Identifying legitimate content using user-agent-based white listing

A non-transitory computer-readable storage medium storing executable computer program instructions for identifying legitimate content, the instructions comprising instructions for:

• establishing a list of trusted user-agent strings used by legitimate applications in downloading executable content from locations on a network;
• receiving content download descriptions from a plurality of traffic interception modules connected to the network, the traffic interception modules examining traffic exchanged between clients and servers on the network, recognizing traffic associated with downloads of executable content from the network, and creating content download descriptions identifying executable content downloaded from the network and user-agent strings involved in the executable content downloads;
• analyzing the content download descriptions to identify content downloads using trusted user-agent strings in the list;
• adding identifiers including digests of executable content downloaded from the network using the trusted user-agent strings to a white list of legitimate content;
• and
• providing a client with access to the white list of legitimate executable content, wherein the client is adapted to use the white list to identify legitimate executable content at the client.

A computer system for identifying legitimate content, comprising:

• a computer-readable storage medium storing executable computer program instructions comprising instructions for:
• examining executable content download requests from legitimate applications known to not contain malware to identify user-agent strings used by the legitimate applications;
• establishing, responsive to the examining, a list of trusted user-agent strings used by the legitimate applications to request executable content;
• identifying executable content downloaded from the network using the trusted user-agent strings in the list by receiving content download descriptions from a plurality of traffic interception modules connected to a network, the traffic interception modules examining traffic exchanged between clients and servers on the network;
• generating identifiers of the executable content downloaded from the network using trusted user-agent strings in the list, the identifiers including digests of the downloaded executable content;
• adding the generated identifiers of the executable content downloaded from the network using trusted user-agent strings to a white list of legitimate executable content;
• and
• providing a client with access to the white list of legitimate executable content, wherein the client is adapted to use the white list to identify legitimate executable content at the client;
• and
• a processor for executing the computer program instructions.