Apparatus and methods for intercepting, examining and controlling code, data and files and their transfer

• US 20010042214A1
• Filed: 03/06/2001
• Published: 11/15/2001
• Est. Priority Date: 02/03/1999
• Status: Active Grant

• Current Assignee: Cybersoft, Inc.
• Original Assignee: Cybersoft, Inc.
• Inventors: Radatti, Peter V., Eliseo, Timothy R.
• Granted Patent: US 7,389,540 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The present invention comprises apparatus and methods for processing code, that is, for intercepting, examining and/or controlling code streams in a network. A protocol parser is implemented in order to intercept the code as it passes through the channel and transfer the code to a proscribed code scanner. Embodiments for various platforms, including Unix® and Windows® NT are disclosed.

Claims

1. An apparatus for intercepting and processing code on a communications channel comprising:

a protocol parser; and

,

a proscribed code scanner;

whereby said protocol parser intercepts said code traveling on said channel and transmits said code for review by said proscribed code scanner.

2. An apparatus as in

claim 1

further comprising a protocol scanner, whereby said protocol parser transmits said code to said proscribed code scanner through said protocol scanner.

3. An apparatus as in

claim 2

whereby said proscribed code scanner further comprises a scanning means and an indicator means, whereby said indicator means provides an indication of the presence of proscribed code after scanning said intercepted code.

4. An apparatus as in

claim 3

, whereby said proscribed code scanner comprises a virus scanner.

5. An apparatus as in

claim 1

, wherein said protocol parser further comprises a configuration means for configuring interception parameters.

6. An apparatus as in

claim 2

, wherein said protocol scanner further comprises a configuration means for configuring interception parameters.

7. An apparatus for intercepting and processing code on a communications channel comprising:

a protocol parser;

a protocol scanner; and

,

a proscribed code scanner comprised of a scanning means and an indicator means;

whereby said protocol parser transmits said code to said proscribed code scanner through said protocol scanner, and whereby said indicator means provides an indication of the presence of proscribed code after scanning said intercepted code.

8. A method for processing code on a communications channel comprising:

intercepting said code;

scanning said code for the presence of proscribed code; and

,

providing an indicator for the presence of said proscribed code.

9. A method as in

claim 8

further comprising the step of:

returning said code to said communication channel if said indicator is negative.

10. A method as in

claim 8

further comprising the step of:

further indicating the presence of said proscribed code if said indicator is positive.

11. A method as in

claim 8

wherein the step of intercepting said code further comprises intercepting the code according to configured parameters.

12. A method as in

claim 8

further comprising the step of providing a separate system inserted in said communications channel, and with at least one of said steps of intercepting said code;

decrypting said code;

scanning said code for the presence of proscribed code, and providing an indicator for the presence of said proscribed code, occurring on said separate machine.

13. A method as in

claim 8

wherein the step of scanning said code for the presence of proscribed code further comprises scanning said code for the presence of viruses.