System, method, and computer program product for automatically identifying potentially unwanted data as unwanted
View Patent ↗A system, method, and computer program product are provided for automatically identifying potentially unwanted data as unwanted. In use, data determined to be potentially unwanted (e.g. potentially malicious) is received. Additionally, the data is automatically identified as unwanted (e.g. malicious). Furthermore, the data is stored for use in detecting unwanted data (e.g. malicious data).
1. A computer program product embodied on a non-transitory computer readable medium, comprising:
computer code for receiving data by a server, wherein the data is not known to be wanted and wherein the data is not known to be unwanted;
computer code for assigning a weight to each source from which the data was received;
computer code for calculating an aggregate weight from the weights assigned to each source from which the data was received; and
computer code for automatically identifying by the server that the data is unwanted if the aggregate weight meets a predetermined threshold weight; and
computer code for storing the data by the server for use in detecting unwanted data.
2. The computer program product of claim 1 , wherein the data is not known to be malicious and wherein the data is not known to be non-malicious.
3. The computer program product of claim 1 , wherein the data does not match known wanted data and does not match known unwanted data.
4. The computer program product of claim 1 , wherein the data is automatically received based on monitoring of at least one of an electronic messaging application, file transfer protocol (FTP), and a web site.
5. The computer program product of claim 1 , wherein the data is automatically identified as unwanted based on at least one source from which the data is received.
6. The computer program product of claim 5 , wherein the source includes a security vendor.
7. The computer program product of claim 5 , wherein the source includes a honeypot.
8. The computer program product of claim 5 , wherein the data is automatically identified as unwanted if it is determined that other data previously received from the at least one source includes known unwanted data.
9. The computer program product of claim 5 , wherein the data is automatically identified as unwanted if it is determined that the data was received by a predefined threshold number of different sources.
10. The computer program product of claim 5 , wherein the data is automatically identified as unwanted if it is determined that a weight assigned to the at least one source meets a predefined threshold weight.
11. The computer program product of claim 1 , wherein storing the data includes storing a hash of the data.
12. The computer program product of claim 1 , further comprising computer code for storing an indication with the data that the data includes potentially unwanted data automatically identified as unwanted.
13. The computer program product of claim 12 , further comprising computer code for identifying the data stored with the indication that the data includes potentially unwanted data automatically identified as unwanted, analyzing the data, and determining whether the data is unwanted based on the analysis.
14. The computer program product of claim 13 , further comprising computer code for updating one of a list of known unwanted data and a list of known wanted data based on the determination.
15. The computer program product of claim 1 , wherein the stored data is utilized for detecting the unwanted data by identifying other received data determined to be potentially unwanted as unwanted if the other received data matches the stored data.
16. A method, comprising:
receiving data by a computer processor, wherein the data is not known to be wanted and wherein the data is not known to be unwanted;
assigning a weight to each source from which the data was received;
calculating an aggregate weight from the weights assigned to each source from which the data was received;
identifying automatically that the data is unwanted if the aggregate weight meets a predetermined threshold weight; and
storing the data for use in detecting unwanted data.
17. A system, comprising:
a computer processor for receiving data, wherein the data is not known to be wanted and wherein the data is not known to be unwanted, assigning a weight to each source from which the data was received, calculating an aggregate weight from the weights assigned to each source from which the data was received, identifying automatically that the data is unwanted if the aggregate weight meets a predetermined threshold weight, and storing the data for use in detecting unwanted data.
18. The method of claim 16 , further comprising:
identifying the data as unwanted by the computer processor by analyzing the data.
19. A method, comprising:
receiving a first data by a client computer;
analyzing the first data by the client computer, and determining that the first data is not known to be wanted and wherein the first data is not known to be unwanted;
sending the first data to a server computer;
assigning a weight to each source from which the data was received;
calculating an aggregate weight from the weights assigned to each source from which the data was received;
identifying automatically that the data is unwanted if the aggregate weight meets a predetermined threshold weight; and
storing the first data by the server computer.
20. The method of claim 19 , further comprising:
analyzing the stored first data by the server computer responsive to analysis resources being available; and
identifying the stored first data as wanted or unwanted responsive to the act of analyzing the stored first data by the server computer;
updating a datastore responsive to the act of identifying the stored first data as wanted or unwanted;
distributing the updated datastore to the client computer.
21. The method of claim 19 , wherein the second data comprises an identification of the client computer as a previous source of unwanted data.
22. The method of claim 19 , further comprising:
using the stored first data automatically identified as unwanted for determining that a third data is unwanted.
23. The computer program product of claim 1 , wherein the computer code for automatically identifying by the server the data as unwanted without analyzing the data comprises:
computer code for automatically identifying by the server the data as unwanted responsive to a second data, without analyzing the first data.
24. The method of claim 16 , wherein the act of identifying the data automatically as unwanted by the computer processor without analyzing the data comprises:
identifying the data automatically as unwanted by the computer process without analyzing the data, responsive to a second data.
25. The method of claim 24 , wherein the second data comprises a source from which the data is received.