Determining a reputation for a process
Particular embodiments described herein provide for an electronic device that can be configured to identify a process running on the electronic device, assign a reputation to the process if the process has a known reputation, determine if the process includes executable code, determine a reputation for the executable code, and combine the reputation for the executable code with the reputation assigned to the process to create a new reputation for the process.
1. At least one non-transitory, computer-readable medium including instructions that, when executed by an electronic device, cause the electronic device to perform a method comprising:
launching a process including a plurality of primary executable code modules or functions;
executing executable code included in the process, the process having a first reputation;
determining a second reputation for a first one of the plurality of primary executable code modules or functions;
determining a third reputation for a second one of the plurality of primary executable code modules or functions;
updating the first reputation of the process, based on the third reputation for the second one of the plurality of primary executable code modules or functions, the second reputation for the first one of the plurality of primary executable code modules or functions, and the first reputation of the process;
determining that a user interacts with the process;
updating the first reputation of the process with a reputation of the user;
if an event affects the first reputation of the process, modifying the first reputation of the process to a merge of the first reputation of the process and a fourth reputation of the event; and,
if the process interprets a content file, combining a reputation of the content file with the first reputation of the process, wherein the content file is a script or document.
2. The at least one computer-readable medium of claim 1 , the method further comprising:
determining that the process performs a load library event; and
combining a reputation of the loaded library with the first reputation of the process, if the library is identified to have a malicious reputation after the load library event has occurred.
3. The at least one computer-readable medium of claim 1 , the method further comprising:
if a thread is attached to the process, combining a reputation of the thread with the first reputation of the process.
4. The at least one computer-readable medium of claim 1 , the method further comprising:
if the reputation of the electronic device has changed, combining the reputation of the electronic device with the first reputation of the process.
5. The at least one computer-readable medium of claim 1 , wherein the first reputation of the process is determined based on an allow list or a block list.
6. The at least one computer-readable medium of claim 1 , wherein the user has a seniority in a department of employment.
7. An apparatus, comprising:
a memory that stores a process; and
a processor configured to
launch a process including a plurality of primary executable code modules or functions;
execute executable code included in the process, which has a first reputation;
determine a second reputation for a first one of the plurality of primary executable code modules or functions;
determine a third reputation for a second one of the plurality of primary executable code modules or functions;
update the first reputation of the process, based on the third reputation for the second one of the plurality of primary executable code modules or functions, the second reputation for the first one of the plurality of primary executable code modules or functions, and the first reputation of the process;
determine that a user interacts with the process;
update the first reputation of the process with a reputation of the user;
if an event affects the first reputation of the process, modify the first reputation of the process to a merge of the first reputation of the process and a fourth reputation of the event; and,
if the process interprets a content file, combine a reputation of the content file with the first reputation of the process, and the content file is a script or document.
8. The apparatus of claim 7 , wherein the processor further is configured to determine that the process performs a load library event and to combine a reputation of the loaded library with the first reputation of the process, if the library is identified to have a malicious reputation after the load library event has occurred.
9. The apparatus of claim 7 , wherein the processor further is configured to, if a thread is attached to the process, combine a reputation of the thread with the first reputation of the process.
10. The apparatus of claim 7 , wherein the processor further is configured to, if the reputation of the apparatus has changed, combine the reputation of the apparatus with the first reputation of the process.
11. The apparatus of claim 7 , wherein the first reputation of the process is determined based on an allow list or a block list.
12. The apparatus of claim 7 , wherein the user has a seniority in a department of employment.
13. A method, comprising:
launching a process including a plurality of primary executable code modules or functions;
executing, with an electronic device, executable code included in the process, the process having a first reputation;
determining a second reputation for a first one of the plurality of primary executable code modules or functions;
determining a third reputation for a second one of the plurality of primary executable code modules or functions;
updating the first reputation of the process, based on the third reputation for the second one of the plurality of primary executable code modules or functions, the second reputation for the first one of the plurality of primary executable code modules or functions, and the first reputation of the process;
determining that a user interacts with the process;
updating the first reputation of the process with a reputation of the user;
if an event affects the first reputation of the process, modifying the first reputation of the process to a merge of the first reputation of the process and a fourth reputation of the event; and,
if the process interprets a content file, combining a reputation of the content file with the first reputation of the process, wherein the content file is a script or document.
14. The method of claim 13 , further comprising:
determining that the process performs a load library event; and
combining a reputation of the loaded library with the first reputation of the process, if the library is identified to have a malicious reputation after the load library event has occurred.
15. The method of claim 13 , further comprising:
if a thread is attached to the process, combining a reputation of the thread with the first reputation of the process.
16. The method of claim 13 , further comprising:
if the reputation of the electronic device has changed, combining the reputation of the electronic device with the first reputation of the process.
17. The method of claim 13 , wherein the first reputation of the process is determined based on an allow list or a block list.