Patent application EP20177162A (EP), filed 2020-05-28
Publication number: EP3758330A1
Title: SYSTEM AND METHOD OF DETERMINING A TRUST LEVEL OF A FILE
Abstract: Disclosed herein are systems and methods for determining trust levels of files on a computing device. In one example, an exemplary method comprises, selecting file names which are stable, generating at least one group of files from at least two files of the selected file names, the at least two files being components of a same application, searching for a presence of a dominant developer such that at least one private key of the dominant developer has been used to sign at least one file of the group of files that is generated, when a dominant developer is found, determining a trust level for all files of the group in accordance with verdicts associated with the dominant developer, and when the dominant developer is not found, determining the trust level for all the files of the group based on verdicts of outside services that have been assigned to the files of the group.
IPC codes: H04L  29/    06            A I
G06F  21/    56            A I
H04L   9/    40            A I
Claims: number: 1
text: A method for determining a trust level of a file, the method comprising:
number: 2
text: The method according to claim 1, wherein the trust levels are determined in accordance with verdicts associated with the dominant developer based on: verdicts of outside services which have been assigned to the files of the group.
number: 3
text: The method according to any of claims 1 to 2, wherein the trust levels are determined in accordance with verdicts associated with the dominant developer based on: verdicts of outside services which have been assigned to at least one file on a computing device of a user which does not belong to the group and is signed with the private key of the dominant developer.
number: 4
text: The method according to any of claims 1 to 3, wherein the trust levels are determined in accordance with verdicts associated with the dominant developer based on: verdicts of outside services that have been assigned to files of another group of the dominant developer, the files of the another group having a run frequency among users that is greater than a predetermined threshold for a run frequency.
number: 5
text: The method according to any of claims 1 to 4, wherein the outside services comprise at least one of: at least one protection system of at least one computing device on which the files are stored, and any number of servers of a cloud infrastructure with which the at least one computing device is communicatively coupled.
number: 6
text: The method according to claim 5, wherein the cloud infrastructure aggregates and stores data received from all of the computing device, wherein data is collected by a protection system of a given computing device based on confidentiality settings selected by a user of the given computing device.
number: 7
text: The method according to claim 6, wherein, when the selected confidentiality settings indicates refraining from data collection, data on a local database of files of the computing device for which the refraining is selected includes information only on files having a predetermined characteristic, the predetermined characteristic including at least one of: the files being executable, the files being stored along a predetermined path, and the files having a predetermined set of extensions.
number: 8
text: A system for determining a trust level of a file, comprising:
at least one processor configured to:
number: 9
text: The system according to claim 8, wherein the trust levels are determined in accordance with verdicts associated with the dominant developer based on: verdicts of outside services which have been assigned to the files of the group.
number: 10
text: The system according to any of claims 8 to 9, wherein the trust levels are determined in accordance with verdicts associated with the dominant developer based on: verdicts of outside services which have been assigned to at least one file on a computing device of a user which does not belong to the group and is signed with the private key of the dominant developer.
number: 11
text: The system according to any of claims 8 to 10, wherein the trust levels are determined in accordance with verdicts associated with the dominant developer based on: verdicts of outside services that have been assigned to files of another group of the dominant developer, the files of the another group having a run frequency among users that is greater than a predetermined threshold for a run frequency.
number: 12
text: The system according to any of claims 8 to 11, wherein the outside services comprise at least one of: at least one protection system of at least one computing device on which the files are stored, and any number of servers of a cloud infrastructure with which the at least one computing device is communicatively coupled.
number: 13
text: The system according to claim 12, wherein the cloud infrastructure aggregates and stores data received from all of the computing device, wherein data is collected by a protection system of a given computing device based on confidentiality settings selected by a user of the given computing device.
number: 14
text: The system according to claim 13, wherein, when the selected confidentiality settings indicates refraining from data collection, data on a local database of files of the computing device for which the refraining is selected includes information only on files having a predetermined characteristic, the predetermined characteristic including at least one of: the files being executable, the files being stored along a predetermined path, and the files having a predetermined set of extensions.
Office action: search_report, dated 2020-12-30
Rejection reasons: novelty_epc_54
inventive_step_epc_56
Prior art cited: ref_id: EP2169583A1
ref_type: patent
severity: background
ref_id: US2014283065A1
ref_type: patent
severity: background
ref_id: US2009083731A1
ref_type: patent
severity: background
ref_id: US8650649B1
ref_type: patent
severity: background
ref_id: US2009083731
ref_type: patent
severity: obviousness
ref_id: EP2169583
ref_type: patent
severity: novelty_destroying
ref_id: US8650649
ref_type: patent
severity: obviousness
ref_id: US2014283065
ref_type: patent
severity: obviousness
Final disposition: pending (2020-12-30)