Server-based system, method, and computer program product for scanning data on a client using only a subset of the data

• US 10,419,525 B2
• Filed: 07/22/2014
• Issued: 09/17/2019
• Est. Priority Date: 10/14/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Pham, Khai N.
• Primary Examiner(s): Patel, Chirag R
• Application Number:
  US14/337,360
• Publication Number:
  US 20150019631A1
• Time in Patent Office: 1,883 Days
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A server-based system, method, and computer program product are provided for scanning data on a client using only a subset of the data. In operation, a request is received for a subset of data stored on a client that is required for determining whether the data is unwanted. Additionally, a representation of only the subset of data is sent from the client to a server over a network. Furthermore, a response is received from the server over the network. Still yet, there is a reaction based on the response.

Claims

1. A method, comprising:

sending a request for a subset of data, the request including a signature and information for a decomposition to isolate the subset of data;

receiving, at a server, a representation of the subset of data from a client, the receiving performed after the sending the request, the representation of the subset of data corresponding to the signature, the client being a mobile device; and

in response to an antivirus scanning of the representation of the subset of data, by the server, utilizing a plurality of signatures, sending from the server to the client a response including an uninfected file and an instruction to restart an application that involves the subset of data.

2. The method of claim 1, wherein the representation of the subset of data includes the subset of data.

3. The method of claim 1, wherein the representation of the subset of data includes a hash of the subset of data.

5. The method of claim 1, wherein the request defines identification information that identifies a hash of the subset of data, the representation including the hash.

6. The method of claim 1, wherein the mobile device is a mobile wireless communication device.

7. The method of claim 1, wherein the data contains evidence of malware, and the uninfected file cleanses or prevents the client from a further operation with the malware.

18. The method of claim 1, further comprising:

selecting the plurality of signatures, based on identification information, wherein the representation of the subset of data includes the identification information.

23. The method of claim 1, wherein the request is sent from the server to the client.

4. An apparatus, comprising:

logic, at least partially implemented in hardware, configured to send a request for a subset of data, and to receive a representation of the subset of data from a client, the request including a signature and information for a decomposition to isolate the subset of data, the representation received after the request is sent, the representation of the subset of data corresponding to the signature, wherein the client is a mobile device,

the logic further configured to perform an antivirus scan of the representation of the subset of data utilizing a plurality of signatures, and to send, in response to the antivirus scan, a response to the client, the response including an uninfected file and an instruction to restart an application that involves the subset of data.

8. The apparatus of claim 4, wherein the representation of the subset of data includes the subset of data.

9. The apparatus of claim 4, wherein the request defines identification information that identifies a hash of the subset of data, the representation including the hash.

10. The apparatus of claim 4, wherein the mobile device is a mobile wireless communication device.

11. The apparatus of claim 4, wherein the data contains evidence of malware, and the uninfected file cleanses or prevents the client from a further operation with the malware.

19. The apparatus of claim 4, wherein the logic is further configured to select the plurality of signatures, based on identification information, and the representation of the subset of data includes the identification information.

12. At least one non-transitory computer readable storage medium, comprising:

computer executable code to send a request from a server for a subset of data, the request including a signature and information for a decomposition to isolate the subset of data;

computer executable code to receive, at the server, a representation of the subset of data from a mobile client device, the representation of the subset of data corresponding to the signature, the representation received after the request is sent;

computer executable code to perform an antivirus scan of the representation of the subset of data utilizing a plurality of signatures; and

computer executable code to send, in response to the antivirus scan, a response from the server to the mobile client device, the response including an uninfected file and an instruction to restart an application that involves the subset of data.

13. The at least one computer readable storage medium of claim 12, wherein the request defines identification information that identifies a hash of the subset of data, the representation including the hash.

14. The at least one computer readable storage medium of claim 12, wherein the representation of the subset of data includes the subset of data.

15. The at least one computer readable storage medium of claim 12, wherein the mobile client device is a mobile wireless communication device.

16. The at least one computer readable storage medium of claim 12, wherein the representation includes a virus, spyware, or other malware.

17. The at least one computer readable storage medium of claim 12, wherein the data contains evidence of malware, and the uninfected file cleanses or prevents the mobile client device from a further operation with the malware.

20. The at least one computer readable storage medium of claim 12, further comprising:

computer executable code to select the plurality of signatures, based on identification information, wherein the representation of the subset of data includes the identification information.

21. The at least one computer readable storage medium of claim 12, wherein the uninfected file is configured to be automatically installed on the client.

22. The at least one computer readable storage medium of claim 12, further comprising:

computer executable code to send an enabling signal to the mobile client device, based on a finding that no malware is present in the representation.