Maintaining virus detection software

• US 20040083384A1
• Filed: 02/27/2003
• Published: 04/29/2004
• Est. Priority Date: 08/31/2000
• Status: Active Grant

• Current Assignee: Withsecure Corporation
• Original Assignee: F-Secure Oyj
• Inventors: Hypponen, Ari
• Granted Patent: US 7,266,845 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

A method of managing a virus signature database associated with an anti-virus application, both of which are resident in a memory of a mobile wireless device 2,4. Management messages containing for example new virus signatures are sent from the network 1 to the device 2,4. In accordance with instructions contained in the management messages, individual signature entries of the virus signature database are deleted or replaced, and new signatures added.

Claims

1. A method of managing a virus signature database associated with an anti-virus application, both of which are resident in a memory of a computer device, the method comprising adding, deleting, and replacing individual signature entries of the virus signature database to maintain the effectiveness of the database.

2. A method according to claim 1, wherein said computer device is a mobile wireless platform.

3. A method according to any one of the preceding claims and comprising receiving management messages over the wireless interface, the management messages containing respective add, delete, or replace virus signature instructions.

4. A method according to claim 3, wherein in the case of an add or replace signature instruction, the message is accompanied by a new signature.

5. A method according to any one of the preceding claims, wherein management messages are accompanied by respective sequence numbers and the anti-virus application, or a management agent, resident in the memory of the wireless device uses the sequence number of a received management message to determine whether or not one or more preceding management messages have not been received.

6. A method according to claim 5, wherein, if it is determined that a management message has not been received, the application or agent requests that message via the wireless interface.

7. A method according to any one of the preceding claims and comprising filtering management messages either at the origin side of the wireless interface, prior to transmission over the wireless interface, or following receipt at a mobile device, to allow only messages relevant to a particular device or software installed on that device to be sent to that device or to be acted upon at the device.

8. A method according to any one of the preceding claims, wherein said mobile wireless device is a cellular communication device having an interface for allowing the device to communicate with a cellular telecommunications network.

9. A computer device having a memory and an anti-virus software application resident in the memory, the memory also containing an anti-virus signature database accessible in use by the anti-virus application, the apparatus comprising processing means for adding, deleting, and/or replacing individual signature entries of the virus signature database.

10. A device according to claim 9, wherein the computer device is a mobile wireless device.

11. A method of managing a virus signature database associated with an anti-virus application, both of which are resident in a memory of a mobile wireless device, the method comprising receiving management messages, relating to database or anti-virus application changes, at the device, the management messages being filtered either at the origin side of the wireless interface or at the mobile device to pass only messages relevant to the recipient device.

12. A method according to claim 11, wherein the filter at the mobile device or at the origin side of the wireless interface has a knowledge of the properties of the mobile device and/or of the software applications resident on the mobile device.

13. A method according to claim 11 or 12, wherein the filter exists at the origin side of the wireless interface, and properties of the mobile device and/or of the software applications resident on the mobile device are sent to the filter from the mobile device.

14. A method according to any one of claims 11 to 13, wherein the management messages contain the identity of mobile devices and/or applications to which they are relevant, such that the filter may compare the applicability of messages to the properties/resident software of destination mobile devices.

15. A method of scanning information for the presence of a virus, the method comprising extracting predetermined virus signatures from a virus signature database and sequentially searching for the presence of signatures in the information, wherein the database contains for each of one or more viruses a plurality of signatures, and indicating the presence or absence of each of said one or more viruses based on a combination of the results of the plurality of searches.