Using confidence about user intent in a reputation system

Abstract

Reputations of objects are determined by a reputation system using reports from clients identifying the objects. Confidence metrics for the clients are generated using information determined from the reports. Confidence metrics indicate the amounts of confidence in the veracity of the reports. Reputation scores of objects are calculated using the reports from the clients and the confidence metrics for the clients. Confidence metrics and reputation scores are stored in correlation with identifiers for the objects. An object's reputation score is provided to a client in response to a request.

What is claimed is: 
     
         1 . A method of using a computer to determine a reputation of an object in a reputation system, comprising:
 receiving reports from clients in the reputation system, the reports identifying an object detected at the clients;   determining a prevalence of the object on the clients in the reputation system based on the reports received from the clients;   determining information about the clients from the reports received from the clients;   generating confidence metrics for the clients responsive to the determined information about the clients, the confidence metrics indicating amounts of confidence in the veracity of the reports received from the clients, wherein higher confidence metrics for the clients indicate that information in reports received from the clients is more likely to be true;   calculating a reputation score of the object responsive at least in part to the reports received from the clients, the prevalence of the object, and the confidence metrics for the clients, wherein a high prevalence of the object on the clients causes the object to receive a higher reputation score indicating that the object is unlikely to contain malicious software; and   storing the reputation score of the object.   
     
     
         2 . The method of  claim 1 , wherein a report from a client includes a request for the reputation score of the object and further comprising:
 providing the reputation score of the object to the client.   
     
     
         3 . The method of  claim 1 , wherein the high prevalence of the object on the clients indicates a likelihood that the object is legitimate. 
     
     
         4 . The method of  claim 1 , wherein the determined information about the clients includes a geographic location of a client in the reputation system, and wherein a confidence metric for the client is based at least in part on the geographic location of the client. 
     
     
         5 . The method of  claim 1 , wherein the determined information about the clients includes an expected frequency submission pattern for reports submitted by a client, and wherein a confidence metric for the client is based at least in part on whether a frequency of reports submitted by the client deviates from the expected submission pattern. 
     
     
         6 . The method of  claim 1 , wherein calculating the reputation score of the object comprises:
 using a confidence metric threshold to identify clients having low confidence metrics;   determining a ratio of clients having low confidence metrics that submitted reports identifying the object to all clients that submitted reports identifying the object; and   calculating the reputation score of the object responsive at least in part to the determined ratio.   
     
     
         7 . The method of  claim 1 , wherein calculating the reputation score of the object comprises:
 using a confidence metric threshold to identify clients having high confidence metrics;   determining a ratio of clients having high confidence metrics that submitted reports identifying the object to all clients that submitted reports identifying the object; and   calculating the reputation score of the object responsive at least in part to the determined ratio.   
     
     
         8 . The method of  claim 1 , wherein calculating the reputation score of the object comprises:
 using a statistical machine learning algorithm to calculate the reputation score of the object.   
     
     
         9 . A non-transitory computer-readable storage medium storing executable computer program instructions for determining a reputation of an object in a reputation system, the computer program instructions comprising instructions for:
 receiving reports from clients in the reputation system, the reports identifying an object detected at the clients;   determining a prevalence of the object on the clients in the reputation system based on the reports received from the clients;   determining information about the clients from the reports received from the clients;   generating confidence metrics for the clients responsive to the determined information about the clients, the confidence metrics indicating amounts of confidence in the veracity of the reports received from the clients, wherein higher confidence metrics for the clients indicate that information in reports received from the clients is more likely to be true;   calculating a reputation score of the object responsive at least in part to the reports received from the clients, the prevalence of the object, and the confidence metrics for the clients, wherein a high prevalence of the object on the clients causes the object to receive a higher reputation score indicating that the object is unlikely to contain malicious software; and   storing the reputation score of the object.   
     
     
         10 . The non-transitory computer-readable storage medium of  claim 9 , wherein a report from a client includes a request for the reputation score of the object and the computer program instructions further comprise:
 providing the reputation score of the object to the client.   
     
     
         11 . The non-transitory computer-readable storage medium of  claim 9 , wherein the high prevalence of the object on the clients indicates a likelihood that the object is legitimate. 
     
     
         12 . The non-transitory computer-readable storage medium of  claim 9 , wherein the determined information about the clients includes a geographic location of a client in the reputation system, and wherein a confidence metric for the client is based at least in part on the geographic location of the client. 
     
     
         13 . The non-transitory computer-readable storage medium of  claim 9 , wherein the determined information about the clients includes an expected frequency submission pattern for reports submitted by a client, and wherein a confidence metric for the client is based at least in part on whether a frequency of reports submitted by the client deviates from the expected submission pattern. 
     
     
         14 . The computer-readable storage medium of  claim 9 , wherein calculating the reputation score of the object comprises:
 using a confidence metric threshold to identify clients having low confidence metrics;   determining a ratio of clients having low confidence metrics that submitted reports identifying the object to all clients that submitted reports identifying the object; and   calculating the reputation score of the object responsive at least in part to the determined ratio.   
     
     
         15 . The computer-readable storage medium of  claim 9 , wherein calculating the reputation score of the object comprises:
 using a confidence metric threshold to identify clients having high confidence metrics;   determining a ratio of clients having high confidence metrics that submitted reports identifying the object to all clients that submitted reports identifying the object; and   calculating the reputation score of the object responsive at least in part to the determined ratio.   
     
     
         16 . A computer system for determining a reputation of an object in a reputation system, the computer system comprising:
 a non-transitory computer-readable storage medium storing executable computer program instructions, the computer program instructions comprising instructions for:   receiving reports from clients in the reputation system, the reports identifying an object detected at the clients;   determining a prevalence of the object on the clients in the reputation system based on the reports received from the clients;   determining information about the clients from the reports received from the clients;   generating confidence metrics for the clients responsive to the determined information about the clients, the confidence metrics indicating amounts of confidence in the veracity of the reports received from the clients, wherein higher confidence metrics for the clients indicate that information in reports received from the clients is more likely to be true;   calculating a reputation score of the object responsive at least in part to the reports received from the clients, the prevalence of the object, and the confidence metrics for the clients, wherein a high prevalence of the object on the clients causes the object to receive a higher reputation score indicating that the object is unlikely to contain malicious software; and   storing the reputation score of the object.   
     
     
         17 . The computer system of  claim 16 , wherein the determined information about the clients includes at least one of a geographic location of a client in the reputation system, and wherein a confidence metric for the client is based at least in part on the geographic location of the client. 
     
     
         18 . The computer system of  claim 16 , wherein the determined information about the clients includes an expected frequency submission pattern for reports submitted by a client, and wherein a confidence metric for the client is based at least in part on whether a frequency of reports submitted by the client deviates from the expected submission pattern. 
     
     
         19 . The computer system of  claim 16 , wherein calculating the reputation score of the object comprises:
 using a confidence metric threshold to identify clients having low confidence metrics;   determining a ratio of clients having low confidence metrics that submitted reports identifying the object to all clients that submitted reports identifying the object; and   calculating the reputation score of the object responsive at least in part to the determined ratio.   
     
     
         20 . The computer system of  claim 16 , wherein calculating the reputation score of the object comprises:
 using a confidence metric threshold to identify clients having high confidence metrics;   determining a ratio of clients having high confidence metrics that submitted reports identifying the object to all clients that submitted reports identifying the object; and   calculating the reputation score of the object responsive at least in part to the determined ratio.