Virus detection

• US 20030051168A1
• Filed: 08/09/2002
• Published: 03/13/2003
• Est. Priority Date: 08/10/2001
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Mayhead, Martin P., King, James E., Garnett, Paul J.
• Granted Patent: US 7,299,495 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 1/183 Internal mounting support structures, e.g. for printed circuit boards, internal connecting means for buses G06F13/409
• CPC Class Codes: G06F 1/187 Mounting of fixed and removable disk drives
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G11B 33/128 of the plurality of recording/reproducing devices, e.g. disk drives, onto a chassis
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H05K 7/1425 of standardised dimensions, e.g. 19"-subrack
• CPC Class Codes: H05K 7/1489 characterized by the mounting of blades therein, e.g. brackets, rails, trays H05K7/1491 takes precedence

Abstract

A server blade may comprise a processor and a network interface. The network interface can be configured to be connected to a network remote to the server blade. The server blade may be configured to detect a malicious code occurrence in traffic on the network. The server blade may be further configured as a field replaceable unit. Optionally, the server blade may further comprise an enclosure which encloses the processor.

Claims

1. A server blade comprising at least one processor and a network interface configured to be connected to a network remote to the server blade, the server blade being configured to detect a malicious code occurrence in traffic on the network, the server blade being further configured as a field replaceable unit.

2. The server blade of claim 1, comprising an enclosure which encloses the at least one processor.

3. The server blade of claim 1, configured to monitor traffic of the network.

4. The server blade of claim 3, configured to detect traffic of the network capable of transporting malicious code.

5. The server blade of claim 3, configured to analyse the traffic for malicious code.

6. The server blade of claim 1, configured to detect a malicious code occurrence by a comparison to known malicious code patterns.

7. The server blade of claim 1, configured to detect a malicious code occurrence by an analysis of code behaviour.

8. The server blade of claim 1, configured to monitor http traffic.

9. The server blade of claim 8, configured to monitor mobile code.

10. The server blade of claim 9, configured to monitor at least one of Java code, Javascript code, ActiveX code and VBScript code.

11. The server blade of claim 1, configured to monitor ftp traffic.

12. The server blade of claim 1, configured to monitor email traffic.

13. The server blade of claim 1, comprising a solid state memory configured to store operating software of the server blade.

14. The server blade of claim 1 configured as an appliance.

15. A server blade comprising processor means and network interface means for connecting to a network remote to the server blade, the server blade being configured for detecting a malicious code occurrence in traffic on the network, the server blade being further configured as a field replaceable unit.

16. A modular computer system comprising:

a carrier operable removably to receive a plurality of computer system modules therein;

a plurality of information processing modules removably received in the carrier, each module having a communications port operable to connect to a communications network internal to the carrier;

a switch operable to connect to the internal communications network to distribute information messages between the modules and to connect to an external communications network; and

a traffic inspection module removably received in the carrier and operable to connect to the internal communications network to receive an information message, to perform processing on the message to determine a safety status, and to forward the message toward a final destination via the internal communications network dependent upon the determined safety status.

17. The modular computer system of claim 17, wherein the traffic inspection module is configured to determine the safety status on the basis of comparing the message to a pattern of a known unsafe code formulation.

18. The modular computer system of claim 17, wherein the traffic inspection module is configured to determine the safety status on the basis of analysing the message for the presence of unsafe code instructions.

19. The modular computer system of claim 17, wherein upon determination of an unsafe safety status, the message is processed to remove a cause of the unsafe status.

20. The modular computer system of claim 17, wherein upon determination of an unsafe safety status, the message is deleted.

21. The modular computer system of claim 17, wherein an unsafe safety status is allocated in the event of detection of malicious code within the message.

22. A modular computer system comprising:

carrier means for removably receiving a plurality of computer system modules therein;

a plurality of information processing modules removably received in the carrier, each module having communications means for connecting to a communications network internal to the carrier means;

switch means for connecting to the internal communications network for distributing information messages between the modules and for connecting to an external communications network; and

a traffic inspection module removably received in the carrier means and for connecting to the internal communications network for receiving an information message, for performing processing on the message to determine a safety status, and for forwarding the message toward a final destination via the internal communications network dependent upon the determined safety status.