# US 11,308,207 B2 · User verification of malware impacted files > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,207 B2 - Document ID: US11308207B2 - Status: Granted - Kind: B2 - Application number: 15/941,219 - Filed: 2018-03-30 - Published: 2019-10-03 - Granted: 2022-04-19 - Earliest claimed: 2018-03-30 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Filip Chelarescu; Benjamin N. Truelove; Meir E. Abergel; Parthipan Thayanithy - Web page: https://patentgrep.com/patent/US11308207B2 ## CPC - G06F 21/565: {by checking file integrity} - G06F 11/1451: {by selection of backup contents} - G06F 16/1734: {Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs} - G06F 21/554: {involving event detection and direct action} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/568: {eliminating virus, restoring damaged files} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A cloud storage server accesses a plurality of server-stored files of a cloud storage account of a client device. The cloud storage server determines that one or more server-stored files from the plurality of server-stored files are affected by a malware activity. The cloud storage server generates a graphical user interface that includes a detection notification and a confirmation request, the detection notification indicating a detected presence of malware in the one or more server-stored files and metadata corresponding to the one or more server-stored files, the confirmation request indicating a request for the client device to confirm the detected presence of malware in the one or more server-stored files. A confirmation response is received from the client device. The confirmation response identifies at least one of the one or more server-stored files and confirming the presence of malware activity in the identified server-stored files. ## Claims ### Claim 1 A computer-implemented method comprising: accessing, by a cloud storage server, a plurality of server-stored files of a cloud storage account of a client device; determining that one or more server-stored files from the plurality of server-stored files are affected by a malware activity; generating a graphical user interface that includes a detection notification and a confirmation request, the detection notification indicating a detected presence of malware in the one or more server-stored files and metadata corresponding to the one or more server-stored files, the metadata indicating a suspicious file renaming activity and an indication whether the one or more server-stored files are shared with other client devices registered with the cloud storage server, the confirmation request indicating a request for the client device to confirm the detected presence of malware in the one or more server-stored files; receiving a confirmation response from the client device, the confirmation response identifying at least one of the one or more server-stored files and confirming the presence of malware activity in the identified server-stored files; and training a malware detection model based on the confirmation response from the client device, feedback from other users or client devices with files sharing a same attribute or feature of the one or more server-stored files, features of the one or more server-stored files, and metadata corresponding to the one or more server-stored files, wherein the determining of the malware activity is based on the malware detection model. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the metadata comprises a server-stored file name, a server-stored extension name, a type of activity identifying a nature of a modification of a corresponding server-stored file, a name of a user who last modified a corresponding server-stored file, and a time of the modification. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, wherein the metadata comprises an identification of a subset of the one or more server-stored files, the subset identified based on one of a common server-stored extension name, a common type of activity, and a common name of the user who last modified the subset of the one or more server-stored files. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the metadata comprises an identification of a subset of the one or more server-stored files, the subset identified based on a common server-stored file share attribute identifying a shared user, wherein the method further comprises: generating a malware notification to the shared user, the malware notification identifying the subset of the one or more server-stored files as malware impacted. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, comprising: restoring the identified server-stored files to a non-compromised version of the identified server-stored files at the cloud storage server based on a time at which the identified server-stored files became affected by the malware activity at the cloud storage server. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, comprising: receiving, at the cloud storage server, a request from the client device to store a file at the cloud storage server; storing the file in a storage device of the cloud storage server; determining features of the server-stored file; detecting the malware activity based on the features of the server-stored file, receiving, from the client device, a malware confirmation indicating a confirmation of the presence of the malware activity in the server-stored file; and updating an operation of the detection of the malware activity based on the received malware confirmation. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, wherein determining features of the server-stored file comprises: identifying an encryption status of the server-stored file; identifying a name extension of the server-stored file; identifying a content type of the server-stored file; and identifying a previous user feedback related to the server-stored file. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, further comprising: determining that the encryption status indicates that the server-stored file is encrypted and that a previous version of the server-stored file is unencrypted; determining that the name extension or a file name of the server-stored file is indicative of the malware activity; determining that the content type of the server-stored file does not correspond with a content associated with the name extension of the server-stored file; and determining the previous user feedback in response to previous malware notifications related to the server-stored file. ### Claim 9 (depends on 6) The computer-implemented method of claim 6, wherein updating the operation of the detecting the malware activity further comprises: identifying at least one of the server-stored file name or the server-stored name extension as safe from the malware activity in response to the confirmation response indicating an absence of the malware activity in the server-stored file. ### Claim 10 (depends on 6) The computer-implemented method of claim 6, wherein updating the operation of the detection of the malware activity further comprises: identifying at least one of the server-stored file name or the server-stored name extension as safe from the malware activity in response to the confirmation response indicating the absence of the malware activity in a client-stored file copy of the server-stored file. ### Claim 11 A system comprising: one or more hardware processors; and a memory storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising: accessing, by a cloud storage server, a plurality of server-stored files of a cloud storage account of a client device; determining that one or more server-stored files from the plurality of server-stored files are affected by a malware activity; generating a graphical user interface that includes a detection notification and a confirmation request, the detection notification indicating a detected presence of malware in the one or more server-stored files and metadata corresponding to the one or more server-stored files, the metadata indicating a suspicious file renaming activity and an indication whether the one or more server-stored files are shared with other client devices registered with the cloud storage server, the confirmation request indicating a request for the client device to confirm the detected presence of malware in the one or more server-stored files; receiving a confirmation response from the client device, the confirmation response identifying at least one of the one or more server-stored files and confirming the presence of malware activity in the identified server-stored files; and training a malware detection model based on the confirmation response from the client device, feedback from other users or client devices with files sharing a same attribute or feature of the one or more server-stored files, features of the one or more server-stored files, and metadata corresponding to the one or more server-stored files, wherein the determining of the malware activity is based on the malware detection model. ### Claim 12 (depends on 11) The system of claim 11, wherein the metadata comprises a server-stored file name, a server-stored extension name, a type of activity identifying a nature of a modification of a corresponding server-stored file, a name of a user who last modified a corresponding server-stored file, and a time of the modification. ### Claim 13 (depends on 12) The system of claim 12, wherein the metadata comprises an identification of a subset of the one or more server-stored files, the subset identified based on one of a common server-stored extension name, a common type of activity, and a common name of the user who last modified the subset of the one or more server-stored files. ### Claim 14 (depends on 11) The system of claim 11, wherein the metadata comprises an identification of a subset of the one or more server-stored files, the subset identified based on a common server-stored file share attribute identifying a shared user, wherein the operations further comprise: generating a malware notification to the shared user, the malware notification identifying the subset of the one or more server-stored files as malware impacted. ### Claim 15 (depends on 11) The system of claim 11, wherein the operations further comprise: restoring the identified server-stored files to a non-compromised version of the identified server-stored files at the cloud storage server based on a time at which the identified server-stored files became affected by the malware activity at the cloud storage server. ### Claim 16 (depends on 11) The system of claim 11, wherein the operations further comprise: receiving, at the cloud storage server, a request from the client device to store a file at the cloud storage server; storing the file in a storage device of the cloud storage server; determining features of the server-stored file; detecting the malware activity based on the features of the server-stored file, receiving, from the client device, a malware confirmation indicating a confirmation of the presence or an absence of the malware activity in the server-stored file; and updating an operation of the detection of the malware activity based on the received malware confirmation. ### Claim 17 (depends on 16) The system of claim 16, wherein determining features of the server-stored file comprises: identifying an encryption status of the server-stored file; identifying a name extension of the server-stored file; identifying a content type of the server-stored file; and identifying a previous user feedback related to the server-stored file. ### Claim 18 (depends on 17) The system of claim 17, wherein detecting the malware activity comprises: determining that the encryption status indicates that the server-stored file is encrypted and that a previous version of the server-stored file is unencrypted; determining that the name extension or a file name of the server-stored file is indicative of the malware activity; determining that the content type of the server-stored file does not correspond with a content associated with the name extension of the server-stored file; and determining the previous user feedback in response to previous malware notifications related to the server-stored file. ### Claim 19 (depends on 16) The system of claim 16, wherein updating the operation of the detecting the malware activity further comprises: identifying at least one of the server-stored file name or the server-stored name extension as safe from the malware activity in response to the confirmation response indicating the absence of the malware activity in the server-stored file. ### Claim 20 A machine-storage medium storing instructions that, when executed by one or more processors of a machine, cause the one or more processors to perform operations comprising: accessing, by a cloud storage server, a plurality of server-stored files of a cloud storage account of a client device; determining that one or more server-stored files from the plurality of server-stored files are affected by a malware activity; generating a graphical user interface that includes a detection notification and a confirmation request, the detection notification indicating a detected presence of malware in the one or more server-stored files and metadata corresponding to the one or more server-stored files, the metadata indicating a suspicious file renaming activity and an indication whether the one or more server-stored files are shared with other client devices registered with the cloud storage server, the confirmation request indicating a request for the client device to confirm the detected presence of malware in the one or more server-stored files; receiving a confirmation response from the client device, the confirmation response identifying at least one of the one or more server-stored files and confirming the presence of malware activity in the identified server-stored files; and training a malware detection model based on the confirmation response from the client device, feedback from other users or client devices with files sharing a same attribute or feature of the one or more server-stored files, features of the one or more server-stored files, and metadata corresponding to the one or more server-stored files, wherein the determining of the malware activity is based on the malware detection model.