Microsoft Technology Licensing, LLC

Micosoft Corporation

Andrew J Newman

Christopher A Meek

Geoff Hulten

John Scarrow

Ronald A Franczyk

Ron Franczyk

Sterling M Reasor

Anatoly Victor Koretsky

Anthony Blumfield

Christopher R Jones

Paul Steve Rehfuss

Steve Rehfuss

Technologies for an application reputation service to assist users with minimizing their computerized machines' exposure to and infection from malware, including an application reputation service that contains the reputations for elements (e.g., applications) that are known to be non-malicious as well as those known to be malicious. In one example, when a user attempts to install or execute a new application, the service is queried by the user's machine with a set of identities for the element. The service determines the reputation of the application by referencing a knowledge base of known reputations and returns an indication (e.g., an overall rating, or a flag) of how safe that application would be to install and run on the user's computer.

Application reputation service

The claimed subject matter is directed to the use of an application reputation service to assist users with minimizing their computerized machines' exposure to infection from malware. The claimed subject matter provides an application reputation service that contains the reputations for elements that are known to be non-malicious as well as those known to be malicious. One embodiment is implemented as a method to determine the reputation of an element (e.g., an application). When a user attempts to install or execute a new application, the Application Reputation Service is queried by the user's machine with a set of identities for the element. The reputation of the application is determined by referencing a knowledge base of known reputations and returns an indication (e.g., an overall rating, or a flag) of how safe that application would be to install and run on the user's computer.

Systems, methods, and/or techniques ('tools') that relate to an automated service for blocking malware hosts are described herein. In different implementations, the tools receive network addresses identifying hosts that are discovered to contain malware. The tools also provide the network addresses to a collection and storage service. Other components provided by the tools receive the network addresses from, for example, a plurality of reporting clients. These components may aggregate the network addresses across the reporting clients, and store instances of the malware and associated malware addresses.

Automated service for blocking malware hosts

Embodiments of a feedback-driven malware detector are directed to protecting a computer from programs that perform actions that are malicious or not expected by a user. In one embodiment, the feedback-driven malware detector performs a method that initially determines whether the state of an application program scheduled to be added to an extensibility point on a computer is already known. If the state of the object is not already known, the user is informed that an application program is being installed on the computer and that the application program is being added to an extensibility point. Then, input is obtained from the user that assists in determining whether the application program is malware.

Feedback-driven malware detector

Growing community of inventors

Kirkland, WA, United States of America

Andrew J Newman