Back to results
US 8,800,030 B2Granted
Individualized time-to-live for reputation scores of computer files
AssigneeSymantec Corporation
InventorsVijay Seshadri, Zulfikar Ramzan, James Hoagland, Adam L. Glick, Adam Wright
Life of this patent
Estimating the term…
Abstract
An individualized time-to-live (TTL) is determined for a reputation score of a computer file. The TTL is determined based on the reputation score and the confidence in the reputation score. The confidence can be determined based on attributes such as the reputation score, an age of the file, and a prevalence of the file. The reputation score is used to determine whether the file is malicious during a validity period defined by the TTL, and discarded thereafter.
Claims14
A computer-implemented method for generating an individualized time-to-live (TTL) for a reputation score of a file, comprising:
- receiving, at a security system, a request from a client system, the request comprising an identifier of a file identified by the client system;
- generating a reputation score of the file based on reputation information of the file received from a plurality of client systems, the reputation score representing an assessment of a trustworthiness of the file;
- determining a confidence score for the reputation score based on the reputation information received from the plurality of client systems, the confidence score measuring a likelihood of the reputation score reflecting actual trustworthiness of the file, wherein determining the confidence score comprises at least one of:
- determining an age of the file, wherein the confidence score for a reputation score associated with an old file is higher than the confidence score for a reputation score associated with a young file;
- and
- determining a prevalence of the file among client systems, wherein the confidence score for a reputation score associated with a prevalent file is higher than the confidence score for a reputation score associated with a less prevalent file;
- computing, by the security system, a TTL for the reputation score based on the reputation information received from the plurality of client systems and the confidence score, the TTL describing a validity period for the reputation score, wherein a validity period described by a TTL for a reputation score associated with a high confidence score is longer than a validity period described by a TTL for a reputation score associated with a low confidence score;
- and
- transmitting the reputation score and the TTL to the client system in response to the request.
6 more elements
A computer system for generating an individualized time-to-live (TTL) for a reputation score of a file, comprising:
- a processor for executing computer program code;
- and
- a non-transitory computer-readable storage medium storing executable computer program code comprising:
- a communication module for receiving a request from a client system at a security system, the request comprising an identifier of a file identified by the client system;
- a reputation score generation module for generating a reputation score of the file based on reputation information received from a plurality of client systems, the reputation score representing an assessment of a trustworthiness of the file;
- a confidence determination module for determining a confidence score for the reputation score based on the reputation information received from the plurality of client systems, the confidence score measuring a likelihood of the reputation score reflecting actual trustworthiness of the file, wherein determining the confidence score comprises at least one of:
- determining an age of the file, wherein the confidence score for a reputation score associated with an old file is higher than the confidence score for a reputation score associated with a young file;
- and
- determining a prevalence of the file among client systems, wherein the confidence score for a reputation score associated with a prevalent file is higher than the confidence score for a reputation score associated with a less prevalent file;
- and
- a TTL determination module for computing a TTL for the reputation score based on the reputation information received from the plurality of client systems and the confidence score, the TTL describing a validity period for the reputation score, wherein a validity period described by a TTL for a reputation score associated with a high confidence score is longer than a validity period described by a TTL for a reputation score associated with a low confidence score;
- wherein the communication module is further configured for transmitting the reputation score and the TTL to the client system in response to the request.
9 more elements
A non-transitory computer-readable storage medium encoded with executable computer program code for generating an individualized time-to-live (TTL) for a reputation score of a file, the computer program code comprising program code for:
- receiving, at a security system, a request from a client system, the request comprising an identifier of a file identified by the client system;
- generating a reputation score of the file based on reputation information received from a plurality of client systems, the reputation score representing an assessment of a trustworthiness of the file;
- determining a confidence score for the reputation score based on the reputation information received from the plurality of client systems, the confidence score measuring a likelihood of the reputation score reflecting actual trustworthiness of the file, wherein determining the confidence score comprises at least one of:
- determining an age of the file, wherein the confidence score for a reputation score associated with an old file is higher than the confidence score for a reputation score associated with a young file;
- and
- determining a prevalence of the file among client systems, wherein the confidence score for a reputation score associated with a prevalent file is higher than the confidence score for a reputation score associated with a less prevalent file;
- determining a TTL for the reputation score based on the reputation information received from the plurality of client systems and the confidence score, the TTL describing a validity period for the reputation score, wherein a validity period described by a TTL for a reputation score associated with a high confidence score is longer than a validity period described by a TTL for a reputation score associated with a low confidence score;
- and
- transmitting the reputation score and the TTL to the client system in response to the request.
6 more elements
Dependencies are inferred from the claim text.