Software publisher trust extension application
A digitally signed unknown application from a software publisher having a reputation is assigned the reputation of the software publisher. In this manner, software publishers who have an established reputation of publishing applications are allowed to rely on their existing reputation when releasing a new application. By quickly assigning reputations to new applications, users executing the new applications for the first time are provided timely recommendations on the quality, e.g., trustworthiness, of the applications they wish to run.
1. A computer-implemented method comprising:
executing, on a processor of a host computer system, a software publisher trust extension application, the executing including:
determining a software publisher of an unknown application, wherein the unknown application is an application without an assigned reputation;
determining reputations of respective ones of at least one user of software published by the software publisher, wherein individual respective reputations of ones of the at least one user being either a first reputation of normally having malicious software on a computing system of the user or a second reputation of not normally having malicious software on a computing system of the user;
determining whether the software publisher of the unknown application has a reputation, the reputation of the software publisher at least including aggregated user reputations of users of software published by the software publisher including the previously determined reputations of the at least one user of software published by the software publisher; and
assigning said reputation of the software publisher to said unknown application upon a determination that said software publisher does have the reputation,
wherein the reputation of the software publisher includes a number of applications published by the software publisher and a number of the published applications including malware, and
the assigning of the reputation changes the unknown application to a known application.
2. The computer-implemented method of claim 1 wherein said reputation is an overall trustworthiness of said software publisher.
3. The computer-implemented method of claim 1 wherein said software publisher published said application by producing or releasing said application for distribution to end-users.
4. The computer-implemented method of claim 3 wherein said application comprises a program designed for said end-users.
5. The computer-implemented method of claim 1 further comprising:
determining, prior to the determining a software publisher, whether said unknown application is digitally signed.
6. The computer-implemented method of claim 5 further comprising:
assigning a default reputation to said unknown application following a determination that said unknown application is not digitally signed.
7. The computer-implemented method of claim 5 wherein said determining whether said unknown application is digitally signed comprises determining whether said unknown application has a valid digital signature.
8. The computer-implemented method of claim 7 wherein the determining said software publisher of said application comprises:
determining said software publisher of said application from said valid digital signature following a determination that said unknown application is digitally signed.
9. The computer-implemented method of claim 1 further comprising:
assigning a default reputation to said application following a determination that said software publisher does not have a reputation.
10. The computer-implemented method of claim 1 further comprising determining whether said known application is being executed, wherein upon a determination that said known application is being executed, said computer-implemented method further comprising determining whether said reputation of said known application allows said execution.
11. The computer-implemented method of claim 10 wherein upon a determination that said reputation of said known application does not allow said execution, said computer-implemented method further comprising taking protective action.
12. The computer-implemented method of claim 11 wherein said taking protective action comprises preventing said execution of said known application.
13. The computer-implemented method of claim 1 , wherein said reputation further includes information about application behavior, the computer-implemented method further comprising:
determining whether said known application is being executed;
determining whether said executing known application is exhibiting suspicious behavior following a determination that said known application is being executed; and
determining whether said reputation of said known application allows said suspicious behavior following a determination that said executing known application is exhibiting suspicious behavior.
14. The computer-implemented method of claim 13 wherein upon a determination that said reputation of said known application does not allow said suspicious behavior, said computer-implemented method further comprising taking protective action.
15. A computer system comprising:
a memory having stored therein a software publisher trust extension application; and
a processor coupled to said memory, wherein execution of said software publisher trust extension application performs a method comprising:
determining a software publisher of an unknown application, wherein the unknown application is an application without an assigned reputation;
determining reputations of respective ones of at least one user of software published by the software publisher, wherein individual respective reputations of ones of the at least one user being either a first reputation of normally having malicious software on a computing system of the user or a second reputation of not normally having malicious software on a computing system of the user;
determining whether the software publisher of the unknown application has a reputation, the reputation of the software publisher at least including aggregated user reputations of users of software published by the software publisher including the previously determined reputations of the at least one user of software published by the software publisher; and
assigning said reputation of the software publisher to said unknown application upon a determination that said software publisher does have the reputation,
wherein the reputation of the software publisher includes a number of applications including malware published by the software publisher, and
the assigning of the reputation changes the unknown application to a known application.
16. A computer-program product comprising a non-transitory tangible computer readable storage medium containing computer program code comprising:
a software publisher trust extension application for:
determining a software publisher of an unknown application, wherein the unknown application is an application without an assigned reputation;
determining reputations of respective ones of at least one user of software published by the software publisher, wherein individual respective reputations of ones of the at least one user being either a first reputation of normally having malicious software on a computing system of the user or a second reputation of not normally having malicious software on a computing system of the user;
determining whether the software publisher of the unknown application has a reputation, the reputation of the software publisher at least including aggregated user reputations of users of software published by the software publisher including the previously determined reputations of the at least one user of software published by the software publisher; and
assigning said reputation of the software publisher to said unknown application upon a determination that said software publisher does have the reputation,
wherein the reputation of the software publisher includes a number of applications including malware published by the software publisher, and
the assigning of the reputation changes the unknown application to a known application.