IP-based blocking of malware
A security module on a client monitors file download activities at the client and reports hosting website data to a security server. A download analysis module at the security server receives a hosting website data report from the client, where the hosting website data report describes a domain name and an IP address of a website hosting a file the client is attempting to download. The download analysis module analyzes the domain name and IP address of the website to generate file download control data indicating whether to allow downloading of the file to the client. The download analysis module reports the file download control data to the security module of the client. The security module uses the file download control data to selectively block downloading of the file.
1. A computer-implemented method for blocking a download of malicious software (malware), the method comprising:
using one or more computer processors to perform:
receiving a hosting website data report, the hosting website data report describing a domain name and an Internet Protocol (IP) address of a website hosting a file a client is attempting to download;
determining whether the domain name of the web site is on a list of trusted domains, and generating file download control data indicating to allow downloading of the file responsive to determining the domain name of the website is on the list of trusted domains;
responsive to determining the domain name of the website being not on the list of trusted domains, determining whether the IP address of the web site is on a list of IP addresses from which clients have downloaded malware, wherein the list of IP addresses from which clients have downloaded malware lists IP addresses from which more than a threshold number of malware downloads to clients have been detected within a given time period;
responsive to determining the domain name of the website being not on the list of trusted domains and the IP address of the website being not on the list of IP addresses from which clients have downloaded malware, using a file identifier to determine a file reputation score for the file by obtaining information about the file from a database, the information about the file describing characteristics of the file for determining the file reputation score, the file reputation score indicating whether the file likely contains malware;
responsive to the file reputation score indicating the file likely containing malware, generating file download control data indicating to block downloading of the file; and
reporting the file download control data to the client, wherein the client is adapted to use the file download control data to selectively block downloading of the file.
2. The method of claim 1 , wherein trusted domain names are added to the list of trusted domains responsive to data observed about the domain names in hosting website data reports received from a plurality of clients.
3. The method of claim 1 , wherein the client is further adapted to examine the file for malware responsive to receiving the file download control data indicating to download the file.
4. A non-transitory computer-readable storage medium storing executable computer program instructions for blocking a download of malicious software (malware), the computer program instructions comprising instructions for:
receiving a hosting website data report, the hosting website data report describing a domain name and an Internet Protocol (IP) address of a website hosting a file a client is attempting to download;
determining whether the domain name of the website is on a list of trusted domains, and generating file download control data indicating to allow downloading of the file responsive to determining the domain name of the website is on the list of trusted domains;
responsive to determining the domain name of the website being not on the list of trusted domains, determining whether the IP address of the website is on a list of IP addresses from which clients have downloaded malware, wherein the list of IP addresses from which clients have downloaded malware lists IP addresses from which more than a threshold number of malware downloads to clients have been detected within a given time period;
responsive to determining the domain name of the website being not on the list of trusted domains and the IP address of the website being not on the list of IP addresses from which clients have downloaded malware, using a file identifier to determine a file reputation score for the file by obtaining information about the file from a database, the information about the file describing characteristics of the file for determining the file reputation score, the file reputation score indicating whether the file likely contains malware;
responsive to the file reputation score indicating the file likely containing malware, generating file download control data indicating to block downloading of the file; and
reporting the file download control data to the client, wherein the client is adapted to use the file download control data to selectively block downloading of the file.
5. The computer-readable storage medium of claim 4 , wherein trusted domains are added to the list of trusted domains responsive to data observed about the domain names in hosting website data reports received from a plurality of clients.
6. The computer-readable storage medium of claim 4 , wherein the client is further adapted to examine the file for malware responsive to receiving the file download control data indicating to download the file.
7. A system for blocking a download of malicious software (malware) comprising:
a non-transitory computer-readable storage medium storing executable computer program modules comprising:
an evaluation module for receiving a hosting website data report, the hosting website data report describing a domain name and an Internet Protocol (IP) address of a website hosting a file a client is attempting to download;
the evaluation module further for:
determining whether the domain name of the web site is on a list of trusted domains, and generating file download control data indicating to allow downloading of the file responsive to determining the domain name of the website is on the list of trusted domains;
responsive to determining the domain name of the website being not on the list of trusted domains, determining whether the IP address of the website is on a list of IP addresses from which clients have downloaded malware, wherein the list of IP addresses from which clients have downloaded malware lists IP addresses from which more than a threshold number of malware downloads to clients have been detected within a given time period;
responsive to determining the domain name of the website being not on the list of trusted domains and the IP address of the website being not on the list of IP addresses from which clients have downloaded malware, using a file identifier to determine a file reputation score for the file by obtaining information about the file from a database, the information about the file describing characteristics of the file for determining the file reputation score, the file reputation score indicating whether the file likely contains malware; and
responsive to the file reputation score indicating the file likely containing malware, generating file download control data indicating to block downloading of the file;
a server interaction module for reporting the file download control data to the client, wherein the client is adapted to use the file download control data to selectively block downloading of the file; and
a processor for executing the computer program modules.
8. The system of claim 7 , wherein trusted domains are added to the list of trusted domains responsive to data observed about the domain names in hosting website data.
9. The system of claim 7 , wherein the client is further adapted to examine the file for malware responsive to receiving the file download control data indicating to download the file.