Systems and methods for determining potential impacts of applications on the security of computing systems

Patent metadata

Field	Value
Publication number	US-9501649-B2
Application number	US-201313838613-A
Country	US
Kind code	B2
Filing date	Mar 15, 2013
Priority date	Mar 15, 2013
Publication date	Nov 22, 2016
Grant date	Nov 22, 2016

Abstract

A computer-implemented method for determining potential impacts of applications on the security of computing systems may include (1) identifying an application subject to a security vulnerability assessment, (2) requesting information that identifies a potential impact of the application on a vulnerability of at least one computing system to at least one exploit associated with the application, (3) receiving the information that identifies the potential impact of the application on the vulnerability of the computing system, wherein the information may be derived at least in part from data from at least one additional computing system on which the application has previously been installed and (4) directing a determination about an installation of the application on the computing system based at least in part on the information that identifies the potential impact of the application on the vulnerability of the computing system. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for determining potential impacts of applications on the security of computing systems, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying an application subject to a security vulnerability assessment that includes an assessment of how the application may interfere with one or more components of a computing system that may create a vulnerability in the computing system, the one or more components comprising at least one of a hardware component of the computing system or a software component of the computing system;
requesting information that identifies a potential impact of the application on a vulnerability of the computing system to at least one exploit associated with the application by submitting information about the one or more components of the computing system;
receiving the information that identifies the potential impact of the application on the vulnerability of the computing system, wherein:
the information that identifies the potential impact of the application is derived at least in part from a statistical analysis correlating at least one of the one or more components of the computing system with at least one event on at least one additional computing system on which the application has previously been installed;
the event indicates the exploit associated with the application;
one or more components of the additional computing system match at least one of the one or more components of the computing system;
the information that identifies the potential impact is based at least in part on the one or more components of the computing system;

directing a determination about an installation of the application on the computing system based at least in part on the information that identifies the potential impact of the application on the vulnerability of the computing system, wherein:
the installation comprises an automatic update of a previous version of the application to a newer version of the application;
directing the determination about the installation comprises blocking the automatic update of the previous version of the application on the computing system to the newer version of the application.

2. The computer-implemented method of claim 1 , wherein identifying the application subject to the security vulnerability assessment comprises receiving, at a security server, a request from a user of the computing system to respond with information regarding whether the application is safe to install and/or or whether installing the application will create a vulnerability on the computing system.

3. The computer-implemented method of claim 1 , wherein identifying the application subject to the security vulnerability assessment comprises identifying the application in response to identifying a download of the application to the computing system.

4. The computer-implemented method of claim 1 , wherein identifying the application subject to the security vulnerability assessment comprises identifying the application in response to identifying an attempt to automatically update the previous version of the application.

5. The computer-implemented method of claim 1 , wherein directing the determination about the installation of the application on the computing system comprises:
determining, based on the information that identifies the potential impact of the application, that the application will create the vulnerability on the computing system if installed on the computing system;
blocking the automatic update based at least in part on determining that the application will create the vulnerability.

6. The computer-implemented method of claim 1 , wherein identifying the application subject to the security vulnerability assessment comprises identifying an attempted update to the previous version of the application.

7. The computer-implemented method of claim 1 , wherein identifying the application subject to the security vulnerability assessment comprises identifying the application by scanning the computing system for a program for installing applications.

8. The computer-implemented method of claim 1 , wherein the information that identifies the potential impact of the application is derived at least in part from at least one of:
events on the additional computing system before the application is installed and/or updated on the additional computing system;
events on the additional computing system after the application is installed and/or updated on the additional computing system;
events on the additional computing system after the application is removed from the additional computing system.

9. The computer-implemented method of claim 1 , wherein blocking the automatic update comprises quarantining the computing system by installing the application in a virtualization layer of the computing system that overlays a base file system of the computing system, wherein the virtualization layer is managed by a file system filter that redirects calls which are initially directed to locations within the base file system to locations within the virtualization layer.

10. The computer-implemented method of claim 1 , wherein the one or more components of the computing system comprise at least one of:
a processor of the computing system;
a memory device of the computing system;
a storage device of the computing system;
an operating system of the computing system;
a dynamic-link of the computing system.

11. A system for determining potential impacts of applications on the security of computing systems, the system comprising:
an identification module programmed to identify an application subject to a security vulnerability assessment that includes an assessment of how the application may interfere with one or more components of a computing system that may create a vulnerability in the computing system, the one or more components comprising at least one of a hardware component of the computing system or a software component of the computing system;
a requesting module programmed to request information that identifies a potential impact of the application on a vulnerability of the computing system to at least one exploit associated with the application by submitting information about the one or more components of the computing system;
a receiving module programmed to receive the information that identifies the potential impact of the application on the vulnerability of the computing system, wherein:
the information that identifies the potential impact of the application is derived at least in part from a statistical analysis correlating at least one of the one or more components of the computing system with at least one event on at least one additional computing system on which the application has previously been installed;
the event indicates the exploit associated with the application;
one or more components of the additional computing system match at least one of the one or more components of the computing system;
the information that identifies the potential impact is based at least in part on the one or more components of the computing system;

a direction module programmed to direct a determination about an installation of the application on the computing system based at least in part on the information that identifies the potential impact of the application on the vulnerability of the computing system, wherein:
the installation comprises an automatic update of a previous version of the application to a newer version of the application;
the direction module directs the determination about the installation by blocking the automatic upda

Assignees

• Symantec Corp

Inventors

• Sharma Piyush
• Ashley Peter

Classifications

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F8/61

  Installation · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F8/60 Primary

  Software deployment · CPC title