Adjudicating files by classifying directories based on collected telemetry data

Patent metadata

Field	Value
Publication number	US-11308212-B1
Application number	US-201916453766-A
Country	US
Kind code	B1
Filing date	Jun 26, 2019
Priority date	Jun 26, 2019
Publication date	Apr 19, 2022
Grant date	Apr 19, 2022

Abstract

Telemetry data from client file reputation queries is collected over time. Directories/sub-directories under which files of queries are located are identified. The files including the reputations for the files under a given directory/sub-directory are identified and used to calculate the reputation score for the directory/sub-directory. The directory/sub-directory is then classified based on the calculated score for the directory/sub-directory. After the classification of directories/sub-directories, reputation for a file with unknown reputation is then determined based on the classification of the directory/sub-directory under which the file is located.

First claim

What is claimed is:

1. A computer-implemented method for classifying directories of a file system, the method comprising:
analyzing telemetry data concerning a directory of the file system and files under the directory of the file system;
computing a reputation score for the directory of the file system based on a reputation of one or more of the files under the directory of the file system, wherein computing the reputation score for the directory includes computing a reputation score for each of a plurality of sub-directories of the directory; and
classifying the directory of the file system into one of known benign and known malicious based on the computed reputation score for the directory of the file system.

2. The method of claim 1 , further comprising:
collecting the telemetry data concerning the directory of the file system and the files under the directory from a file reputation database.

3. The method of claim 1 , wherein computing the reputation score for the directory based on the reputation of one or more of the files under the directory further comprises:
computing the reputation score for the directory based on reputation of files with ground truth, high good, and high bad reputation.

4. The method of claim 1 , wherein computing the reputation score for the directory further comprises:
computing the reputation score for the directory based on the number of computing devices that initiate a reputation query for the directory.

5. The method of claim 1 , wherein computing the reputation score for the directory further comprises:
parsing a full path of the directory into the plurality of sub-directories.

6. The method of claim 5 , wherein parsing the full path of the directory into the plurality of sub-directories further comprising:
parsing the full path of the directory in a parent-child hierarchy with a given number of levels.

7. The method of claim 6 , wherein classifying the directory into one of known benign and known malicious further comprising:
whitelisting a sub-directory at a highest level of the directory of the file system, the whitelisted sub-directory having a reputation score greater than a first threshold.

8. The method of claim 6 , wherein classifying the directory into one of known benign and known malicious further comprising:
blacklisting a sub-directory of a highest level of the directory of the file system, the blacklisted sub-directory having a reputation score less than a second threshold.

9. The method of claim 1 , further comprising:
receiving a query from a client for a reputation of a file with unknown reputation;
identifying a directory under which the file with unknown reputation is located; and
classifying the file with unknown reputation based on a classification of the directory under which the file with unknown reputation is located.

10. The method of claim 9 , wherein classifying the file with unknown reputation based on the classification of the directory under which the file with unknown reputation is located further comprises:
classifying the file with unknown reputation based on a classification of a sub-directory under which the file with unknown reputation is located.

11. The method of claim 9 , further comprising:
responsive to the file with unknown reputation being classified as malicious, generating an alert for the client indicating that the file with unknown reputation is malicious.

12. The method of claim 9 , further comprising:
responsive to the file with unknown reputation being classified as benign, automatically delivering a message to the client indicating that the file with unknown reputation is benign.

13. At least one non-transitory computer-readable storage medium for directory-based file reputation determination, the at least one non-transitory computer-readable storage medium storing computer executable instructions that, when loaded into computer memory and executed by at least one processor of a computing device, cause the computing device to perform the following steps:
analyzing telemetry data concerning a directory of a file system and files under the directory of the file system;
computing a reputation score for the directory of the file system based on a reputation of one or more of the files under the directory of the file system, wherein computing the reputation score for the directory includes computing a reputation score for each of a plurality of sub-directories of the directory; and
classifying the directory of the file system into one of known benign and known malicious based on the computed reputation score for the directory of the file system.

14. The at least one non-transitory computer-readable storage medium of claim 13 further storing computer-executable instructions to perform the following additional step:
collecting the telemetry data concerning the directory of the file system and the files under the directory from a file reputation database.

15. The at least one non-transitory computer-readable storage medium of claim 13 further storing computer-executable instructions to perform the following additional step:
computing the reputation score for the directory based on reputation of files with ground truth, high good, and high bad reputation.

16. The at least one non-transitory computer-readable storage medium of claim 13 further storing computer-executable instructions to perform the following additional step:
computing the reputation score for the directory based on the number of computing devices that initiate a reputation query for the directory.

17. The at least one non-transitory computer-readable storage medium of claim 13 further storing computer-executable instructions to perform the following additional step:
parsing a full path of the directory into the plurality of sub-directories.

18. The at least one non-transitory computer-readable storage medium of claim 17 further storing computer-executable instructions to perform the following additional step:
parsing the full path of the directory in a parent-child hierarchy with a given number of levels.

19. The at least one non-transitory computer-readable storage medium of claim 18 further storing computer-executable instructions to perform the following additional step:
whitelisting a sub-directory at a highest level of the directory of the file system, the whitelisted sub-directory having a reputation score greater than a first threshold.

20. A computer system for directory/sub-directory based file reputation determination, the computer system comprising:
at least one processor;
system memory;
a telemetry data analyzing module for analyzing telemetry data concerning a directory of a file system and files under the directory of the file system;
a directory reputation calculating module for computing a reputation score for the directory of the file system based on a reputation of one or more of the files under the directory of the file system, wherein computing the reputation score for the directory includes computing a reputation score for each of a plurality of sub-directories of the directory; and
a directory classifying module for classifying the directory of the file system into one of known benign and known malicious based on the computed reputation score for the directory of the file system.

Assignees

• Ca Inc

Inventors

• Zhu Qian
• Lichstein Alexander
• Sosa Daniel

Classifications

• G06F16/906

  Clustering; Classification · CPC title

• G06F16/164

  File meta data generation · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/562 Primary

  Static detection · CPC title

• G06F16/185

  Hierarchical storage management [HSM] systems, e.g. file migration or policies thereof (details of archiving G06F16/11) · CPC title