Automated software safeness categorization with installation lineage and hybrid information sources

1. A computer-implemented method for enhancing cybersecurity in a computer environment by detecting a safeness level of an executable, comprising:

identifying an installation lineage of any type of executable, entities forming the installation lineage including at least an installer of the executable, and a network address from which the executable is retrieved;

analyzing, individually, each entity of the entities forming the installation lineage using at least one safeness analysis, results of the at least one safeness analysis of each entity being inherited by other entities in the lineage of the executable;

determining a backtrace result for the executable based on an inherited safeness evaluation of the executable, the backtrace result being determined by collecting and analyzing reputations of dependent binaries of the executable, and the executable inheriting the reputations of the dependent binaries;

evaluating a total safeness of the executable against a set of thresholds to detect a safeness level of the executable, the total safeness based on at least the backtrace result and a weighted backtrace score determined using a generated dependency importance factor; and

outputting, on a display screen, the safeness level of the executable.

2. The computer-implemented method as recited in claim 1 , further comprising analyzing the executable using the at least one safeness analysis based on gathered program information relating to the executable.

3. The computer-implemented method as recited in claim 2 , wherein evaluating the total safeness of the executable is based on the backtrace result and respective results of the at least one safeness analysis, the safeness level being selected from at least one of: safe, unsafe and unknown.

4. The computer-implemented method as recited in claim 1 , wherein the at least one safeness analysis comprises comparing a behavior of the executable against predefined lists of suspicious process behavior, file behavior and network behavior.

5. The computer-implemented method as recited in claim 1 , wherein the at least one safeness analysis comprises:

generating an executable signature by a hash function based on the executable; and

evaluating the executable signature by accessing a database of executable signatures.

6. The computer-implemented method as recited in claim 1 , wherein the at least one safeness analysis comprises verifying a developer signature of the executable, the developer signature being generated by a developer of the executable, verifying the developer signature includes accessing a database of developer signatures.

7. The computer-implemented method as recited in claim 1 , wherein the at least one safeness analysis comprises conducting one or more anti-virus scans of the executable, each anti-virus scan being conducted by a different anti-virus program.

8. The computer-implemented method as recited in claim 1 , wherein the at least one safeness analysis comprises searching known safe software repositories to determine if the executable is hosted thereon.

9. The computer-implemented method as recited in claim 1 , further comprising:

inputting, on a user interface, feedback regarding the safeness level of the executable and storing the feedback in association with the executable;

adjusting the safeness level of the executable based on the feedback; and

referring to the feedback associated with the executable during future evaluation of the total safeness of the executable.

10. A system for enhancing cybersecurity in a computer system by detecting a safeness level of an executable, comprising:

a storage device configured to store program code and program information relating to any type of executable;

a processor operatively coupled to the storage device and configured to detect a safeness level of the executable by executing program code, stored on the storage device, to:

identify an installation lineage of an executable, entities forming the installation lineage including at least an installer of the executable, and a network address from which the executable is retrieved;

analyze, individually, each entity of the entities forming the installation lineage using at least one safeness analysis, results of the at least one safeness analysis of each entity being inherited by other entities in the lineage of the executable;

determine a backtrace result for the executable based on an inherited safeness evaluation of the executable, the backtrace result being determined by collecting and analyzing reputations of dependent binaries of the executable, and the executable inheriting the reputations of the dependent binaries; and

evaluate a total safeness of the executable against a set of thresholds to detect a safeness level of the executable, the total safeness based on at least the backtrace result and a weighted backtrace score determined using a generated dependency importance factor; and

a display screen having a graphical user interface implemented by the processor and displayed on the display screen, the graphical user interface configured to present the safeness level of the executable, and accept feedback overriding the safeness level of the executable.

11. The system as recited in claim 10 , wherein the processor further executes program code to:

analyze the executable using the at least one safeness analysis based on gathered program information relating to the executable.

12. The system as recited in claim 11 , wherein the processor evaluates the total safeness of the executable based on the backtrace result and respective results of the at least one safeness analysis, the processor selecting the safeness level from at least one of: safe, unsafe and unknown.

13. The system as recited in claim 10 , wherein the processor further executes program code to compare a behavior of the executable against predefined lists of suspicious process behavior, file behavior and network behavior.

14. The system as recited in claim 10 , wherein the processor further executes program code to:

generate an executable signature by a hash function based on the executable; and

evaluate the executable signature by accessing a database of executable signatures.

15. The system as recited in claim 10 , wherein the processor further executes program code to verify a developer signature of the executable, the developer signature being generated by a developer of the executable, the developer signature being verified by at least accessing a database of developer signatures.

16. The system as recited in claim 10 , wherein the processor further executes program code to conduct one or more anti-virus scans of the executable, each anti-virus scan being conducted by a different anti-virus program.

17. The system as recited in claim 10 , wherein the processor further executes program code to:

receive, on a user interface, feedback regarding the safeness level of the executable and store the feedback in association with the executable;

adjust the safeness level of the executable based on the feedback; and

refer to the feedback associated with the executable during future evaluation of the total safeness score of the executable.

18. A computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method for enhancing cybersecurity of the computer by detecting a safeness level of an executable, comprising:

identifying an installation lineage of any type of executable, entities forming the installation lineage including at least an installer of the executable, and a network address from which the executable is retrieved;

analyzing, individually, each entity of the entities forming the installation lineage using at least one safeness analysis, results of the at least one safeness analysis of each entity being inherited by other entities in the lineage of the executable;

determining a backtrace result for the executable based on an inherited safeness evaluation of the executable, the backtrace result being determined by collecting and analyzing reputations of dependent binaries of the executable, and the executable inheriting the reputations of the dependent binaries;

evaluating a total safeness of the executable against a set of thresholds to detect a safeness level of the executable, the total safeness based on at least the backtrace result and a weighted backtrace score determined using a generated dependency importance factor; and

outputting, on a display screen, the safeness level of the executable.

19. The computer program product as recited in claim 18 , further comprising:

analyzing the executable using the at least one safeness analysis based on gathered program information relating to the executable.

20. The computer program product as recited in claim 19 , wherein evaluating the total safeness of the executable is based on the backtrace result and respective results of the at least one safeness analysis, the safeness level being selected from at least one of: safe, unsafe and unknown.