Identifying malware based on content item identifiers
Disclosed are systems, methods, and non-transitory computer-readable storage media for identifying malware based on content item identifiers. For example, a system for detecting malware can be made more efficient by reducing the number of content items that are scanned or analyzed for malicious software code or computer instructions. The number of content items that need to be scanned can be reduced by identifying suspicious content items based on tokens (e.g., strings of characters) commonly used by malware in the identifiers of malware related content items and then analyzing the identified suspicious content items for malicious content (e.g., malicious software instructions) using the anti-malware software.
1. A method comprising:
receiving, by a computing device from a user device, a selection of a content item associated with a user account;
determining, by the computing device, an identifier for the selected content item, wherein the identifier is a name or pathname associated with the selected content item;
generating, by the computing device, one or more tokens based on the content item identifier;
determining, by the computing device, a one or more token scores each corresponding to a respective one of the one or more tokens,
generating, by the computing device, a content item score based on the token scores, wherein the content item score is calculated based on a maximum token score in the one or more token scores, and/or a summation of the one or more token scores;
determining, by the computing device, that the content item is suspected of being associated with malicious software based on the content item score; and
in response to determining that the content item is suspected of being associated with malicious software based on the content item score:
preventing access to the content item,
causing a message to be presented on the user device indicating that the selected content item is unavailable, and
performing an anti-malware scan of a content of the content item.
2. The method of claim 1 , wherein the one or more tokens correspond to respective portions of the content item identifier.
3. The method of claim 1 , wherein each of the token scores is calculated by determining a ratio of a first number corresponding to a number of instances where the respective token appears in malware related content items and a second number corresponding to a number of instances where the respective token appears in all content items managed by the computing device.
4. The method of claim 1 , further comprising:
determining an age of the user account; and
generating the content item score based on the token scores and the age of the user account.
5. The method of claim 1 , further comprising:
determining, by the computing device, that the content item is suspected of being associated with malicious software when the content item score is greater than a threshold value.
6. A non-transitory computer-readable medium including one or more sequences of instructions that, when executed by one or more processors, causes the processors to perform operations comprising:
receiving, by a computing device from a user device, a selection of a content item associated with a user account;
determining, by the computing device, an identifier for the selected content item, wherein the identifier is a name or pathname associated with the selected content item;
generating, by the computing device, one or more tokens based on the content item identifier;
determining, by the computing device, a one or more token scores each corresponding to a respective one of the one or more tokens;
generating, by the computing device, a content item score based on the token scores, wherein the content item score is calculated based on a maximum token score in the one or more token scores, and/or a summation of the one or more token scores;
determining, by the computing device, that the content item is suspected of being associated with malicious software based on the token scores; and
in response to determining that the content item is suspected of being associated with malicious software based on the content item score:
preventing access to the content item,
causing a message to be presented on the user device indicating that the selected content item is unavailable, and
performing an anti-malware scan of a content of the content item.
7. The non-transitory computer-readable medium of claim 6 , wherein the one or more tokens correspond to respective portions of the content item identifier.
8. The non-transitory computer-readable medium of claim 6 , wherein each of the token scores is calculated by determining a ratio of a first number corresponding to a number of instances where the respective token appears in malware related content items and a second number corresponding to a number of instances where the respective token appears in all content items managed by the computing device.
9. The non-transitory computer-readable medium of claim 6 , further comprising:
determining that the content item is associated with malicious software based on the content item scores.
10. The non-transitory computer-readable medium of claim 6 , wherein the instructions cause:
determining an age of the user account; and
generating the content item score based on the token scores and the age of the user account.
11. The non-transitory computer-readable medium of claim 6 , wherein the instructions cause:
determining, by the computing device, that the content item is suspected of being associated with malicious software when the content item score is greater than a threshold value.
12. A system comprising:
one or more processors; and
a non-transitory computer-readable medium including one or more sequences of instructions that, when executed by one or more processors, causes the processors to perform operations comprising:
receiving, by a computing device from a user device, a selection of a content item associated with a user account;
determining, by the computing device, an identifier for the selected content item, wherein the identifier is a name or pathname associated with the selected content item;
generating, by the computing device, one or more tokens based on the content item identifier;
determining, by the computing device, a one or more token scores each corresponding to a respective one of the one or more tokens;
generating, by the computing device, a content item score based on the token scores, wherein the content item score is calculated based on a maximum token score in the one or more token scores, and/or a summation of the one or more token scores;
determining, by the computing device, that the content item is suspected of being associated with malicious software based on the token scores; and
in response to determining that the content item is suspected of being associated with malicious software:
preventing, by the computing device, access to the content item,
causing a message to be presented on the user device indicating that the selected content item is unavailable, and
performing an anti-malware scan of a content of the content item.
13. The system of claim 12 , wherein the one or more tokens correspond to respective portions of the content item identifier.
14. The system of claim 12 , wherein each of the token scores is calculated by determining a ratio of a first number corresponding to a number of instances where the respective token appears in malware related content items and a second number corresponding to a number of instances where the respective token appears in all content items managed by the computing device.
15. The system of claim 12 , further comprising:
determining that the content item is associated with malicious software based on the content item score.
16. The system of claim 15 , wherein the instructions cause:
after performing the anti-malware scan of the content of the content item, determining that the content item is not associated with malicious software; and allowing access to the content item upon determining that the content item is not associated with malicious software.
17. The system of claim 15 , wherein the instructions cause:
after performing the anti-malware scan of the content of the content item, determining that the content item is associated with malicious software; and
in response to determining that the content item is associated with malicious software, storing information indicating that the content item is associated with malicious software; and
in response to determining that the content item is associated with malicious software, preventing the computing device from distributing the content item.
18. The system of claim 12 , wherein the instructions cause:
determining an age of the user account; and
generating the content item score based on the token scores and the age of the user account.
19. The system of claim 12 , wherein the instructions cause:
determining, by the computing device, that the content item is suspected of being associated with malicious software when the content item score is greater than a threshold value.