Identification of telemetry data

摘要

Methods, systems, and computer-readable media are disclosed for identifying telemetry data. A particular method scans a file and compares the file to at least one attribute to be used for telemetry collection. When the file is identified as a telemetry candidate, an offer to submit a sample of the file is sent to a server. A response to the offer is received from the server. If the response to the offer indicates an acceptance, a sample of the file is sent to the server.

主权项

1. A method comprising:
scanning a file by an anti-malware engine, the anti-malware engine receiving telemetry data from a server, the telemetry data including at least one attribute, and comparing the file to the at least one attribute; identifying the file as a telemetry candidate, the telemetry candidate identified by a malware detection engine at a client device, the malware detection engine configured to detect known malware and other potentially dangerous software, wherein the file is identified as the telemetry candidate in response to identifying a match between the file and the at least one attribute; communicating an offer to send a sample of the file to the server; receiving a response to the offer from the server; and after receiving the response:
sending the sample of the file to the server conditioned on the response indicating an acceptance of the offer to send the sample; andrefraining from sending the sample of the file to the server conditioned on the response indicating a refusal of the offer to send the sample.