Systems and methods for determining trustworthiness of software programs

Patent metadata

Field	Value
Publication number	US-9065849-B1
Application number	US-201314030745-A
Country	US
Kind code	B1
Filing date	Sep 18, 2013
Priority date	Sep 18, 2013
Publication date	Jun 23, 2015
Grant date	Jun 23, 2015

Abstract

A computer-implemented method for determining trustworthiness of software programs may include (1) determining, for at least one software program, a prevalence score that indicates a prevalence of the software program within a local network, (2) obtaining, for the software program, a reputation score that indicates a reputation of the software program, (3) determining a trustworthiness of the software program based on both the reputation score of the software program and the prevalence score of the software program, and (4) performing a security action based on the trustworthiness of the software program. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for determining trustworthiness of software programs, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
determining, for at least one software program, a prevalence score that indicates a prevalence of the software program within a local network;
obtaining, for the software program, a reputation score that indicates a prevalence of the software program outside the local network;
comparing the prevalence score with the reputation score to a determine trustworthiness of the software program based on both the reputation score of the software program and the prevalence score of the software program;
performing a security action based on the trustworthiness of the software program.

2. The computer-implemented method of claim 1 , wherein the prevalence score comprises at least one of:
a percentage of devices within the local network on which the software program is present;
a number of instances of the software program installed within the local network.

3. The computer-implemented method of claim 1 , wherein comparing the prevalence score with the reputation score to determine the trustworthiness of the software program comprises:
determining, based on the prevalence score and the reputation score, that the prevalence of the software program in the local network is greater than the prevalence of the software program outside the local network;
determining, based the prevalence of the software program being greater inside the local network than outside the local network, that the software program is likely an internal program for the local network and does not comprise a malware threat.

4. The computer-implemented method of claim 1 , wherein obtaining the reputation score comprises:
calculating a total number of devices surveyed outside the local network on which the software program is installed;
calculating a percentage of devices surveyed outside the local network on which the software program is installed.

5. The computer-implemented method of claim 1 , further comprising:
conducting a malware deep scan on one or more devices in the local network to determine whether the software program potentially comprises malware;
determining that the prevalence score indicates that the software program has not been identified within the local network, wherein the prevalence score is based on an inventory of software programs used within the local network;
determining that the software program was identified during the malware deep scan;
determining, based on the software program not being identified in the inventory of software programs and being identified during the malware deep scan, that the software program may comprise a rootkit threat;
wherein the trustworthiness determination is further based on the determination that the software program may comprise the rootkit threat.

6. The computer-implemented method of claim 1 , wherein determining the prevalence score comprises taking an inventory of software programs installed on local devices within the local network by at least one of:
querying the local devices;
performing a remote scan of the local devices;
querying an application inventory system for inventory data about software applications installed within the local network.

7. The computer-implemented method of claim 1 , wherein comparing the prevalence score with the reputation score to determine the trustworthiness of the software program comprises:
determining that the prevalence score is below a threshold and indicates low prevalence of the software program in the local network;
determining that the reputation score indicates that the software program has not been identified outside the local network;
determining, based on the low prevalence of the software program in the local network and absence of the software program outside the local network, that the software program may comprise an advanced persistent threat.

8. The computer-implemented method of claim 1 , wherein comparing the prevalence score with the reputation score to determine the trustworthiness of the software program comprises:
determining that the prevalence score is below a local-prevalence threshold and indicates low prevalence of the software program in the local network;
determining that the reputation score indicates that the prevalence of the software program outside the local network is above a global-prevalence threshold and is therefore high;
determining, based on the low prevalence of the software program in the local network and the high prevalence of the software program outside the local network, that the software program does not comprise a malware threat.

9. The computer-implemented method of claim 1 , wherein comparing the prevalence score with the reputation score to determine the trustworthiness of the software program comprises:
determining that the prevalence score is below a local-prevalence threshold and indicates low prevalence of the software program in the local network;
determining that the reputation score indicates that the prevalence of the software program outside the local network is below a global-prevalence threshold and is therefore low;
determining, based on the low prevalence of the software program in the local network and the low prevalence of the software program outside the local network, that the software program may comprise a malware threat.

10. A system for determining trustworthiness of software programs, the system comprising:
a prevalence module, stored in memory, that determines, for at least one software program, a prevalence score that indicates a prevalence of the software program within a local network;
a reputation module, stored in memory, that obtains, for the software program, a reputation score that indicates a prevalence of the software program outside the local network;
a trustworthiness module, stored in memory, that compares the prevalence score with the reputation score to determine a trustworthiness of the software program based on both the reputation score of the software program and the prevalence score of the software program;
a security module, stored in memory, that performs a security action based on the trustworthiness of the software program;
at least one hardware processor that executes the prevalence module, the reputation module, the trustworthiness module, and the security module.

11. The system of claim 10 , wherein the prevalence score comprises at least one of:
a percentage of devices within the local network on which the software program is present;
a number of instances of the software program installed within the local network.

12. The system of claim 10 , wherein the trustworthiness module compares the prevalence score with the reputation score to determine the trustworthiness of the software program by:
determining, based on the prevalence score and the reputation score, that prevalence of the software program in the local network is greater than the prevalence of the software program outside the local network;
determining, based the prevalence of the software program being greater inside the local network than outside the local network, that the software program is likely an internal program for the local network and does not comprise a malware threat.

13. The system of claim 10 , wherein the reputation module obtains the reputation score by:
calculating a total number of devices surveyed outside the local network on which the software program is installed;
calculating a percentage of devices surveyed outside the local network

Assignees

• Symantec Corp

Inventors

• Rivera Shireen H
• Ashley Peter

Classifications

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title