Computer security system

• US 20050022014A1
• Filed: 11/06/2002
• Published: 01/27/2005
• Est. Priority Date: 11/21/2001
• Status: Active Grant

• Current Assignee: British Telecommunications PLC (BT Group PLC)
• Original Assignee: British Telecommunications PLC (BT Group PLC)
• Inventors: Shipman, Robert A
• Granted Patent: US 7,774,845 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A computer security system for use in a network environment comprising at least a plurality of user computers arranged to communicate over a network, the system comprising a warning message exchange system operable to allow the communication from the user computers of warning messages relating to suspect data identified as a possible security threat; a message counting system operable to maintain a count for every particular piece or set of suspect data based on the number of warning messages communicated relating thereto; and network security means operable to act against any particular piece or set of suspect data for which the count maintained therefor exceeds at least one threshold value

Claims

1. A computer security system for use in a network environment comprising at least a first group of user computers arranged to communicate over a network, the system comprising a warning message exchange system operable to allow the communication from the user computers of warning messages relating to suspect data identified as a possible security threat;

a message counting system operable to maintain a count for every particular piece or set of suspect data based on the number of warning messages communicated relating thereto; and

network security means operable to act in respect of any particular piece or set of suspect data for which the count maintained therefor is substantially equal to or greater than at least one threshold value.

2. A computer security system according to claim 1, wherein the judgement as to whether any piece or set of data present at any one or more of the user computers is a possible threat is performed by the respective human user or users of the or each user computer.

3. A computer security system according to claim 1, wherein the network security means is further operable to compare the maintained count for a particular piece or set of suspect data against a plurality of different thresholds, and to take different action in respect of the data dependent upon which threshold or thresholds are met.

4. A computer security system according to claim 1, wherein the action taken by the network security means comprises warning each of the users as to the suspect nature of a particular piece or set of data.

5. A computer security system according to claim 1, wherein the action taken by the network security means comprises preventing the transmission of the particular piece or set of suspect data across the network.

6. A computer security system according to claim 1, wherein the or each warning message comprises at least an identifier of the piece of or set of suspect data to which it relates.

7. A computer security system according to claim 6, wherein the identifier is the piece or set of suspect data itself.

8. A computer security system according to claim 6, wherein the identifier is a repeatably generatable signature substantially unique to the piece or set of data.

9. A computer security system according to claim 1, and further comprising a network server arranged to receive the or each warning message communicated from the user computers, and further arranged to host the message counting system and at least part of the network security system, wherein that part of the network security system hosted by the server is operable to determine the action which should be taken against a particular piece or set of suspect data, and to communicate an action condition indicator indicative of the determined action to each of the plurality of users.

10. A computer security system according to claim 1, wherein a warning message generated by a user computer is broadcast to every other user computer, and each user computer is further arranged to host its own message counting system and network security system operable in accordance with any of the preceding claims.

11. A computer security system according to claim 1, and further comprising an inter-group communications system operable to allow the communication of warning messages relating to suspect data identified as a possible security threat from the first group of user computers to one or more other groups of other user computers.

12. A computer security system according to claim 11, wherein the inter group warning messages are transmitted by the inter-group communications system if the number of warning messages communicated by the user computers in the first group concerning a particular piece or set of data is substantially equal to or greater than at least one threshold value.

13. A computer security system according to claim 12, wherein the threshold value or values is/are the same as those at which the network security system takes action.

14. A computer security system according to claim 11, wherein the inter-group communications system is further arranged to receive inter-group warning messages from the one or more other groups of user computers.

15. A computer security system according to claim 14, and further comprising a second message counting system operable to maintain a count for every particular piece or set of suspect data based on the number of inter-group warning messages communicated relating thereto;

and wherein the network security means is further operable to act against any particular piece or set of suspect data for which the count maintained therefor by the second message counting system is substantially equal to or greater than at least one inter-group threshold value.

16. A computer security system according to claim 15, wherein the network security means is further arranged to act against a particular piece or set of suspect data only if both the respective counts maintained by the message counting system and the second message counting system are substantially equal to or greater than at least the threshold value and the inter-group threshold value respectively.

17. A computer security system according to claim 1, wherein the message counting system is further arranged to store one or more weighting coefficients relating to one or more particular user computers, and to increment the count maintained for a particular piece or set of suspect data by an amount based upon the weighting coefficient when a warning is received from the one or more particular user computers relating to the particular piece or set of suspect data.

18. A computer readable storage medium storing one or more computer programs which when run on a computer causes the computer to operate in the manner of a system according to claim 1.