Securing file launch activity utilizing safety ratings
System and method for assessing a risk level associated with launching acquired objects on an associated computer system. Events occurring on the computer system are detected, including an event representing launching of a first object. An association of a detected launching of the first object with user input effecting that launching, if any, is stored. In response to a launching of the first object, a determination is made as to whether an association exists between the launching, and any user input initiating that launching. A risk assessment record is updated for the first object such that, in response to the launching of the first object being either associated or not associated with user input initiating that launching, the risk assessment record is updated to reduce an indicated risk level for the first object, or to increase the indicated risk level for the first object, respectively.
1. A security arrangement for assessing a risk level associated with launching acquired objects in an associated computer system, the security arrangement comprising:
computing hardware, including a processor, a data store, input/output facilities, and a user interface;
an operating system executable on the computing hardware, the operating system being adapted to facilitate launching of objects in the computer system;
an event monitoring module executable on the computing hardware and operatively coupled with the operating system, the event monitoring module configured to detect events occurring on the computer system including an event representing launching of a first object;
a launch registration module executable on the computing hardware and operatively coupled with the event monitoring module, the launch registration module configured to store an association of a detected launching of the first object with user input effecting that launching, if any;
a comparison module operatively coupled with the event monitoring module and the launch registration module, the comparison module configured to, determine, in response to a launching of the first object, whether an association exists between the launching, and any user input initiating that launching; and
wherein the comparison module is further adapted to maintain a risk assessment record for the first object such that:
in response to the launching of the first object being associated with user input initiating that launching, the risk assessment record is updated to reduce an indicated risk level for the first object; and
in response to the launching of the first object not being associated with any user input initiating that launching, the risk assessment record is updated to increase the indicated risk level for the first object.
2. The security arrangement of claim 1 , wherein the risk assessment record is stored remotely from the computer system.
3. The security arrangement of claim 1 , wherein the risk assessment record is stored in the computer system utilizing the computing hardware.
4. The security arrangement of claim 1 , wherein the risk assessment record includes risk assessment information for a plurality of different objects based on associated launches of each of those objects on a plurality of distinct computer systems.
5. The security arrangement of claim 1 , wherein the risk assessment record includes risk assessment information for the first object based on associated launches the first object on a plurality of distinct computer systems.
6. The security arrangement of claim 1 , wherein in the stored association of the detected launching of the first object with user input effecting that launching, the first object is uniquely identified by its computer hash value.
7. The security arrangement of claim 1 , wherein in the stored association of the detected launching of the first object with user input effecting that launching, the first object is uniquely identified by its full filename.
8. The security arrangement of claim 1 , wherein the first object is a file.
9. The security arrangement of claim 1 , wherein the first object is a document.
10. The security arrangement of claim 1 , wherein the first object is a program.
11. The security arrangement of claim 1 , wherein the first object is acquired via an attachment to a message.
12. The security arrangement of claim 1 , wherein the first object is acquired via download from a remote computer system.
13. The security arrangement of claim 1 , wherein the indicated risk level for the first object is indicated as at least one of: a category rating, and a numerical value; and
wherein the risk assessment record is updated according to a predefined set of rules wherein increases in the risk level are made with greater increments than decreases in the risk level.
14. The security arrangement of claim 1 , further comprising:
an antivirus module configured to perform a plurality of different security-related operations including heuristic analysis of objects for any presence of malware therein;
wherein the antivirus module is further configured to forgo the heuristic analysis of objects and to permit subsequent launching of those objects in response to a risk level associated with those object in the risk assessment record being below a predefined minimum risk threshold level.
15. The security arrangement of claim 1 , further comprising:
an antivirus module configured to perform a plurality of different security-related operations including heuristic analysis of objects for any presence of malware therein;
wherein the antivirus module is further configured to forgo the heuristic analysis objects and to prevent subsequent launching of those objects in response to a risk level associated with those objects in the risk assessment record being above a predefined maximum risk threshold level.
16. The security arrangement of claim 1 , wherein the comparison module is further adapted to adjust an amount by which the risk level is reduced or increased based on a characteristic of the first object selected from the group consisting of a file type, a file size, or any combination thereof.
17. In a computer system having computing hardware including a processor, a data store, and input/output facilities, a method for assessing a risk level associated with launching acquired objects on an associated computer system, the method being carried out automatically under program control by the computer system, the method comprising:
detecting events occurring on the computer system including an event representing launching of a first object;
storing an association of a detected launching of the first object with user input effecting that launching, if any;
determining, in response to a launching of the first object, whether an association exists between the launching, and any user input initiating that launching; and
updating a risk assessment record for the first object such that:
in response to the launching of the first object being associated with user input initiating that launching, the risk assessment record is updated to reduce an indicated risk level for the first object; and
in response to the launching of the first object not being associated with any user input initiating that launching, the risk assessment record is updated to increase the indicated risk level for the first object.
18. The method of claim 17 , wherein the risk assessment record is stored remotely from the computer system.
19. The method of claim 17 , wherein the risk assessment record is stored in the computer system utilizing the computing hardware.
20. The method of claim 17 , wherein the risk assessment record includes risk assessment information for a plurality of different objects based on associated launches of each of those objects on a plurality of distinct computer systems.
21. The method of claim 17 , wherein the risk assessment record includes risk assessment information for the first object based on associated launches the first object on a plurality of distinct computer systems.
22. The method of claim 17 , wherein in the storing, the first object is uniquely identified by its computer hash value.
23. The method of claim 17 , wherein in the storing, the first object is uniquely identified by its full filename.
24. The method of claim 17 , wherein the first object is an object selected from the group consisting of: a file, a document, or a program.
25. The method of claim 17 , further comprising:
acquiring the first object via an attachment to a message.
26. The method of claim 17 , further comprising:
acquiring the first object via download from a remote computer system.
27. The method of claim 17 , wherein the indicated risk level for the first object is indicated as at least one of: a category rating, and a numerical value, and
wherein the risk assessment record is updated according to a predefined set of rules wherein increases in the risk level are made with greater increments than decreases in the risk level.
28. The method of claim 17 , further comprising:
performing a plurality of different security-related operations including heuristic analysis of objects for any presence of malware therein; and
forgoing the heuristic analysis of objects and permitting subsequent launching of those objects in response to a risk level associated with those object in the risk assessment record being below a predefined minimum risk threshold level.
29. The method of claim 17 , further comprising:
performing a plurality of different security-related operations including heuristic analysis of objects for any presence of malware therein; and
forgoing the heuristic analysis objects and to prevent subsequent launching of those objects in response to a risk level associated with those objects in the risk assessment record being above a predefined maximum risk threshold level.
30. The method of claim 17 , further comprising:
adjusting an amount by which the risk level is reduced or increased based on a characteristic of the first object selected from the group consisting of: a file type, a file size, or any combination thereof.