Chunk-based file acquisition and file reputation evaluation

• US 9,398,036 B2
• Filed: 09/17/2014
• Issued: 07/19/2016
• Est. Priority Date: 09/17/2014
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Penta, Anthony, Sim, Robert Alexander, Seifert, Christian, Haber, Elliott Jeb, Kasperkiewicz, Tomasz
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US14/488,719
• Publication Number:
  US 20160080400A1
• Time in Patent Office: 671 Days
• Field of Search: 726 22- 25
• US Class Current: 1/1
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks

Abstract

One or more techniques and/or systems are provided for file acquisition for reputation evaluation. A reputation service may be configured to evaluate files and provide reputations of such files to clients (e.g., an indication as to whether a file is safe or malicious). If the reputation service receives a reputation request for a file that is unknown to the reputation service (e.g., a file not yet fully acquired by the reputation service), then the reputation service may identify a set of chunks into which the file can be partitioned. The reputation service may obtain chunks from various clients, such as a first chunk from a first client and a second chunk from a second client. Such chunks may be evaluated to assign a reputation to the file. In this way, the reputation service may retrieve portions of a file in a distributed manner for reputation evaluation.

Claims

1. A method, implemented at a computer system that includes one or more processors, for file acquisition and reputation evaluation, comprising:

receiving a first reputation request from a first computer client, the first reputation request comprising a unique file identifier of a particular file;

based at least on receiving the first reputation request;

determining that there is no existing reputation that corresponds to the unique file identifier of the particular file; and

based at least on determining that there is no existing reputation that corresponds to the unique file identifier of the particular file;

identifying a set of chucks into which the particular file can be partitioned, each chunk comprising a portion of the particular file;

requesting a first chunk of the set of chunks from the first computer client and

receiving the first chunk of the set of chunks from the first computer client;

subsequent to receiving the first reputation request, receiving a second reputation request from a second computer client, the second reputation request comprising the unique file identifier of the particular file;

based at least on receiving the second reputation request, and based at least on having identified the set of chucks into which the file can be partitioned;

requesting a second chunk of the set of chunks from the second computer client and

receiving the second chunk of the set of chunks from the second computer client; and

based at least on receiving the first chunk of the set of chunks from the first computer client, and based at least on receiving the second chunk of the set of chunks from the second computer client, calculating a particular reputation for the particular file.

2. The method of claim 1, further comprising:

generating a distribution curve based upon the set of chunks, the distribution curve specifying a distribution of chunks within the set of chunks that are to be retrieved from clients.

3. The method of claim 2, the distribution comprising at least one of a random distribution, a sequential distribution, an ordered distribution, an overlapping distribution, a prioritization distribution, or an ordered overlapping distribution.

4. The method of claim 1, further comprising:

retrieving the first chunk from a third computer client based upon an overlapping distribution specifying redundant retrieval for the first chunk.

5. The method of claim 1, the first chunk comprising overlapping file data with respect to the second chunk.

6. The method of claim 1, the identifying a set of chucks comprising:

assigning retrieval priorities to respective chunks within the set of chunks.

7. The method of claim 6, the assigning retrieval priorities comprising:

assigning a first retrieval priority to the first chunk that is higher than a second retrieval priority assigned to the second chunk based upon a determination that the first chunk has a first reputation evaluation relevancy greater than a second reputation evaluation relevancy of the second chunk.

8. The method of claim 1, further comprising:

receiving a transmission initiation of a third chunk of the file from a third computer client;

responsive to the third chunk having been previously retrieved, cancelling transmission of the third chunk;

or

responsive to determining that the third chunk has not yet been retrieved, accepting the transmission of the third chunk.

9. The method of claim 1, further comprising:

querying a file reputation data structure using the unique file identifier to determine whether the reputation exists.

10. The method of claim 1, further comprising:

assigning the particular reputation to the unique file identifier, and providing the reputation to at least one of the first computer client and the second computer client.

11. The method of claim 1, further comprising:

comparing the first chunk, from the first computer client, to a second instance of the first chunk, from a computer client other than the first computer client, to verify that the first chunk, from the first computer client, is received in a non-tampered state.

12. The method of claim 1, further comprising:

scheduling a future acquisition of a third chunk of the particular file from at least one of the first computer client, the second computer client, or a third computer client.

13. The method of claim 1, requesting the first chunk comprising:

identifying an operating context of the first computer client; and

scheduling acquisition of the first chunk from the first computer client based upon the operating context corresponding to an upload policy.

14. The method of claim 1, further comprising:

assigning indicators to respective chunks within the set of chunks; and

responsive to retrieving the first chunk, setting a first indicator for the first chunk to an acquired state.

15. A computer system, comprising:

one or more processors; and

one or more computer-readable media having stored thereon computer-executable instructions that are executable by the one or more processors to cause the computer system to acquire a file and evaluate reputation of the file, the computer-executable instructions including instructions that are executable to cause the computer system to perform at least the following;

receive a first reputation request from a first computer client, the first reputation request comprising a unique file identifier of a particular file;

based at least on receiving the first reputation request;

determine that there is no existing reputation that corresponds to the unique file identifier of the particular file; and

based at least on determining that there is no existing reputation that corresponds to the unique file identifier of the particular file;

identify a set of chucks into which the particular file can be partitioned, each chunk comprising a portion of the particular file;

request a first chunk of the set of chunks from the first computer client; and

receive the first chunk of the set of chunks from the first computer client;

subsequent to receiving the first reputation request, receive a second reputation request from a second computer client, the second reputation request comprising the unique file identifier of the particular file;

based at least on receiving the second reputation request, and based at least on having identified the set of chucks into which the file can be partitioned;

request a second chunk of the set of chunks from the second computer client; and

receive the second chunk of the set of chunks from the second computer client; and

based at least on receiving the first chunk of the set of chunks from the first computer client, and based at least on receiving the second chunk of the set of chunks from the second computer client, calculate a particular reputation for the particular file.

16. The computer system of claim 15, the computer-executable instructions also including instructions that are executable to cause the computer system to assign a first retrieval priority to the first chunk that is higher than a second retrieval priority assigned to the second chunk based upon a determination that the first chunk has a first reputation evaluation relevancy greater than a second reputation evaluation relevancy of the second chunk.

17. The computer system of claim 15, the computer-executable instructions also including instructions that are executable to cause the computer system to schedule a future acquisition of a third chunk of the particular file from at least one of the first computer client, the second computer client, or a third computer client.

18. The computer system of claim 15, the computer-executable instructions also including instructions that are executable to cause the computer system to compare the first chunk, from the first computer client, to a second instance of the first chunk, from a computer client other than the first computer client, to verify that the first chunk, from the first computer client, is received in a non-tampered state.

19. The computer system of claim 15, the computer-executable instructions also including instructions that are executable to cause the computer system to:

identify an operating context of the first computer client; and

schedule acquisition of the first chunk from the first computer client based upon the operating context corresponding to an upload policy.

20. A computer program product comprising one or more hardware storage devices having stored thereon computer-executable instructions that are executable by one or more processors of a computer system to cause the computer system to acquire a file and evaluate reputation of the file, the computer-executable instructions including instructions that are executable to cause the computer system to perform at least the following:

receive a first reputation request from a first computer client, the first reputation request comprising a unique file identifier of a particular file;

based at least on receiving the first reputation request;

determine that there is no existing reputation that corresponds to the unique file identifier of the particular file; and

based at least on determining that there is no existing reputation that corresponds to the unique file identifier of the particular file;

identify a set of chucks into which the particular file can be partitioned, each chunk comprising a portion of the particular file;

request a first chunk of the set of chunks from the first computer client; and

receive the first chunk of the set of chunks from the first computer client;

subsequent to receiving the first reputation request, receive a second reputation request from a second computer client, the second reputation request comprising the unique file identifier of the particular file;

based at least on receiving the second reputation request, and based at least on having identified the set of chucks into which the file can be partitioned;

request a second chunk of the set of chunks from the second computer client; and

receive the second chunk of the set of chunks from the second computer client; and

based at least on receiving the first chunk of the set of chunks from the first computer client, and based at least on receiving the second chunk of the set of chunks from the second computer client, calculate a particular reputation for the particular file.