Method and apparatus for classifying reputation of files on a computer network

1. A method of classifying a file of interest in a computer network, comprising:

receiving, over the computer network, file statistics for a plurality of users and a plurality of files;

processing the file statistics to identify: (i) a set of users in the plurality of users that received the file of interest; (ii) a group of shared files in the plurality files, where each file in the group of shared files was received by at least two users in the set of users; and (iii) numbers of infected files received by respective users in the set of users;

computing an average ratio of a number of infected files to a total number of files in the group of shared files using a Monte Carlo process constrained by: (i) indications of which users in the set of users received which files in the group of shared files; and (ii) the numbers of infected files received by the respective users; and

assigning a probability of infection to the file of interest based on the average ratio.

2. The method of claim 1 , further comprising:

distributing the probability of infection among the plurality of users over the computer network.

3. The method of claim 1 , wherein the step of computing comprises:

(a) randomly allocating infections among the group of shared files in a simulation, the simulation constrained by: (i) the indications of which users in the set of users received which files in the group of shared files; and (ii) the numbers of infected files received by the respective users;

(b) computing a ratio of a number of infected files to a total number of files in the group of shared files in the simulation; and

(c) repeating steps (a) and (b) for a plurality of simulations to compute the average ratio.

4. The method of claim 3 , wherein the step of processing comprises:

forming an incident matrix, I, representing the indications of which users in the set of users received which files in the group of shared files;

forming a matrix, n, representing the numbers of infected files received by the respective users.

5. The method of claim 4 , wherein the step of randomly allocating comprises:

(a1) forming a matrix, L, representing indications of which files in the group of shared files are infected, where the matrix L initially represents that all of the files in the group of shared files are not infected;

(a2) randomly selecting a file in the group of shared files and indicating such file as infected in the matrix L;

(a3) if an equation I*L=n cannot be satisfied, indicating the file as selected in step (a2) as not infected; and

(a4) repeating steps (a2) and (a3) for each remaining file in the group of shared files.

6. The method of claim 1 , wherein the file statistics include, for each user of the plurality of users, a list of files, of the plurality of files, received by the user and a number of infected files received by the user.

7. The method of claim 1 , further comprising:

processing the file statistics to determine a file popularity threshold, where any of the plurality of files satisfying the popularity threshold are designated as not infected;

wherein each file in the group of shared files has a popularity that does not satisfy the file popularity threshold.

8. Apparatus for classifying a file of interest in a computer network, comprising:

means for receiving, over the computer network, file statistics for a plurality of users and a plurality of files;

means for processing the file statistics to identify: (i) a set of users in the plurality of users that received the file of interest; (ii) a group of shared files in the plurality files, where each file in the group of shared files was received by at least two users in the set of users; and (iii) numbers of infected files received by respective users in the set of users;

means for computing an average ratio of a number of infected files to a total number of files in the group of shared files using a Monte Carlo process constrained by: (i) indications of which users in the set of users received which files in the group of shared files; and (ii) the numbers of infected files received by the respective users; and

means for assigning a probability of infection to the file of interest based on the average ratio.

9. The apparatus of claim 8 , further comprising:

means for distributing the probability of infection among the plurality of users over the computer network.

10. The apparatus of claim 8 , wherein the means for computing comprises:

means for randomly allocating infections among the group of shared files in a simulation, the simulation constrained by: (i) the indications of which users in the set of users received which files in the group of shared files; and (ii) the numbers of infected files received by the respective users;

means for computing a ratio of a number of infected files to a total number of files in the group of shared files in the simulation; and

means for repeating the random allocation of infections and the computer of the ratio for a plurality of simulations to compute the average ratio.

11. The apparatus of claim 10 , wherein the means for processing comprises:

means for forming an incident matrix, I, representing the indications of which users in the set of users received which files in the group of shared files;

means for forming a matrix, n, representing the numbers of infected files received by the respective users.

12. The apparatus of claim 8 , wherein the file statistics include, for each user of the plurality of users, a list of files, of the plurality of files, received by the user and a number of infected files received by the user.

13. The apparatus of claim 8 , further comprising:

means for processing the file statistics to determine a file popularity threshold, where any of the plurality of files satisfying the popularity threshold are designated as not infected;

wherein each file in the group of shared files has a popularity that does not satisfy the file popularity threshold.

14. A computer readable medium having stored thereon instructions that, when executed by a processor, cause the processor to perform a method of classifying a file of interest in a computer network, comprising:

receiving, over the computer network, file statistics for a plurality of users and a plurality of files;

processing the file statistics to identify: (i) a set of users in the plurality of users that received the file of interest; (ii) a group of shared files in the plurality files, where each file in the group of shared files was received by at least two users in the set of users; and (iii) numbers of infected files received by respective users in the set of users;

computing an average ratio of a number of infected files to a total number of files in the group of shared files using a Monte Carlo process constrained by: (i) indications of which users in the set of users received which files in the group of shared files; and (ii) the numbers of infected files received by the respective users; and

assigning a probability of infection to the file of interest based on the average ratio.

15. The computer readable medium of claim 14 , further comprising:

distributing the probability of infection among the plurality of users over the computer network.

16. The computer readable medium of claim 14 , wherein the step of computing comprises:

(a) randomly allocating infections among the group of shared files in a simulation, the simulation constrained by: (i) the indications of which users in the set of users received which files in the group of shared files; and (ii) the numbers of infected files received by the respective users;

(b) computing a ratio of a number of infected files to a total number of files in the group of shared files in the simulation; and

(c) repeating steps (a) and (b) for a plurality of simulations to compute the average ratio.

17. The computer readable medium of claim 16 , wherein the step of processing comprises:

forming an incident matrix, I, representing the indications of which users in the set of users received which files in the group of shared files;

forming a matrix, n, representing the numbers of infected files received by the respective users.

18. The computer readable medium of claim 17 , wherein the step of randomly allocating comprises:

(a1) forming a matrix, L, representing indications of which files in the group of shared files are infected, where the matrix L initially represents that all of the files in the group of shared files are not infected;

(a2) randomly selecting a file in the group of shared files and indicating such file as infected in the matrix L;

(a3) if an equation I*L=n cannot be satisfied, indicating the file as selected in step (a2) as not infected; and

(a4) repeating steps (a2) and (a3) for each remaining file in the group of shared files.

19. The computer readable medium of claim 14 , wherein the file statistics include, for each user of the plurality of users, a list of files, of the plurality of files, received by the user and a number of infected files received by the user.

20. The computer readable medium of claim 14 , further comprising:

processing the file statistics to determine a file popularity threshold, where any of the plurality of files satisfying the popularity threshold are designated as not infected;

wherein each file in the group of shared files has a popularity that does not satisfy the file popularity threshold.