Identifying malware based on content item identifiers
Disclosed are systems, methods, and non-transitory computer-readable storage media for identifying malware based on content item identifiers. For example, a system for detecting malware can be made more efficient by reducing the number of content items that are scanned or analyzed for malicious software code or computer instructions. The number of content items that need to be scanned can be reduced by identifying suspicious content items based on tokens (e.g., strings of characters) commonly used by malware in the identifiers of malware related content items and then analyzing the identified suspicious content items for malicious content (e.g., malicious software instructions) using the anti-malware software.
1. A non-transitory computer readable medium comprising instructions which, when executed by a computing system, cause the computing system to perform operations comprising:
receiving a request to access a content item stored in content storage;
obtaining an identifier for the content item, wherein the identifier comprises a name or pathname associated with the content item;
generating one or more tokens based on the identifier;
determining one or more token scores each corresponding to a respective one of the one or more tokens;
generating a content item score based on the one or more token scores, wherein the content item score is calculated based at least on a maximum token score in the one or more token scores or a summation of the one or more token scores;
determining that the content item is suspected of being associated with malicious content based on the content item score; and
in response to determining that the content item is suspected of being associated with malicious content based on the content item score, performing at least one of a plurality of remedial operations with respect to the requested content item, the plurality of remedial operations comprising:
preventing access to the content item,
causing a message to be presented indicating that the content item is unavailable, and
performing an anti-malware scan of a content of the content item.
2. The non-transitory computer readable medium of claim 1 , wherein the one or more tokens correspond to respective portions of the identifier.
3. The non-transitory computer readable medium of claim 1 , wherein each of the one or more token scores is calculated by:
determining a ratio of a first number corresponding to a number of instances where the respective token appears in malware related content items and a second number corresponding to a number of instances where the respective token appears in substantially all content items in the content storage.
4. The non-transitory computer readable medium of claim 1 , further comprising:
determining an age of a user account associated with the request; and
generating the content item score based on the one or more token scores and the age of the user account.
5. The non-transitory computer readable medium of claim 4 , wherein generating the content item score based on the one or more token scores and the age of the user account comprises:
determining that the age of the user account is at least a threshold amount of time; and
increasing the content item score based on a value associated with the threshold amount of time.
6. The non-transitory computer readable medium of claim 1 , wherein determining that the content item is suspected of being associated with malicious content based on the content item score comprises:
comparing the content item score to a threshold value.
7. The non-transitory computer readable medium of claim 1 , wherein generating the one or more tokens based on the identifier, comprises:
identifying one or more delimiters contained in the identifier; and
extracting tokens from the identifier based on the one or more delimiters.
8. A method comprising:
receiving, by a content management system, a request to access a content item stored in content storage;
obtaining, by the content management system, an identifier for the content item, wherein the identifier comprises a name or pathname associated with the content item;
generating, by the content management system, one or more tokens based on the item identifier;
determining, by the content management system, one or more token scores each corresponding to a respective one of the one or more tokens;
generating, by the content management system, a content item score based on the one or more token scores, wherein the content item score is calculated based at least on a frequency in which each token is found within identifiers for a plurality of content items stored in the content storage;
determining, by the content management system, that the content item is suspected of being associated with malicious content based on the content item score; and
in response to determining that the content item is suspected of being associated with malicious content based on the content item score, performing at least one of a plurality of remedial operations with respect to the requested content item, the plurality of remedial operations comprising:
preventing access to the content item,
causing a message to be presented indicating that the content item is unavailable, and
performing an anti-malware scan of a content of the content item.
9. The method of claim 8 , wherein the one or more tokens correspond to respective portions of the identifier.
10. The method of claim 8 , wherein each of the one or more token scores is calculated by:
determining a ratio of a first number corresponding to a number of instances where the respective token appears in malware related content items and a second number corresponding to a number of instances where the respective token appears in substantially all content items managed by the content management system.
11. The method of claim 8 , wherein the content item score corresponds to a maximum token score in the one or more token scores.
12. The method of claim 8 , further comprising:
determining an age of a user account; and
generating the content item score based on the token scores and the age of the user account.
13. The method of claim 8 , wherein determining, by the content management system, that the content item is suspected of being associated with malicious content based on the content item score comprises:
comparing the content item score to a threshold value.
14. The method of claim 8 , wherein generating, by the content management system, the one or more tokens based on the identifier, comprises:
identifying one or more delimiters contained in the identifier; and
extracting tokens from the content.
15. A system, comprising:
one or more processors; and
a memory having programming instructions stored thereon, which, when executed by the one or more processors, causes the system to perform operations, comprising:
receiving a request to access a content item stored in content storage;
obtaining an identifier for the content item, wherein the identifier comprises a name or pathname associated with the content item;
generating one or more tokens based on the identifier;
determining one or more token scores each corresponding to a respective one of the one or more tokens;
generating a content item score based on the one or more token scores, wherein the content item score is calculated based at least on a maximum token score in the one or more token scores or a summation of the one or more token scores;
determining that the content item is suspected of being associated with malicious content based on the content item score; and
in response to determining that the content item is suspected of being associated with malicious content based on the content item score, performing at least one of a plurality of remedial operations with respect to the requested content item, the plurality of remedial operations comprising:
preventing access to the content item,
causing a message to be presented indicating that the content item is unavailable, and
performing an anti-malware scan of a content of the content item.
16. The system of claim 15 , wherein the one or more tokens correspond to respective portions of the identifier.
17. The system of claim 15 , wherein each of the one or more token scores is calculated by:
determining a ratio of a first number corresponding to a number of instances where the respective token appears in malware related content items and a second number corresponding to a number of instances where the respective token appears in substantially all content items managed by the system.
18. The system of claim 15 , wherein the operations further comprise:
determining an age of a user account associated with the request; and
generating the content item score based on the one or more token scores and the age of the user account.
19. The system of claim 18 , wherein generating the content item score based on the one or more token scores and the age of the user account comprises:
determining that the age of the user account is at least a threshold amount of time; and
increasing the content item score based on a value associated with the threshold amount of time.
20. The system of claim 15 , wherein determining that the content item is suspected of being associated with malicious content based on the content item score comprises:
comparing the content item score to a threshold value.