How file reputation is calculated?

[onedayoneapple]

Hi Heroes,

Can you help provide more details for the below questions, thanks in advance!

1. File reputation is calculated by ENS ATP, TIE just stores the file reputation (also query GTI to get the reputation and deliver it via DXL ), is it correct?

2. If 1 is correct, may I know how exactly the file reputation is calculated by ATP? it's not done by just doing some kind of hash value calculating right? perhaps it maybe hard to explain the exact details, but I wish I can get more details here. thanks.

[Former Member · Accepted solution]

Hello @onedayoneapple 

Thanks for your post!

1. Correct.

2.Please check the below link:
https://docs.mcafee.com/bundle/endpoint-security-10.6.0-adaptive-threat-protection-client-product-gu...

https://docs.mcafee.com/bundle/threat-intelligence-exchange-2.3.0-product-guide/page/GUID-A6A8C8F4-7...

You can also check the below community post to check more details:

https://community.mcafee.com/t5/Threat-Intelligence-Exchange-TIE/Trying-to-understand-TIE-2-0-reputa...

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[LKS · Accepted solution]

The Reputation calculation is really a Math and it is very difficult to explain. ATP has it own calculation methodology to determine the file reputation. In general, a suspicious file is any program executable, Portable Document Format (PDF), or Android Application Package (.APK) file that has characteristics common to malicious files. 

Certain identifiers inside the executable to determine whether the program has particular characteristics normally associated with malware. 

ATP does the 5 level of scans before it classify a reputation. Pre.execution and Post execution

Pre Execution scan :

* OAS 
* JTI (rule based) BAL,Sec,PRod
* RP (real protect)

Post Execution scan :

* DAC (it creates a small container within the client machine to analyze the file)

* RP cloud (rp.gti.mcafee.com)

You can post your query in ENS forum, they may explain you in better about the process.

https://community.mcafee.com/t5/Endpoint-Security-ENS/bd-p/endpoint-security

Was my reply helpful?

If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a Solution" if this reply resolves your query!