Chunk-based file acquisition and file reputation evaluation

Patent metadata

Field	Value
Publication number	US-9398036-B2
Application number	US-201414488719-A
Country	US
Kind code	B2
Filing date	Sep 17, 2014
Priority date	Sep 17, 2014
Publication date	Jul 19, 2016
Grant date	Jul 19, 2016

Abstract

One or more techniques and/or systems are provided for file acquisition for reputation evaluation. A reputation service may be configured to evaluate files and provide reputations of such files to clients (e.g., an indication as to whether a file is safe or malicious). If the reputation service receives a reputation request for a file that is unknown to the reputation service (e.g., a file not yet fully acquired by the reputation service), then the reputation service may identify a set of chunks into which the file can be partitioned. The reputation service may obtain chunks from various clients, such as a first chunk from a first client and a second chunk from a second client. Such chunks may be evaluated to assign a reputation to the file. In this way, the reputation service may retrieve portions of a file in a distributed manner for reputation evaluation.

First claim

What is claimed is:

1. A method, implemented at a computer system that includes one or more processors, for file acquisition and reputation evaluation, comprising:
receiving a first reputation request from a first computer client, the first reputation request comprising a unique file identifier of a particular file;
based at least on receiving the first reputation request:
determining that there is no existing reputation that corresponds to the unique file identifier of the particular file; and
based at least on determining that there is no existing reputation that corresponds to the unique file identifier of the particular file:
identifying a set of chucks into which the particular file can be partitioned, each chunk comprising a portion of the particular file;
requesting a first chunk of the set of chunks from the first computer client and
receiving the first chunk of the set of chunks from the first computer client;

subsequent to receiving the first reputation request, receiving a second reputation request from a second computer client, the second reputation request comprising the unique file identifier of the particular file;
based at least on receiving the second reputation request, and based at least on having identified the set of chucks into which the file can be partitioned:
requesting a second chunk of the set of chunks from the second computer client and
receiving the second chunk of the set of chunks from the second computer client; and

based at least on receiving the first chunk of the set of chunks from the first computer client, and based at least on receiving the second chunk of the set of chunks from the second computer client, calculating a particular reputation for the particular file.

2. The method of claim 1 , further comprising:
generating a distribution curve based upon the set of chunks, the distribution curve specifying a distribution of chunks within the set of chunks that are to be retrieved from clients.

3. The method of claim 2 , the distribution comprising at least one of a random distribution, a sequential distribution, an ordered distribution, an overlapping distribution, a prioritization distribution, or an ordered overlapping distribution.

4. The method of claim 1 , further comprising:
retrieving the first chunk from a third computer client based upon an overlapping distribution specifying redundant retrieval for the first chunk.

5. The method of claim 1 , the first chunk comprising overlapping file data with respect to the second chunk.

6. The method of claim 1 , the identifying a set of chucks comprising:
assigning retrieval priorities to respective chunks within the set of chunks.

7. The method of claim 6 , the assigning retrieval priorities comprising:
assigning a first retrieval priority to the first chunk that is higher than a second retrieval priority assigned to the second chunk based upon a determination that the first chunk has a first reputation evaluation relevancy greater than a second reputation evaluation relevancy of the second chunk.

8. The method of claim 1 , further comprising:
receiving a transmission initiation of a third chunk of the file from a third computer client;
responsive to the third chunk having been previously retrieved, cancelling transmission of the third chunk; or
responsive to determining that the third chunk has not yet been retrieved, accepting the transmission of the third chunk.

9. The method of claim 1 , further comprising:
querying a file reputation data structure using the unique file identifier to determine whether the reputation exists.

10. The method of claim 1 , further comprising:
assigning the particular reputation to the unique file identifier, and providing the reputation to at least one of the first computer client and the second computer client.

11. The method of claim 1 , further comprising:
comparing the first chunk, from the first computer client, to a second instance of the first chunk, from a computer client other than the first computer client, to verify that the first chunk, from the first computer client, is received in a non-tampered state.

12. The method of claim 1 , further comprising:
scheduling a future acquisition of a third chunk of the particular file from at least one of the first computer client, the second computer client, or a third computer client.

13. The method of claim 1 , requesting the first chunk comprising:
identifying an operating context of the first computer client; and
scheduling acquisition of the first chunk from the first computer client based upon the operating context corresponding to an upload policy.

14. The method of claim 1 , further comprising:
assigning indicators to respective chunks within the set of chunks; and
responsive to retrieving the first chunk, setting a first indicator for the first chunk to an acquired state.

15. A computer system, comprising:
one or more processors; and
one or more computer-readable media having stored thereon computer-executable instructions that are executable by the one or more processors to cause the computer system to acquire a file and evaluate reputation of the file, the computer-executable instructions including instructions that are executable to cause the computer system to perform at least the following:
receive a first reputation request from a first computer client, the first reputation request comprising a unique file identifier of a particular file;
based at least on receiving the first reputation request:
determine that there is no existing reputation that corresponds to the unique file identifier of the particular file; and
based at least on determining that there is no existing reputation that corresponds to the unique file identifier of the particular file:
identify a set of chucks into which the particular file can be partitioned, each chunk comprising a portion of the particular file;
request a first chunk of the set of chunks from the first computer client; and
receive the first chunk of the set of chunks from the first computer client;

subsequent to receiving the first reputation request, receive a second reputation request from a second computer client, the second reputation request comprising the unique file identifier of the particular file;
based at least on receiving the second reputation request, and based at least on having identified the set of chucks into which the file can be partitioned:
request a second chunk of the set of chunks from the second computer client; and
receive the second chunk of the set of chunks from the second computer client; and

based at least on receiving the first chunk of the set of chunks from the first computer client, and based at least on receiving the second chunk of the set of chunks from the second computer client, calculate a particular reputation for the particular file.

16. The computer system of claim 15 , the computer-executable instructions also including instructions that are executable to cause the computer system to assign a first retrieval priority to the first chunk that is higher than a second retrieval priority assigned to the second chunk based upon a determination that the first chunk has a first reputation evaluation relevancy greater than a second reputation evaluation relevancy of the second chunk.

17. The computer system of claim 15 , the computer-executable instructions also including instructions that are executable to cause the computer system to schedule a future acquisition of a third chunk of the particular file from at least one of the first computer client, t

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Sim Robert Alexander
• Seifert Christian
• Penta Anthony
• Haber Elliott Jeb
• Kasperkiewicz Tomasz

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• G06F21/51

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• G06F16/182

  Distributed file systems · CPC title

• G06F21/56 Primary

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• H04L67/104 Primary

  Peer-to-peer [P2P] networks · CPC title