Reputation checking obtained files

• US 9,235,586 B2
• Filed: 09/13/2010
• Issued: 01/12/2016
• Est. Priority Date: 09/13/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Virmani, Ritika, Colvin, Ryan C., Haber, Elliott Jeb, Stevens, Warren G., Kim, Jane T., Holbrook, Jess S., Bowers, Sarah J., Scarrow, John L., McKune, Jeffrey R.
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Pan, Peiliang
• Application Number:
  US12/880,363
• Publication Number:
  US 20120066346A1
• Time in Patent Office: 1,947 Days
• Field of Search: 726 22- 25, 713/188, 709/219
• US Class Current: 1/1
• CPC Class Codes: G06F 16/164 File meta data generation
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting

Abstract

A Web browser of a computing device downloads or otherwise obtains a file. File information identifying the file is obtained and is sent to a remote reputation service. Client information identifying aspects of the computing device can also optionally be sent to the remote reputation service. In response to the file information (and optionally client information), a reputation indication for the file is received from the remote reputation service. A user interface for the Web browser to present at the computing device is determined, based at least in part on the reputation indication, and presented at the computing device.

Claims

1. A method in a Web browser of a computing device, the method comprising:

obtaining information identifying a file;

sending the information identifying the file, as well as client information identifying the Web browser of the computing device that obtained the file, to a remote reputation service, the information identifying the file including a link to a location of the file;

receiving, from the remote reputation service, a reputation indication for the file, the reputation indication being based on both the information identifying the file and the client information;

identifying one or more user interface components associated with the reputation indication;

determining, based at least in part on the identified one or more user interface components associated with the reputation indication, a user interface for the Web browser to present at the computing device; and

presenting the user interface for the Web browser at the computing device, the user interface including a different link to a different location of the file from the link to the location of the file included in the information sent to the remote reputation service, the different link being provided by the remote reputation service for inclusion in the user interface.

2. The method as recited in claim 1, wherein the reputation indication includes a rating indicating whether the file is a low risk for being malware or a high risk for being malware, and the determining comprises determining that the user interface includes no warnings regarding the file if the file is a low risk for being malware, and determining that the user interface includes one or more warnings regarding the file if the file is a high risk for being malware.

3. The method as recited in claim 1, wherein the determining comprises determining, based at least in part on the reputation indication, that the user interface is to include a warning indicating that the file is rarely downloaded from the Web by other users.

4. The method as recited in claim 1, wherein the determining comprises determining, based at least in part on the reputation indication, that the user interface is to include a warning indicating that a version of a program in the file has been unreliable for other users.

5. The method as recited in claim 1, wherein the different link is provided by the remote reputation service for inclusion in the user interface in response to the remote reputation service identifying a version of the file that is more secure than a current version of the file.

6. The method as recited in claim 1, wherein the determining comprises determining, based at least in part on the reputation indication, that the user interface is to include a warning specific to the file.

7. The method as recited in claim 1, further comprising:

receiving, from a user of the computing device, a user action in response to the user interface; and

sending an indication of the user action to the remote reputation service for subsequent use by the remote reputation server in determining subsequent reputation indications for the file or for other files.

8. The method as recited in claim 1, wherein the information identifying the file comprises a hash value generated by applying a hash function to the file, and a digital signature of the file generated by a publisher of the file.

9. The method as recited in claim 1, wherein the information identifying the file comprises:

a hash value generated by applying a hash function to the file;

a uniform resource locator (URL) from which the file was obtained;

an identifier of a version of the file;

an indication of whether metadata associated with the file includes a valid digital signature of the file, and the valid digital signature of the file if the metadata associated with the file includes the valid digital signature of the file;

an identifier of an antivirus program analyzing the file; and

an indication of whether the antivirus program indicated that the file was clean or infected.

10. The method as recited in claim 1, wherein the reputation indication comprises:

a rating for the file that identifies which of one or more user interface components, if any, are to be included in the user interface;

an indication of different types of programs for which the remote reputation service maintains reputation information; and

an indication of whether antivirus results from an antivirus program analyzing the file are to be provided to the remote reputation service for subsequently obtained files.

11. The method as recited in claim 1, wherein the reputation indication comprises a rating, the rating comprises one of multiple different ratings each associated with different one or more user interface components, and the determining comprises including the identified one or more user interface components that are associated with the rating in the presented user interface.

12. The method as recited in claim 1, wherein the determining comprises determining that the user interface includes no warnings regarding the file.

13. The method as recited in claim 1, wherein the determining comprises determining that the user interface is to include an indication that the file includes malware and thus is being deleted, the method further comprising deleting the file.

14. A computing device comprising:

one or more processors; and

one or more computer storage media having stored thereon multiple instructions that implement a module of a Web browser and that, when executed by the one or more processors, cause the one or more processors to;

obtain, based on a file downloaded via a network, file information identifying the file, the file information including an identifier of an antivirus program used to analyze the downloaded file;

send both the file information that includes the identifier of the antivirus program used to analyze the downloaded file and client information identifying aspects of the computing device to a remote reputation service;

receive a reputation indication from the remote reputation service, the reputation indication identifying reputation information for the file based on both the file information and the client information;

associate one or more user interface components with the reputation indication;

determine, based at least in part on the reputation indication, a user interface for the Web browser to present at the computing device, the user interface including the one or more user interface components associated with the reputation indication; and

include, in the determined user interface for the Web browser, an indication, provided by the remote reputation service, of whether the antivirus program used to analyze the downloaded file is to be trusted.

15. The computing device as recited in claim 14, wherein to determine the user interface is to determine, based at least in part on the reputation indication, that the user interface is to include a link to a different version of a program in the file in place of a current version of the program.

16. The computing device as recited in claim 14, wherein the instructions further cause the one or more processors to:

receive, from a user of the computing device, a user action in response to the user interface being presented to the user; and

send an indication of the user action to the remote reputation service for subsequent use by the remote reputation server in determining reputation indications for the file.

17. The computing device as recited in claim 14, wherein:

the file information comprises;

a hash value generated by applying a hash function to the file,

a uniform resource locator (URL) from which the file was obtained,

an identifier of a version of the file,

an indication of whether metadata associated with the file includes a valid digital signature of the file, and the valid digital signature of the file if the metadata associated with the file includes the valid digital signature of the file; and

the client information comprises an identifier of an antivirus program analyzing the file; and

an indication of whether the antivirus program indicated that the file was clean or infected.

18. The computing device as recited in claim 14, wherein the reputation indication comprises an indication of whether antivirus results from an antivirus program analyzing the file are to be provided to the remote reputation service for subsequently obtained files.

19. The computing device as recited in claim 14, wherein to determine the user interface is to determine that the user interface is to include no warnings regarding dangers of installing the file.

20. A computing device comprising:

one or more processors; and

one or more computer storage media having stored thereon multiple instructions that implement a module of a Web browser and that, when executed by the one or more processors, cause the one or more processors to;

obtain information identifying a file;

send the information identifying the file, as well as client information identifying the Web browser of the computing device that obtained the file, to a remote reputation service, the information identifying the file including a link to a location of the file;

receive, from the remote reputation service, a reputation indication for the file, the reputation indication being based on both the information identifying the file and the client information;

identify one or more user interface components associated with the reputation indication;

determine, based at least in part on the identified one or more user interface components associated with the reputation indication, a user interface for the Web browser to present at the computing device; and

present the user interface for the Web browser at the computing device, the user interface including a different link to a different location of the file from the link to the location of the file included in the information sent to the remote reputation service, the different link being provided by the remote reputation service for inclusion in the user interface.