Method and apparatus for identifying and characterizing errant electronic files
View Patent ↗A computer system includes a server having a memory connected thereto. The server is adapted to be connected to a network to permit remote storage and retrieval of data files from the memory. A file identification application is operative with the server to identify errant files stored in the memory. The file identification application provides the functions of: (1) selecting a file stored in said memory; (2) generating a unique checksum corresponding to the stored fire; (3) comparing said unique checksum to each of a plurality of previously generated checksums, wherein the plurality of previously generated checksums correspond to known errant files; and (4) marking the file for deletion from the memory if the unique checksum matches one of the plurality of previously generated checksums.
1. A computer-implemented method for generating a library of checksum values, the method comprising:
under control of one or more configured computer systems:
storing, in a computer storage medium, a checksum library for assessing suspect files;
identifying a source of known illicit files;
accessing a candidate file stored by a physical storage device for the source;
determining that the candidate file appears within proximity of a minimum threshold number of the known illicit files for the source;
generating a candidate checksum for the candidate file stored by the physical storage device for the source, wherein the known illicit files do not include the candidate file;
determining that the checksum library does not include the candidate checksum; and
adding the candidate checksum to the checksum library stored in the computer storage medium.
2. The computer-implemented method of claim 1 , further comprising:
receiving a criterion identifying a file characteristic; and
identifying the source of known illicit files using the criterion.
3. The computer-implemented method of claim 2 , wherein receiving the criterion comprises receiving at least one of:
a minimum file size; and
a file type.
4. The computer-implemented method of claim 1 , wherein the candidate file comprises a graphics file, and wherein generating the candidate checksum comprises at least one of:
generating the candidate checksum for the graphics file based on vector graphics analysis; or
dividing the graphics file into blocks and comparing relationships between the blocks.
5. The computer-implemented method of claim 1 , wherein adding the candidate checksum to the checksum library comprises:
associating a file name of the candidate file with the candidate checksum; and
associating a file length of the candidate file with the candidate checksum.
6. The computer-implemented method of claim 1 , wherein:
generating the candidate checksum for the candidate file comprises:
generating a first checksum of the candidate file using a first number of bytes from a first file location of the candidate file, and
generating a second checksum of the candidate file using a second number of byes from a second file location of the candidate file; and
wherein adding the candidate checksum to the checksum library comprises adding the first checksum and the second checksum to the checksum library.
7. The computer-implemented method of claim 1 , wherein accessing the candidate file of the source comprises establishing a network connection with at least one of a web server or a newsgroup server.
8. The computer-implemented method of claim 1 , wherein accessing the candidate file of the source comprises:
accessing a first directory of the source, the first directory including the candidate file; and
wherein determining that the candidate file appears within the proximity of a minimum threshold number of the known illicit files for the source is based on a second directory of the source, the second directory including the known illicit files, wherein the first directory is a different location than the second directory.
9. The computer-implemented method of claim 1 , further comprising:
obtaining a suspect file from a second file source;
generating a checksum for the suspect file;
determining the checksum for the suspect file corresponds to the candidate checksum in the checksum library; and
characterizing the suspect file as an unauthorized file.
10. A computer system, comprising:
a computer storage device configured to store a checksum library for assessing suspect files;
a server adapted to be connected to a network to permit retrieval of files from a file source; and
a file identification application operative with the server to generate the checksum library, the file identification application providing the functions of:
identifying the file source as a source of known illicit files;
accessing a candidate file stored by a physical storage device for the file source;
determining that the candidate file appears within proximity of a minimum threshold number of the known illicit files for the source;
generating a candidate checksum for the candidate file from the file source, wherein the known illicit files do not include the candidate file;
determining that the checksum library does not include the candidate checksum; and
adding the candidate checksum to the checksum library stored in the computer storage device.
11. The computer system of claim 10 , wherein the file identification application further provides the functions of:
receiving a criterion identifying a file characteristic; and
identifying the source of known illicit files for processing using the criterion.
12. The computer system of claim 11 , wherein the file identification application receiving the criterion comprises the file identification application receiving at least one of:
a minimum file size; and
a file type.
13. The computer system of claim 10 , wherein the candidate file comprises a graphics file, and wherein the file identification application generating the candidate checksum comprises the file identification application providing at least one of the functions of:
generating the candidate checksum for the graphics file based on vector graphics analysis; or
dividing the graphics file into blocks and comparing relationships between the blocks.
14. The computer system of claim 10 , wherein the file identification application adding the candidate checksum to the checksum library comprises the file identification application providing the functions of:
associating a file name of the candidate file with the candidate checksum; and
associating a file length of the candidate file with the candidate checksum.
15. The computer system of claim 10 , wherein:
the file identification application generating the candidate checksum comprises the file identification application providing the functions of:
generating a first checksum of the candidate file using a first number of bytes from a first file location of the candidate file, and
generating a second checksum of the candidate file using a second number of byes from a second file location of the candidate file; and
wherein adding the candidate checksum to the checksum library comprises adding the first checksum and the second checksum to the checksum library.
16. The computer system of claim 10 , wherein the server is adapted to establish a connection via the network with the file source, wherein the file source comprises at least one of a web server or a newsgroup server.
17. The computer system of claim 10 , wherein the server is adapted to access the candidate file from the file source by:
accessing a first directory of the file source, the first directory including the candidate file; and
wherein determining that the candidate file appears within the proximity of a minimum threshold number of the known illicit files for the source is based on a second directory of the file source, the second directory including the known illicit files, wherein the first directory is a different location than the second directory.
18. The computer system of claim 10 , wherein the server is further adapted to obtain a suspect file from a second file source, and wherein the file identification application is further adapted for providing the functions of:
generating a checksum for the suspect file;
determining the checksum for the suspect file corresponds to the candidate checksum in the checksum library; and
characterizing the suspect file as an unauthorized file.
19. A physical storage device having instructions stored thereon, the instructions comprising:
instructions for storing, in a computer storage medium, a checksum library for assessing suspect files;
instructions for identifying a source of known illicit files;
instructions for accessing a candidate file stored by a physical storage device for the source;
instructions for determining that the candidate file appears within proximity of a minimum threshold number of the known illicit files for the source;
instructions for generating a candidate checksum for the candidate file stored by the physical storage device for the source, wherein the known illicit files do not include the candidate file;
instructions for determining that the checksum library does not include the candidate checksum; and
instructions for adding the candidate checksum to the checksum library stored in the computer storage medium.