Benign file list generation

1. A system for generating a list of benign files, comprising one or more processors and one or more non-transitory computer-readable memories coupled to the one or more processors and configured with instructions executable by the one or more processors to cause the system to perform operations comprising:

obtaining standard benign file information identifying a set of standard benign files;

obtaining a set of standard signatures for the set of standard benign files;

adding the standard benign file information to global benign file information identifying a set of global benign files, wherein the global benign file information is associated with a set of global signatures;

obtaining first client benign file information identifying a first set of client benign files for a first client;

determining, for one client benign file of the first set of client benign files, whether the global benign file information identifies the one client benign file;

adding, in response to determining that the global benign file information does not identify the one client benign file, a new signature corresponding to the one client benign file to the set of global signatures;

modifying the global benign file information to associate the one client benign file with an identifier of the first client;

obtaining a set of first client signatures for the first set of client benign files for the first client; and

generating a first client exception list for the first client based on the set of standard signatures and the set of first client signatures.

2. The system of claim 1 , wherein obtaining the standard benign file information includes obtaining the standard benign file information from an organization that creates security standards.

3. The system of claim 1 , wherein at least one signature in the first client exception list is determined based on core information extracted from a corresponding file, wherein the core information extracted from the corresponding file matches core information extracted from a similar file.

4. The system of claim 1 , the operations further comprising:

obtaining second client benign file information identifying a second set of client benign files for a second client;

obtaining a set of second client signatures for the second set of client benign files for the second client; and

generating a second client exception list for the second client based on the set of standard signatures and the set of second client signatures.

5. The system of claim 1 , wherein the set of first client signatures is obtained based on the set of global signatures and the identifier of the first client.

6. The system of claim 1 , the operations further comprising:

obtaining a malware list based on a set of signatures for a set of malware files;

receiving, for a signature contained in both the malware list and the first client exception list, a selection to remove the signature from either the malware list or the first client exception list; and

removing the signature based on the selection.

7. The system of claim 1 , the operations further comprising:

providing the first client exception list to the first client.

8. A method for generating a list of benign files, the method comprising:

obtaining standard benign file information identifying a set of standard benign files;

obtaining a set of standard signatures for the set of standard benign files;

adding the standard benign file information to global benign file information identifying a set of global benign files, wherein the global benign file information is associated with a set of global signatures;

obtaining first client benign file information identifying a first set of client benign files for a first client;

determining, for one client benign file of the first set of client benign files, whether the global benign file information identifies the one client benign file;

adding, in response to determining that the global benign file information does not identify the one client benign file, a new signature corresponding to the one client benign file to the set of global signatures;

modifying the global benign file information to associate the one client benign file with an identifier of the first client;

obtaining a set of first client signatures for the first set of client benign files for the first client; and

generating a first client exception list for the first client based on the set of standard signatures and the set of first client signatures.

9. The method of claim 8 , wherein obtaining the standard benign file information includes obtaining the standard benign file information from an organization that creates security standards.

10. The method of claim 8 , wherein at least one signature in the first client exception list is determined based on core information extracted from a corresponding file, wherein the core information extracted from the corresponding file matches core information extracted from a similar file.

11. The method of claim 8 , further comprising:

obtaining second client benign file information identifying a second set of client benign files for a second client;

obtaining a set of second client signatures for the second set of client benign files for the second client; and

generating a second client exception list for the second client based on the set of standard signatures and the set of second client signatures.

12. The method of claim 8 , wherein the set of first client signatures is obtained based on the set of global signatures and the identifier of the first client.

13. The method of claim 8 , further comprising:

obtaining a malware list based on a set of signatures for a set of malware files;

receiving, for a signature contained in both the malware list and the first client exception list, a selection to remove the signature from either the malware list or the first client exception list; and

removing the signature based on the selection.

14. The method of claim 8 , further comprising:

providing the first client exception list to the first client.