Innoculation of computing devices against a selected computer virus

• US 20050050378A1
• Filed: 10/09/2003
• Published: 03/03/2005
• Est. Priority Date: 08/29/2003
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Liang, Yung Chang
• Granted Patent: US 7,287,278 B2
• Time in Patent Office: Days
• US Class Current: 714/4
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

In a distributed network having a number of server computers and associated client devices, method of creating an anti-computer virus agent is described. As a method, the innoculation is carried out by parsing a selected computer virus into a detection module that identifies a selected one of the client devices as a target client device, an infection module that causes the virus to infect those target client devices not infected by the selected virus, and a viral code payload module that infects the targeted client device modifying the infection module to infect those computers already infected by the selected virus; and incorporating innoculation viral code in the payload module that acts to prevent further infection by the selected virus.

Claims

1. In a distributed network having a number of server computers and associated client devices, method of creating an anti-computer virus agent, comprising:

parsing a selected computer virus into a detection module that identifies a selected one of the client devices as a target client device, an infection module that causes the virus to infect those target client devices not infected by the selected virus, and a viral code payload module that infects the targeted client device

modifying the infection module to infect those computers already infected by the selected virus; and

incorporating innoculation viral code in the payload module that acts to prevent further infection by the selected virus.

2. A method as recited in claim 1, further comprising:

incorporating repair viral code in the payload module that acts to repair any damage in the infected client device caused by the selected virus.

3. A method as recited in claim 2, comprising:

forming an anti-viral agent by combining the detection module, the modified infection module and the modified viral payload module.

4. In a distributed network having a number of server computers and associated client devices, computer program product for creating an anti-computer virus agent, comprising:

computer code for parsing a selected computer virus into a detection module that identifies a selected one of the client devices as a target client device, an infection module that causes the virus to infect those target client devices not infected by the selected virus, and a viral code payload module that infects the targeted client device

computer code for modifying the infection module to infect those computers already infected by the selected virus;

computer code for incorporating innoculation viral code in the payload module that acts to prevent further infection by the selected virus; and

computer readable medium for storing the code.

5. Computer program product as recited in claim 4, further comprising:

computer code for incorporating repair viral code in the payload module that acts to repair any damage in the infected client device caused by the selected virus.

6. Computer program product as recited in claim 5, comprising:

forming an anti-viral agent by combining the detection module, the modified infection module and the modified viral payload module. computer code for incorporating innoculation viral code in the payload module that acts to prevent further infection by the selected virus.