DATASHEET

BrightCloud® FileReputation Service
Dynamic file reputation intelligenceto stop malware distribution

Overview• As malware continues to proliferate, organizations of all
sizes need additional layers of defense within theirsecurity infrastructure

86% of malware is uniqueto a single PC.1

• Network-based malware detection technologies can beoverwhelmed and bypassed• File intelligence can quickly identify malware andtrustworthy files so potential threats can be investigated
Malware hides within the sheer volume of files encounteredby companies every day. The AV-TEST Institute registers over
350,000 new malicious programs every day. This volumeof malware makes the need for strong file reputation
capabilities critical in combating threats, as well as freeing
up valued security resources by allowing known good files to
bypass sometimes over-taxed security infrastructure.
The BrightCloud® File Reputation Service provides up-to-theminute file intelligence derived from millions of real-world
sensors. Each file is analyzed by the latest machine learningtechniques and vetted through years of threat expertise. This
real-time lookup service of known malicious and allowed file
identifiers helps to effectively stop the distribution of threats
through networks. This verification significantly reduces
the amount of ‘noise’ by enabling policies to automaticallydetermine which files to allow, block or investigate further,allowing security administrators to focus on unknown
potential threats.
This service uses industry standard file hashes as fingerprints
to uniquely identify files, regardless of filename, platform,
encryption or password protection. It responds to authorized
requests to look up the reputation of the file hash in theBrightCloud® Threat Intelligence Services Platform.
The service then responds with a determination of Good, Bad
or Unknown/Unclassified, as well as several other security
attributes associated with the file, including:• The type of malware it contains• The number of times the file has been seen across theBrightCloud® Threat Intelligence Services Platform• When it was first detected• The date of its classification or most recent determination

The BrightCloud® Threat Intelligence Services Platform is
updated via millions of enterprise and consumer endpoints
and network security devices around the globe, continuously
receiving the latest information on emerging threats. In
addition, file data is correlated with URLs, IPs and mobile apps
to provide a comprehensive view across the threat landscape.
Mapping the relationships between these different data points
enables BrightCloud to provide partners with highly accurate
intelligence that is always up to date. This automated network
dramatically reduces the time to detect for emerging threatsand provides real-time protection to prevent malicious files
from entering networks and spreading to unsuspecting users.
To date, BrightCloud® Threat Intelligence contains more than
38 billion detailed file behavior records and grows more
intelligent by the day.2

Partner Benefits• Differentiate yourself from your competition
Reduce noise at the network edge, freeing up yourcustomers’ security resources to focus on the mostpressing threats• Leverage the BrightCloud® Threat Intelligence
Services Platform
Harness collective threat intelligence from millionsof sources via the world’s most powerful cloudsecurity platform• Easy to integrate, easy to use
Simple integration through RESTful API and an SDK
into your solution• No impact on your network
Protects through your network devices and increases
user capacity by eliminating unwanted traffic

Platform
Platform
Internet Sensor
Network

BrightCloud
Web Classification& Web Reputation
Services:

CaptureAnalyze

TechnologyPartners

Webroot
Customers(Millions)Contextual Database

Classify
PublishInternet

URLs (billions)
Domains (millions)IPs (billions)

FileMobile

File Behaviors (billions)
Mobile Apps (millions)
Connected Sensors (millions)

BrightCloud API

Global Threat
Databases

Category agnostic reputation scores
82 site categories, such as Shopping,
Job Search, Sports, Pornography, as
well as various threat categories
including:
Botnets
Malware Sites
Phishing and Other Frauds
Proxy Avoidance and Anonymizers
Spam URLs
Spyware and Adware

BrightCloud® File Reputation ServiceThe BrightCloud® File Reputation
Service in Action
The BrightCloud® File Reputation Service helps network edge
appliances, such as next-generation firewalls and intrusion
detection/prevention devices, determine whether files aretrustworthy, malicious or require further investigation.
Additionally, it helps cloud-based storage providers ensure
customers’ stored files are free from malware. It also enables
web and email hosting providers to scan hosted files toensure that both the website/email owner and provider areaware of any hosted or queued malware.
File Reputation data is backed by more than 95 million
real-world endpoints and their encounters with everyday
applications, including malware.3 Because of the constantly
updated feed, the File Reputation Service is often much fasterthan other leading services in discovering zeroday threats.
Additionally, when coupled with BrightCloud® Streaming
Malware Detection, the File Reputation Service makes anespecially effective tool against traditional andmodern malware.

Designed to combat the challenges of polymorphic malware,
BrightCloud® Streaming Malware Detection allows ourpartners’ devices to make determinations at the network
level enabling users to quickly allow, block or flag files forinvestigations. Since the files often don’t need to be fully
downloaded, this service frees up network bandwidth bydropping malware at the perimeter and eliminates the needto re-inspect benign files.

Easy Integration
Traditional antivirus solutions offer a heavy and rigid
approach to integration, sacrificing usability and performancefor companies trying to integrate them. The BrightCloud®
File Reputation Service provides an easy to integrate API
so partners can use the extensive BrightCloud database tobuild malware detection into products and better protect
users. Additionally, this service combines with existing
security solutions through the same SDK as other BrightCloud
services, making integration as simple and straightforward
as possible.

2022 BrightCloud® Threat Report
2022 BrightCloud® Threat Report
32022 BrightCloud® Threat Report
12Contact us to learn more
BrightCloud.com
Phone: +1 800 870 8102
About BrightCloud
BrightCloud was the first threat intelligence platform to harness the cloud and artificial intelligence to stop zero-day threats in real-time. The platform is used tosecure businesses and their products worldwide with threat intelligence and protection for endpoints and networks. With more than 10 years of experience inbuilding and analyzing the industry’s most robust internet threat database, BrightCloud has the strongest coverage model, fewest uncategorized objects andthe most historical records which others cannot replicate.
In 2019, BrightCloud was acquired by OpenText, a global leader in Enterprise Information Management. As a whole, we are a market leader in cyber resilience,
offering total endpoint protection and disaster recovery for businesses of any size.

© 2022 Open Text. All rights reserved. OpenText and BrightCloud are trademarks of Open Text or its subsidiaries. All other trademarks are the propertiesof their respective owners. DS _041822