Method and apparatus for determining software trustworthiness

1. A method of determining software trustworthiness, comprising:

receiving information associated with files of unknown trustworthiness stored on client computers;

determining, using at least one computer processor, prevalence of at least one file of the files stored on the client computers in response to the information associated with files;

generating a request to identify a software package having a plurality of the files stored on the client computer including the at least one file in response to the prevalence thereof exceeding a prevalence threshold, wherein the prevalence determines an order of the at least one file among the plurality of files;

removing from the information associated with files, information associated with at least one file in response to the prevalence thereof falling below the prevalence threshold;

installing on a clean machine the software package identified as including the at least one file of unknown trustworthiness;

generating a report package including a catalog of files that have been installed or modified on the clean machine by the software package;

determining identification attributes for each of the files in the catalog;

processing each of the files in the catalog to assign a level of trustworthiness thereto; and

providing the report package as output.

2. The method of claim 1 , further comprising:

monitoring websites of vendors indicated as being trustworthy sources of software; and

identifying the software package from at least one of the websites.

3. The method of claim 1 , wherein the step of installing comprises:

capturing a first snapshot of software state of the clean machine prior to installing the software package; and

capturing a second snapshot of the software state of the clean machine subsequent to installing the software package.

4. The method of claim 3 , wherein the step of generating the report package comprises:

comparing the first snapshot with the second snapshot to identify the files that have been installed or modified.

5. The method of claim 1 , wherein clean machine comprises a virtual machine executing on a server.

6. The method of claim 1 , wherein the identification attributes for each of the files in the catalog includes a digest thereof.

7. The method of claim 1 , wherein the step of processing comprises:

determining the level of trustworthiness for each of the files responsive to at least one of: (i) scanning each of the files in the catalog for malware; (ii) analyzing a digital signature for at least one of the files in the catalog; (iii) determining an origin of the files in the catalog and obtaining a measure of trustworthiness of such origin; or (iv) performing a statistical analysis of the files in the catalog with respect to existence of the files on client computers and hygiene ratings for the client computers.

8. The method of claim 1 , wherein the level of trustworthiness for each of the files in the catalog is selected from a plurality of levels of trustworthiness.

9. The method of claim 1 , further comprising:

processing the report package to store in a database, for each of the files in the catalog, at least one of the identification attributes thereof in relation with the level of trustworthiness thereof.

10. An apparatus for determining software trustworthiness, comprising:

at least one computer processor configured to:

receive information associated with files of unknown trustworthiness stored on client computers;

determine, using at least one computer processor, prevalence of at least one file of the files stored on the client computers in response to the information associated with files;

generate a request to identify a software package having a plurality of the files stored on the client computer including the at least one file in response to the prevalence thereof exceeding a prevalence threshold, wherein the prevalence determines an order of the at least one file among the plurality of files;

remove from the information associated with files, information associated with at least one file in response to the prevalence thereof falling below the prevalence threshold;

install on a clean machine the software package identified as including the at least one file of unknown trustworthiness;

generate a report package including a catalog of files that have been installed or modified on the clean machine by the software package;

determine identification attributes for each of the files in the catalog;

process each of the files in the catalog to assign a level of trustworthiness thereto; and

provide the report package as output.

11. The apparatus of claim 10 , wherein the at least one computer processor is further configured to:

monitor websites of vendors indicated as being trustworthy sources of software; and

identify the software package from at least one of the websites.

12. The apparatus of claim 10 , wherein installing comprises:

capture a first snapshot of software state of the clean machine prior to installing the software package; and

capture a second snapshot of the software state of the clean machine subsequent to installing the software package.

13. The apparatus of claim 12 , wherein the means for generating the report package comprises:

compare the first snapshot with the second snapshot to identify the files that have been installed or modified.

14. The apparatus of claim 10 , wherein processing comprises:

determining the level of trustworthiness for each of the files responsive to at least one of: (i) scanning each of the files in the catalog for malware; (ii) analyzing a digital signature for at least one of the files in the catalog; (iii) determining an origin of the files in the catalog and obtaining a measure of trustworthiness of such origin; or (iv) performing a statistical analysis of the files in the catalog with respect to existence of the files on client computers and hygiene ratings for the client computers.

15. The apparatus of claim 10 , further comprising:

processing the report package to store in a database, for each of the files in the catalog, at least one of the identification attributes thereof in relation with the level of trustworthiness thereof.

16. A non-transitory computer readable storage medium having stored thereon instructions that when executed by a processor cause the processor to perform a method of determining software trustworthiness, comprising:

receiving information associated with files of unknown trustworthiness stored on client computers;

determining, using at least one computer processor, prevalence of at least one file of the files stored on the client computers in response to the information associated with files;

generating a request to identify a software package having a plurality of the files stored on the client computer including the at least one file in response to the prevalence thereof exceeding a prevalence threshold! wherein the prevalence determines an order of the at least one file among the plurality of files;

removing from the information associated with files, information associated with at least one file in response to the prevalence thereof falling below the prevalence threshold;

installing on a clean machine the software package identified as including the at least one file of unknown trustworthiness;

generating a report package including a catalog of files that have been installed or modified on the clean machine by the software package;

determining identification attributes for each of the files in the catalog;

processing each of the files in the catalog to assign a level of trustworthiness thereto; and

providing the report package as output.

17. The non-transitory computer readable storage medium of claim 16 , wherein the step of processing comprises:

determining the level of trustworthiness for each of the files responsive to at least one of: (i) scanning each of the files in the catalog for malware; (ii) analyzing a digital signature for at least one of the files in the catalog; (iii) determining an origin of the files in the catalog and obtaining a measure of trustworthiness of such origin; or (iv) performing a statistical analysis of the files in the catalog with respect to existence of the files on client computers and hygiene ratings for the client computers.