Determining a reputation for a process
View Patent ↗Particular embodiments described herein provide for an electronic device that can be configured to identify a process running on the electronic device, assign a reputation to the process if the process has a known reputation, determine if the process includes executable code, determine a reputation for the executable code, and combine the reputation for the executable code with the reputation assigned to the process to create a new reputation for the process.
1. At least one non-transitory, computer-readable medium comprising one or more instructions that, when executed by at least one processor, cause the at least one processor to perform a method comprising:
identifying a process, wherein the process includes executable code that interacts with an electronic device, and a reputation is assigned to the process;
determining a reputation for the executable code;
combining the reputation for the executable code and a reputation of the electronic device with the reputation assigned to the process to update the reputation for the process; and,
in response to determining a thread is attached to the process by an actor process in order to bypass a firewall rule, merging the reputation assigned to the process and a reputation of the actor process or the thread to protect a resource of a computer.
2. The at least one non-transitory, computer-readable medium of claim 1 , the method further comprising:
combining a reputation of a loaded library with the reputation for the process, wherein the process includes executable code that interacts with the loaded library.
3. The at least one non-transitory, computer-readable medium of claim 1 , the method further comprising:
combining a reputation of a network element with the reputation for the process, wherein the process includes executable code that interacts with the network element.
4. The at least one non-transitory, computer-readable medium of claim 1 , the method further comprising:
combining a reputation of a content file with the reputation for the process, wherein the process includes executable code that interacts with the content file.
5. The at least one non-transitory, computer-readable medium of claim 1 , the method further comprising:
combining the reputation of the thread with the reputation for the process.
6. The at least one non-transitory, computer-readable medium of claim 1 , the method further comprising:
determining that the reputation of the electronic device has changed to a new reputation; and
combining the new reputation of the electronic device with the reputation for the process.
7. The at least one non-transitory, computer-readable medium of claim 1 , the method further comprising:
determining a reputation of a behavior of the process; and
combining the reputation of the behavior of the process with the reputation for the process.
8. The at least one non-transitory, computer-readable medium of claim 1 , wherein the reputation for the process is determined based on a whitelist or a blacklist.
9. An apparatus, comprising:
a processor configured to
identify a process, wherein the process includes executable code that interacts with an electronic device, and a reputation is assigned to the process;
determine a reputation for the executable code;
combine the reputation for the executable code and a reputation of the electronic device with the reputation assigned to the process to update the reputation for the process; and,
in response to determining a thread is attached to the process by an actor process in order to bypass a firewall rule, merge the reputation assigned to the process and a reputation of the actor process or the thread to protect a resource of a computer.
10. The apparatus of claim 9 , wherein the processor is further configured to:
combine a reputation of a loaded library with the reputation for the process, wherein the process includes executable code that interacts with the loaded library.
11. The apparatus of claim 9 , wherein the processor is further configured to:
combine a reputation of a network element with the reputation for the process, wherein the process includes executable code that interacts with the network element.
12. The apparatus of claim 9 , wherein the processor is further configured to:
combine a reputation of a content file with the reputation for the process, wherein the process includes executable code that interacts with the content file.
13. The apparatus of claim 9 , wherein the processor is further configured to:
combine the reputation of the thread with the reputation for the process, wherein the process includes executable code that interacts with the thread.
14. The apparatus of claim 9 , wherein the processor is further configured to:
determine that the reputation of the electronic device has changed to a new reputation; and
combine the new reputation of the electronic device with the reputation for the process.
15. The apparatus of claim 9 , wherein the processor is further configured to:
determine a reputation of a behavior of the process; and
combine the reputation of the behavior of the process with the reputation for the process.
16. The apparatus of claim 9 , wherein the reputation for the process is determined based on a whitelist or a blacklist.
17. A method, comprising:
identifying a process, wherein the process includes executable code that interacts with an electronic device, and a reputation is assigned to the process;
determining a reputation for the executable code;
combining the reputation for the executable code and a reputation of the electronic device with the reputation assigned to the process to update the reputation for the process; and,
in response to determining a thread is attached to the process by an actor process in order to bypass a firewall rule, merging the reputation assigned to the process and a reputation of the actor process or the thread to protect a resource of a computer.
18. The method of claim 17 , further comprising:
combining a reputation of a loaded library with the reputation for the process, wherein the loaded library interacts with executable code included in the process.
19. The method of claim 17 , further comprising:
combining a reputation of a network element with the reputation for the process, wherein the process includes executable code that interacts with the network element.
20. The method of claim 17 , further comprising:
combining a reputation of a content file with the reputation for the process, wherein the process includes executable code that interacts with the content file.
21. The method of claim 17 , further comprising:
combining the reputation of the thread with the reputation for the process.
22. The method of claim 17 , further comprising:
determining a reputation of a behavior of the process; and
combining the reputation of the behavior of the process with the reputation for the process.
23. A system for determining a reputation of a process, the system comprising:
a memory including instructions; and
a processor that executes the instructions to become configured for
identifying the process, wherein the process includes executable code that interacts with an electronic device, and the reputation is assigned to the process;
determining a reputation for the executable code;
combining the reputation for the executable code and a reputation of the electronic device with the reputation assigned to the process to update the reputation for the process; and,
in response to determining a thread is attached to the process by an actor process in order to bypass a firewall rule, merging the reputation assigned to the process and a reputation of the actor process or the thread to protect a resource of a computer.
24. The system of claim 23 , wherein the system is further configured for:
combining a reputation of a network element with the reputation for the process, wherein the process includes executable code that interacts with the network element.
25. The system of claim 23 , wherein the reputation for the process is determined based on a whitelist or a blacklist.