system of claim 15, wherein the analysis module is further for:

determining whether the URL has provided the same file to a plurality of clients; and

responsive to determining that the URL has provided the same file to a plurality of clients, generating stability information indicating that the URL is stable.

17. The system of claim 15, wherein the analysis module is further for:

identifying files provided by the URL to the plurality of clients during a specified time period; and

generating the stability information responsive at least in part to whether the URL provided the same file to the plurality of clients during the specified time period.