US 12,086,234 B2
System and method for checking reputations of executable files using file origin analysis
Shirish Vijayvargiya, Pune (IN); Pankaj Suryawanshi, Pune (IN); and Roshan Kolhe, Pune (IN)
Assigned to VMware LLC, Palo Alto, CA (US)
Filed by VMWARE, INC., Palo Alto, CA (US)
Filed on Oct. 22, 2021, as Appl. No. 17/507,825.
Claims priority of application No. 202141035579 (IN), filed on Aug. 6, 2021.
Prior Publication US 2023/0041397 A1, Feb. 9, 2023
Int. Cl. H04L 29/06 (2006.01); G06F 21/52 (2013.01)
CPC G06F 21/52 (2013.01) [G06F 2221/033 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method for checking reputations of executable files in an endpoint device, the method comprising:
executing an integrity verification on an executable file being scanned to determine whether the executable file has been unaltered since being installed in the endpoint device, wherein executing an integrity verification comprises:
computing a hash of the executable file;
searching for a stored hash of the executable file in a local storage of the endpoint device;
comparing the computed hash of the executable file with the stored hash of the executable file; and
when the computed hash of the executable file matches the stored hash of the executable file, determining that the executable file has been unaltered since being installed in the endpoint device;
when the executable file has been determined to be altered since being installed in the endpoint device, setting a reputation of the executable file as unknown;
when the executable file has been determined to be unaltered since being installed in the endpoint device, executing a file origin analysis on the executable file based on a vendor identifier for the executable file to determine whether the executable file is from an approved source, wherein the vendor identifier for the executable file is a key used to sign a software installer package that included the executable file that is stored locally when the software installer package is installed in the endpoint device; and
when the executable file is determined to be from an approved source, producing an output that indicates that the executable file has an approved reputation.