File Trust Determination via Dominant Developer Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer security methods, including signature-based and heuristic approaches, fail to effectively classify trusted applications and files, leading to false positives and delayed identification of malicious software, especially for less frequently used files, due to the inefficiencies in cloud-based reputation services.
Innovation Solution
A method and system that determine a trust level of a file by identifying a dominant developer through stable file names and private key signatures, allowing for trust level determination based on verdicts associated with the dominant developer or outside services, reducing the need for extensive code analysis and false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud-based reputation services are used to detect malicious software, then the speed of response and level of protection are improved, but the computational load and need for extensive code analysis increase
Solution Approach 1:
The system performs preliminary grouping of files by stable file names and identification of dominant developers before actual trust level determination. This preliminary organization allows subsequent trust assessments to be made efficiently without extensive code analysis, as files are pre-categorized by their developer associations and stability characteristics.
Solution Approach 2:
The patent introduces an intermediary layer between cloud-based reputation services and individual file analysis. By using stable file names and dominant developer identification as intermediate criteria, the system can determine trust levels without requiring extensive cloud-based code analysis for each file, thus reducing computational load while maintaining protection levels.
2Measurement precision
If extensive code analysis is performed to determine trust levels, then detection accuracy is improved, but the time required for analysis and uploading to cloud infrastructures increases
Solution Approach 1:
The system extracts key identifying features (stable file names and dominant developer signatures) from files without performing extensive code analysis. By taking out only the essential identifying characteristics needed for trust determination, the system achieves accurate detection while minimizing the time required for analysis and cloud uploading.
Solution Approach 2:
The system performs preliminary identification of dominant developers and stable file names before trust level determination. This preliminary action allows the system to have detection accuracy ready in advance, eliminating the need for time-consuming extensive code analysis at the time of trust assessment.
3Reliability
If stable file names are used to group files and identify dominant developers, then false positives are reduced, but the complexity of the classification system increases
Solution Approach 1:
The system applies local quality by focusing classification efforts on specific, stable characteristics (file names and developer signatures) rather than analyzing entire code bases. This localized approach to quality assessment reduces false positives by concentrating on the most reliable identifying features without requiring complex overall system classification.
4Productivity
If cloud infrastructure is used for file analysis, then detection capability is improved, but computational load and resource requirements increase
Solution Approach 1:
The system extracts only the essential elements needed for detection (stable file names and dominant developer identification) without requiring full file uploads to cloud infrastructure. This extraction approach maintains detection capability while significantly reducing computational load and energy consumption associated with cloud-based analysis.
Data Source
AI summary
Disclosed herein are systems and methods for determining trust levels of files on a computing device. In one aspect, an exemplary method comprises, selecting file names which are stable, generating at least one group of files from at least two files of the selected file names, the at least two files being components of a same application, searching for a presence of a dominant developer such that at least one private key of the dominant developer has been used to sign at least one file of the group of files that is generated, when a dominant developer is found, determining a trust level for all files of the group in accordance with verdicts associated with the dominant developer, and when the dominant developer is not found, determining the trust level for all the files of the group based on verdicts of outside services that have been assigned to the files of the group.