Distributed malware detection
View Patent ↗According to one embodiment, a computer-implemented method includes accessing, using one or more processing units, a first file of a plurality of files requested to be analyzed for malware. Each of the plurality of files corresponds to a respective remote client of a plurality of remote clients. Further, the method includes: processing, using the one or more processing units, an analysis of the first file for malware; and generating an output comprising an indication of whether the first file comprises malware. The method also includes accessing, using the one or more processing units, an address for a first remote client of the plurality of remote clients. The first remote client is the respective remote client corresponding to the first file. In addition, the method includes: sending, using the one or more processing units, the output in a communication addressed to the first remote client corresponding to the first file.
1. A computer-implemented method, comprising:
accessing, using one or more processing units, a first file of a plurality of files requested to be analyzed for malware, each of the plurality of files corresponding to a respective remote client of a plurality of remote clients;
processing, using the one or more processing units, an analysis of the first file for malware;
generating, using the one or more processing units, an output comprising an indication of whether the first file comprises malware;
accessing, using the one or more processing units, an address for a first remote client of the plurality of remote clients, the first remote client being the respective remote client corresponding to the first file;
sending, using the one or more processing units, the output in a first communication addressed to the first remote client corresponding to the first file;
accessing a sharing policy corresponding to the first remote client, the sharing policy indicating a type of information a first customer is willing to share with the plurality of remote clients;
determining to share, based at least in part on the sharing policy, the output with a second remote client of the plurality of remote clients;
sending the output, in response to the determination to share the output, in a second communication addressed to the second remote client of the plurality of remote clients;
apportioning a fee based at least in part on the determination to share the output;
generating a first invoice indicating the fee to be paid by the first customer associated with the first remote client; and
generating a second invoice indicating a second fee to be paid by a second customer associated with the second remote client;
wherein apportioning the fee includes apportioning the second fee based at least in part on the determination to share the output.
2. The method of claim 1 , wherein generating the invoice comprises calculating the fee based at least in part on a duration of time that elapsed during the processing of the analysis of the first file for malware.
3. The method of claim 1 , wherein the fee is calculated on a per incident basis for the processing of the analysis of the first file for malware.
4. The computer-implemented method of claim 1 , wherein the output further comprises a parameter corresponding to the first file, the parameter usable by the first remote client in identifying another instance of the first file.
5. The method of claim 1 , wherein the first file comprises data indicating a result of a preliminary analysis of at least a portion of the first file for malware, the analysis conducted at the first remote client.
6. The method of claim 1 , wherein the first file comprises data indicating the address for the first remote client.
7. The method of claim 1 , wherein accessing the first file comprises accessing an email attachment.
8. The method of claim 1 , further comprising decrypting the first file using a key.
9. The method of claim 1 , wherein processing the analysis of the first file for malware comprises accessing input collected via a human interface.
10. A computing system comprising:
an analysis console comprising one or more processing units, the analysis console operable to:
access a first file of a plurality of files requested to be analyzed for malware, each of the plurality of files corresponding to a respective remote client of a plurality of remote clients;
process an analysis of the first file for malware;
generate an output comprising an indication of whether the first file comprises malware;
access an address for a first remote client of the plurality of remote clients, the first remote client being the respective remote client corresponding to the first file; send the output in a first communication addressed to the first remote client corresponding to the first file;
access a sharing policy corresponding to the first remote client, the sharing policy indicating a type of information a first customer is willing to share with the plurality of remote clients;
determine, based at least in part on the sharing policy, to share the output with a second remote client of the plurality of remote clients;
send the output in a second communication addressed to the second remote client of the plurality of remote clients;
apportion a fee based at least in part on the determination to share the output;
generate a first invoice indicating the fee to be paid by the first customer associated with the first remote client; and
generate a second invoice indicating a second fee to be paid by a second customer associated with the second remote client;
wherein apportioning the fee includes apportioning the second fee based at least in part on the determination to share the output.
11. The computing system of claim 10 , wherein the analysis console is further operable to generate the invoice by calculating the fee based at least in part on a duration of time that elapsed during the processing of the analysis of the first file for malware.
12. The computing system of claim 10 , wherein the fee is calculated on a per incident basis for the processing of the analysis of the first file for malware.
13. The computing system of claim 10 , wherein the output further comprises a parameter corresponding to the first file, the parameter usable by the first remote client in identifying another instance of the first file.
14. The computing system of claim 10 , wherein the first file comprises data indicating a result of a preliminary analysis of at least a portion of the first file for malware, the analysis conducted at the first remote client.
15. The computing system of claim 10 , wherein the first file comprises data indicating the address for the first remote client.
16. The computing system of claim 10 , wherein the first file is an email attachment.
17. The computing system of claim 10 , wherein the analysis console logic is further operable to decrypt the first file using a key.
18. The computing system of claim 10 , wherein the analysis console is further operable to process the analysis of the first file for malware by accessing input collected via a human interface.
19. Computer-readable non-transitory storage media comprising logic that is operable when executed to:
access a first file of a plurality of files requested to be analyzed for malware, each of the plurality of files corresponding to a respective remote client of a plurality of remote clients;
process an analysis of the first file for malware;
generate an output comprising an indication of whether the first file comprises malware;
access an address for a first remote client of the plurality of remote clients, the first remote client being the respective remote client corresponding to the first file;
send the output in a first communication addressed to the first remote client corresponding to the first file;
access a sharing policy corresponding to the first remote client, the sharing policy indicating a type of information a first customer is willing to share with the plurality of remote clients;
determine, based at least in part on the sharing policy, to share the output with a second remote client of the plurality of remote clients;
send the output in a second communication addressed to a second remote client of the plurality of remote clients;
calculate a first fee and a second fee that are apportioned based at least in part on the determination to share the output;
generate a first invoice indicating the first fee to be paid by the first customer associated with the first remote client; and
generate a second invoice indicating the second fee to be paid by a second customer associated with the second remote client.
20. The Computer-readable storage media of claim 19 , wherein the first fee is calculated on a per incident basis for the processing of the analysis of the first file for malware.
21. The Computer-readable storage media of claim 19 , wherein a first identity of the first customer and a second identity of the second customer are not revealed to the each other.