Patent ID: 8683585

Claim:
A computer implemented method for using file reputations to identify malicious file sources in real time, the method comprising the steps of: monitoring, by at least one computer, attempts by a plurality of client computers to access files from external file sources; for each monitored attempt by a client to access a file, determining, by the at least one computer, a reputation of the specific file that the client attempts to access; responsive to a determined reputation of at least one file meeting a specific threshold, adjudicating, by the at least one computer, the at least one file to be malicious; analyzing, by the at least one computer, the adjudicated file and distribution of the adjudicated file to identify exploits it uses to infect targets, responsive to adjudicating the at least one file to be malicious; tracking, by the at least one computer, attempts by external file sources to distribute files adjudicated to be malicious to clients of the plurality of client computers; determining, by the at least one computer, reputations of external file sources, responsive to tracked attempts by external file sources to distribute files adjudicated to be malicious to clients of the plurality of client computers; responsive to a determined reputation of at least one external file source meeting a specific threshold, adjudicating, by the at least one computer, the at least one external file source to be malicious; responsive to adjudicating the at least one external file source to be malicious, analyzing, by the at least one computer, files made available for access by the at least one external file source, to determine whether the analyzed files comprise malware; analyzing distribution of files from the at least one external file source adjudicated to be malicious, by the at least one computer, to identify file distribution patterns, the file distribution patterns comprising at least geographic distribution patterns; and publicizing, by the at least one computer, previously-unknown exploits.