DISTRIBUTED COMPUTER VIRUS DETECTION AND SCANNING

• US 20030191957A1
• Filed: 02/19/1999
• Published: 10/09/2003
• Est. Priority Date: 02/19/1999
• Status: Abandoned Application

• Current Assignee: F-Secure Oyj
• Original Assignee: F-Secure Oyj
• Inventors: HYPPONEN, MIKKO, HYPPONEN, ARI, LEHTONEN, TEEMU SAMULI
• Application Number:
  US09/252,967
• Publication Number:
  US 20030191957A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/561 Virus type analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of detecting viruses in a computer network 1 comprising intercepting data at at least one data transit node 4 of the network 1. The transit node 4 identifies which of the data is of a type capable of containing a virus and transfers the identified data to a virus scanning server 7 over the network 1. The identified data is received at the virus scanning server 7 which scans the data to identify viruses present therein. The server 7 subsequently acts in dependence upon the outcome of the virus scan.

Claims

1. A method of detecting viruses in a computer network, the method comprising:

intercepting data at at least one data transit node of the network;

identifying at the transit node which of the data is of a type capable of containing a virus;

transferring the identified data to a virus scanning server over the network; and

receiving the identified data at the virus scanning server and scanning the data to identify viruses present therein.

2. A method according to claim 1, wherein the transit node is a gateway coupling the network to an external system or network.

3. A method according to claim 1, wherein the transit node is one of a database server, an electronic mail server, an Internet server, a proxy server, and a firewall.

4. A method according to claim 1 and comprising performing said steps of intercepting, identifying, and transferring at each of a plurality of transit nodes, the transferred data being received by at least one common virus scanning server.

5. A method according to claim 4, wherein each transit node comprises a discrete computer system.

6. A method according to claim 1 and comprising returning the transferred data to the originating transit node from the virus scanning server in the event that no viruses are identified therein.

7. A method according to claim 1 and comprising returning a message to the originating transit node from the virus scanning server to indicate the result of the virus scan.

8. A method according to claim 1, wherein, in the event that a virus is identified in the data, the virus scanning server:

issues a virus alert message to the network administrator and/or to the intended destination for the data either directly or via the originating transit node; and

/or

stores the infected data in an associated memory; and

/or

attempts to disinfect the infected data in which case, if the disinfection is successful, the disinfected data is returned to the originating transit node and, if unsuccessful, the data is disregarded or stored in the associated memory.

9. A method according to claim 1, wherein the virus scanning server is one of a plurality of virus scanning servers of the computer network.

10. Apparatus for detecting viruses in a computer network, the apparatus comprising:

a first computer providing a transit node for data being transferred within the network or destined for the network, the computer having means for intercepting said data and for identifying data which is of a type capable of containing a virus; and

a second computer coupled to said network and having processing means for scanning data for viruses,

the first computer additionally having means for transferring any identified data to the second computer over said network for virus scanning.

11. Apparatus according to claim 10 and comprising a plurality of said first computers coupled to said data network and one second computer for scanning data for viruses.

12. A computer memory encoded with executable instructions representing a computer program for causing a computer connected to a data network to:

receive data over the data network from a transit node, said data having been intercepted by the transit node and identified thereat as being of a type capable of containing a virus; and

scan the received data to identify viruses present therein.