Statistical analytic method for the determination of the risk posed by file based content

摘要

A system and method for calculating a risk assessment for an electronic file is described. A database of checks, organized into categories, can be used to scan electronic files. The categories of checks can include weights assigned to them. An analyzer can analyze electronic files using the checks. Issues identified by the analyzer can be weighted using the weights to determine a risk assessment for the electronic file.

主权项

1. A system, comprising:
a computer; a memory in the computer;
a database stored in the memory, the database including:a plurality of checks organized into a plurality of categories; and for each of the plurality of categories, a weight assigned to the category, including default weights assigned to the plurality of categories; a receiver to receive an electronic file; an analyser to analyse a first corpus of files with known non-conformities to produce a first result and to analyse a second corpus of safe files to produce a second result, and to analyse the electronic file using the plurality of checks in the database; a statistical analyser to statistically review the first result and the second result and to adjust the default weights assigned to the plurality of categories so that a first calculated risk assessment for the first corpus of files is higher than a second calculated risk assessment for the second corpus of files; and a threat calculator to calculate a risk assessment for the electronic file using a result from the analyser and the weights assigned to the plurality of categories, wherein when the risk assessment indicates that the electronic file is likely a threat, the electronic file can be detonated in an electronic sandbox.