System, method, and computer program product for conditionally performing an action based on an attribute
View Patent ↗A system, method, and computer program product are provided for conditionally performing an action based on an attribute. In use, at least one attribute associated with an object is determined. Additionally, an event associated with the object is identified. Further, at least one action is conditionally performed in association with the event, based on the at least one attribute.
1. A method of reducing an amount of actions performed based on a trust relationship state between objects, the method comprising:
establishing a first trust state for a first object, comprising:
scanning the first object for malware;
maintaining an attribute for the first object related to the established first trust state;
monitoring activity related to the first object and a second object;
updating the attribute of the first object based at least in part upon a second trust state associated with the second object;
determining not to perform a scan operation on the first object based upon the updated attribute when the first trust state and the second trust state indicate that the first object and the second object are both trusted; and
determining to perform a scan operation on the first object after updating the first trust state or the second trust state to indicate either the first object or the second object is untrusted.
2. The method of claim 1 wherein, updating the attribute of the first object comprises changing the attribute from indicating a trusted state to an untrusted state when the second trust state indicates untrusted.
3. The method of claim 1 wherein, the first object comprises a file.
4. The method of claim 1 wherein, the monitored activity indicates an action performed on the first object by the second object.
5. The method of claim 1 wherein, the second object comprises a process of a computer operating system.
6. The method of claim 1 wherein, the monitored activity indicates an action performed on the second object by the first object.
7. The method of claim 1 wherein, the monitored activity indicates that the second object has been loaded by the first object.
8. The method of claim 1 wherein, establishing a first trust state for the first object comprises inheriting a trust state from a creator of the first object.
9. A non-transitory computer readable storage medium comprising instructions stored thereon that when executed by one or more processors cause the one or more processors to:
establish a first trust state for a first object, comprising scanning the first object for malware;
maintain an attribute for the first object related to the established first trust state;
receive an indication of activity between the first object and a second object;
update the attribute of the first object based at least in part upon a second trust state associated with the second object;
determine not to perform a scan operation on the first object based upon the updated attribute when the first trust state and the second trust state indicate that the first object and the second object are both trusted; and
determine to perform a scan operation on the first object after updating the first trust state or the second trust state to indicate either the first object or the second object is untrusted.
10. The non-transitory computer readable storage medium of claim 9 wherein the instructions to cause one or more processors to update the attribute of the first object comprise instructions to cause the one or more processors to change the attribute from indicating a trusted state to an untrusted state when the second trust state indicates untrusted.
11. The non-transitory computer readable storage medium of claim 9 wherein, the first object comprises a file.
12. The non-transitory computer readable storage medium of claim 9 wherein, the second object comprises a process of a computer operating system.
13. The non-transitory computer readable storage medium of claim 9 wherein the instructions to cause one or more processors to receive an indication of activity comprises instructions to receive an indication that the second object has performed an action involving the first object.
14. The non-transitory computer readable storage medium of claim 9 wherein the instructions to cause one or more processors to receive an indication of activity comprise further instructions to determine that the second object has been acted upon by the first object.
15. A computer system comprising:
a memory; and
one or more processors;
wherein the memory comprises stored instructions that when executed by the one or more processors cause the one or more processors to:
establish a first trust state for a first object, comprising scanning the first object for malware;
maintain an attribute for the first object related to the established first trust state;
monitor activity related to the first object, the monitored activity determined to be related to a second object;
update the attribute of the first object based at least in part upon a second trust state associated with the second object;
determine not to perform a scan operation on the first object based upon the updated attribute when the first trust state and the second trust state indicate that the first object and the second object are both trusted; and
determine to perform a scan operation on the first object after updating the first trust state or the second trust state to indicate either the first object or the second object is untrusted.