Systems and methods for determining the reputations of unknown files

1. A computer-implemented method for determining the reputations of unknown files, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying, by the computing device, a file that was downloaded by the computing device from an external file host;

creating, by the computing device, a node that represents the file in a dynamic file relationship graph;

connecting, by the computing device, the node in the dynamic file relationship graph with at least one other node that represents an attribute of the external file host, wherein connecting the node with the at least one other node comprises labeling an edge between the node and the at least one other node with a timestamp of the current time;

determining, by the computing device, that the at least one other node connected to the node in the dynamic file relationship graph has a first reputation score and that the at least one other node exceeds a threshold for a number connected nodes with reputations;

labeling, by the computing device, based on the at least one other node exceeding the threshold, the node with a second reputation score calculated based at least in part on the first reputation score of the at least one other node that represents the attribute of the external file host by using the dynamic file relationship graph to propagate the first reputation score from the at least one other node to the node that represents the file, wherein the attribute comprises an address associated with the external file host and wherein the address is utilized to reconstruct a delivery network for both benign and malicious files;

determining, by the computing device, based on the second reputation score, that the file is malicious; and

performing, by the computing device, a security action with respect to the malicious file to protect the computing device from the malicious file.

2. The computer-implemented method of claim 1 , wherein identifying the file comprises determining that reputation data for the file is not currently stored in the dynamic file relationship graph.

3. The computer-implemented method of claim 1 , wherein labeling the node with the second reputation score comprises averaging the first reputation score for the at least one other node connected to the node.

4. The computer-implemented method of claim 1 , wherein the second reputation score comprises a percentage probability that the file is malicious.

5. The computer-implemented method of claim 1 , further comprising, in response to labeling the node with the second reputation score, labeling an unlabeled node that is connected to the node with a new reputation score that is calculated at least in part using the second reputation score for the node.

6. The computer-implemented method of claim 1 , wherein connecting the node with the at least one other node further comprises creating the at least one other node that represents the attribute of the external file host.

7. The computer-implemented method of claim 6 , wherein creating the at least one other node comprises connecting the at least one other node with at least one additional node that represents at least one additional attribute of the external file host.

8. The computer-implemented method of claim 1 , wherein the attribute of the external file host further comprises an additional file downloaded from the external file host and wherein the address comprises:

an Internet protocol address of the external file host;

a uniform resource locator of the external file host; and

a referrer uniform resource locator of the external file host.

9. A system for determining the reputations of unknown files, the system comprising:

an identification module, stored in memory, that identifies, by a computing device, a file that was downloaded by a computing device from an external file host;

a creation module, stored in memory, that creates, by the computing device, a node that represents the file in a dynamic file relationship graph;

a connection module, stored in memory, that connects, by the computing device, the node in the dynamic file relationship graph with at least one other node that represents an attribute of the external file host, wherein the node is connected with the at least one other node by labeling an edge between the node and the at least one other node with a timestamp of the current time;

a labeling module, stored in memory, that:

determines, by the computing device, that the at least one other node connected to the node in the dynamic file relationship graph has a first reputation score and that the at least one other node exceeds a threshold for a number connected nodes with reputations;

labels, by the computing device, based on the at least one other node exceeding the threshold, the node with a second reputation score calculated based at least in part on the first reputation score of the at least one other node that represents the attribute of the external file host by using the dynamic file relationship graph to propagate the first reputation score from the at least one other node to the node that represents the file, wherein the attribute comprises an address associated with the external file host and wherein the address is utilized to reconstruct a delivery network for both benign and malicious files;

determines, by the computing device, based on the second reputation score, that the file is malicious; and

performs, by the computing device, a security action with respect to the malicious file to protect the computing device from the malicious file; and

at least one physical processor configured to execute the identification module, the creation module, the connection module, and the labeling module.

10. The system of claim 9 , wherein the identification module identifies the file by determining that reputation data for the file is not currently stored in the dynamic file relationship graph.

11. The system of claim 9 , wherein the labeling module labels the node with the second reputation score by averaging the first reputation score for the at least one other node connected to the node.

12. The system of claim 9 , wherein the second reputation score comprises a percentage probability that the file is malicious.

13. The system of claim 9 , wherein the labeling module, in response to labelling the node with the second reputation score, labels an unlabeled node that is connected to the node with a new reputation score that is calculated at least in part using the second reputation score for the node.

14. The system of claim 9 , wherein the connection module further connects the node with the at least one other node by creating the at least one other node that represents the attribute of the external file host.

15. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

Identify, by the computing device, a file that was downloaded by the computing device from an external file host;

create, by the computing device, a node that represents the file in a dynamic file relationship graph;

connect, by the computing device, the node in the dynamic file relationship graph with at least one other node that represents an attribute of the external file host, wherein the node is connected with the at least one other node by labeling an edge between the node and the at least one other node with a timestamp of the current time;

determine, by the computing device, that the at least one other node connected to the node in the dynamic file relationship graph has a first reputation score and that the at least one other node exceeds a threshold for a number of connected nodes with reputations;

label, by the computing device, based on the at least one other node exceeding the threshold, the node with a second reputation score calculated based at least in part on the first reputation score of the at least one other node that represents the attribute of the external file host by using the dynamic file relationship graph to propagate the first reputation score from the at least one other node to the node that represents the file, wherein the attribute comprises an address associated with the external file host and wherein the address is utilized to reconstruct a delivery network for both benign and malicious files;

determine, by the computing device, based on the second reputation score, that the file is malicious; and

perform, by the computing device, a security action with respect to the malicious file to protect the computing device from the malicious file.

16. The non-transitory computer-readable medium of claim 15 , wherein the one or more computer-readable instructions cause the computing device to identify the file by determining that reputation data for the file is not currently stored in the dynamic file relationship graph.

17. The non-transitory computer-readable medium of claim 15 , wherein the one or more computer-readable instructions cause the computing device to label the node with the second reputation score by averaging the first reputation score for the at least one other node connected to the node.

18. The non-transitory computer-readable medium of claim 15 , wherein the second reputation score comprises a percentage probability that the file is malicious.

19. The non-transitory computer-readable medium of claim 15 , wherein the one or more computer-readable instructions further cause the computing device, in response to labeling the node with the second reputation score, to label an unlabeled node that is connected to the node with a new reputation score that is calculated at least in part using the second reputation score for the node.