Directory Reputation Scoring for File Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current file reputation service technologies face challenges in accelerating files from an unknown reputation status to a higher-confidence band, often relying on inaccurate placeholder values for files with unknown reputations.
Innovation Solution
The solution involves determining a file's reputation based on the reputation of its directory or sub-directory, using telemetry data from client queries to calculate a reputation score for these directories, and classifying them as benign or malicious, thereby assigning a more accurate reputation to files located within them.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If placeholder values are assigned to files with unknown reputations, then the system can provide immediate responses to clients, but the accuracy and reliability of file reputation determination deteriorates
Solution Approach 1:
The patent introduces directories as intermediary entities between files and reputation determination. Instead of directly assigning placeholder values to files, the system evaluates directories containing files and uses directory reputation as a mediator to infer file reputation, thereby providing meaningful values without direct file-level analysis
Solution Approach 2:
The system performs preliminary evaluation of directories before individual files need reputation assessment. By pre-calculating directory reputations based on collected telemetry data and file characteristics, the system prepares reputation information in advance that can be quickly applied to files within those directories
2Measurement precision
If telemetry data collection and directory analysis are implemented, then the accuracy of file reputation determination improves, but the system complexity increases
Solution Approach 1:
The patent segments the file reputation determination problem into two distinct levels: directory-level evaluation and file-level assignment. The system separately collects telemetry data, evaluates directory characteristics, and then applies directory reputation to individual files, dividing a complex problem into manageable segments
Solution Approach 2:
The directory reputation evaluation mechanism serves multiple functions: it provides reputation context for files, enables batch processing of files within directories, and creates a reusable framework that can be applied across different file types and clients, reducing overall system complexity through multi-functionality
3Reliability
If only files with high-confidence reputation are used for directory calculation, then the reliability of directory reputation classification improves, but the quantity of files available for calculation decreases
Solution Approach 1:
The patent changes the parameter of file selection criteria from including all files to including only files with high-confidence reputation (Ground Truth or High Good/High Bad). This parameter change ensures that directory reputation calculations are based on reliable data, improving classification reliability while accepting a reduced but higher-quality file set
Data Source
AI summary
Telemetry data from client file reputation queries is collected over time. Directories/sub-directories under which files of queries are located are identified. The files including the reputations for the files under a given directory/sub-directory are identified and used to calculate the reputation score for the directory/sub-directory. The directory/sub-directory is then classified based on the calculated score for the directory/sub-directory. After the classification of directories/sub-directories, reputation for a file with unknown reputation is then determined based on the classification of the directory/sub-directory under which the file is located.