System, method, and computer program product for conditionally performing an action based on an attribute
View Patent ↗A system, method, and computer program product are provided for conditionally performing an action based on an attribute. In use, at least one attribute associated with an object is determined. Additionally, an event associated with the object is identified. Further, at least one action is conditionally performed in association with the event, based on the at least one attribute.
1. A non-transitory computer readable medium, on which are stored instructions, comprising instructions that when executed cause a computer system to:
determine whether a first file is trusted;
monitor activity related to the first file and a second file;
redetermine whether the first file is trusted based at least in part upon whether the second file is trusted;
determine not to perform a scan operation on the first file responsive to both the first file and the second file being trusted;
determine to perform a scan operation on the first file responsive to the first file being untrusted; and
determine to perform a scan operation on the first file responsive to the second file being untrusted,
wherein the first file comprises an executable file, and
wherein the monitored activity indicates an action performed on the second file by execution of the first file.
2. The non-transitory computer readable medium of claim 1 , wherein the instructions that when executed cause the computer system to redetermine whether the first file is trusted comprise instructions that when executed cause the computer system to determine the first file is untrusted responsive to the second file being untrusted.
3. The non-transitory computer readable medium of claim 1 , wherein the monitored activity indicates an action performed on the first file by the second file.
4. The non-transitory computer readable medium of claim 1 , wherein the monitored activity indicates that the second file has been loaded by execution of the first file.
5. The non-transitory computer readable medium of claim 1 , wherein the instructions that when executed cause the computer system to determine the first file is trusted further comprise instructions that when executed cause the computer system to inherit a trust information from a creator of the first file.
6. A computer system comprising:
one or more processors;
memory, coupled to the one or more processors, on which are stored instructions, comprising instructions that when executed cause the one or more processors to:
determine whether a first object is trusted;
monitor activity related to the first object and a second object;
redetermine whether the first object is trusted based at least in part upon whether the second object is trusted;
determine not to perform a scan operation on the first object responsive to both the first object and a the second object being trusted;
determine to perform a scan operation on the first object responsive to the first object being untrusted; and
determine to perform a scan operation on the first object responsive to the second object being untrusted,
wherein the first object comprises an executable object, and
wherein the monitored activity indicates an action performed on the second object by execution of the first object.
7. The computer system of claim 6 , wherein the instructions that when executed cause the one or more processors to redetermine whether the first object is trusted comprise instructions that when executed cause the one or more processors to determine the first object is untrusted responsive to the second object being untrusted.
8. The computer system of claim 6 , wherein the first object comprises a file.
9. The computer system of claim 6 , wherein the second object comprises a process of a computer operating system.
10. The computer system of claim 6 , wherein the instructions that when executed cause the one or more processors to monitor activity related to the first object and a second object comprise instructions that when executed cause the one or more processors to receive an indication that the second object has performed an action involving the first object.
11. The computer system of claim 6 , wherein the instructions that when executed cause one or more processors to monitor activity related to the first object and a second object comprise instructions that when executed cause the one or more processors to determine that the second object has been acted upon by the first object.
12. A computer system comprising:
one or more processors;
a memory, coupled to the one or more processors, on which are stored instructions, comprising instructions that when executed cause one or more processors to:
establish a first trust state for a first object, comprising scanning the first object for malware;
monitor activity related to the first object and a second object;
update the first trust state of the first object based at least in part upon a second trust state associated with the second object;
determine not to perform a scan operation on the first object responsive to the first trust state and the second trust state indicating that the first object and the second object are both trusted;
determine to perform a scan operation on the first object responsive to the first trust state or the second trust state indicating the first object is untrusted; and
determine to perform a scan operation on the first object responsive to the first trust state or the second trust state indicating the second object is untrusted,
wherein the first object comprises an executable object, and
wherein the monitored activity indicates an action performed on the second object by execution of the first object.