Method for speeding up the pass time of an executable through a checkpoint

• US 20050149720A1
• Filed: 01/07/2004
• Published: 07/07/2005
• Est. Priority Date: 01/07/2004
• Status: Abandoned Application

• Current Assignee: Aladdin Knowledge Systems Limited (Thales SA)
• Original Assignee: Aladdin Knowledge Systems Limited (Thales SA)
• Inventors: Gruper, Shimon, Margalit, Yanki, Margalit, Dany
• Application Number:
  US10/751,986
• Publication Number:
  US 20050149720A1
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A method for speeding up the pass time of an executable (an HTML file, a script file, a web page, an EXE file, an email message, and so forth) through a checkpoint (e.g. a gateway) in which the integrity of said executable is being tested, said method comprising: receiving and accumulating the parts of said executable that reach to said checkpoint; testing the integrity of the accumulated parts; releasing and sending the accumulated parts that have been indicated as harmless to their destination in an accelerated manner; releasing and sending the accumulated parts that have not been indicated as harmless or malicious to their destination in a moderate manner; and upon indicating the maliciousness of said accumulated parts, performing an alert procedure. According to a preferred embodiment of the invention, receiving and/or sending data is carried out at the lower levels of the OSI model, especially at the Network level.

Claims

1. A method for speeding up the pass time of an executable through a checkpoint in which the integrity of said executable is being tested, said method comprising:

receiving and accumulating at least one part of said executable that reaches to said checkpoint;

testing the integrity of said at least one part of said executable;

releasing at least one accumulated part whose integrity has been verified to its destination in an accelerated manner;

releasing and sending at least one accumulated part to its destination in a moderate manner; and

upon indicating the non-integrity of said at least one part, performing an alert procedure.

2. A method according to claim 1, wherein said moderate manner is carried out by operations selected from the group consisting of:

dividing packets to be sent to smaller packets thereby increasing the overhead of sending said packets, inserting a delay between two consecutive send operations, sending the data to be sent periodically instead of immediately, and sending dummy commands.

3. A method according to claim 1, wherein said accelerated manner is carried out by operations selected from the group consisting of:

combining a plurality of data packets to one packet thereby decreasing the overhead of sending said packets, and sending the available data once said data has been indicated as harmless.

4. A method according to claim 1, wherein said alert procedure is selected from the group consisting of:

aborting sending said executable to said destination, alerting the operator of the server of said checkpoint, alerting said destination, and alerting said source.

5. A method according to claim 1, wherein said at least one part includes a data packet.

6. A method according to claim 1, wherein said receiving is carried out in at least one lower level of the OSI model.

7. A method according to claim 8, wherein said at least one lower level is the Network layer of the OSI model.

8. A method according to claim 1, wherein said sending is carried out in at least one lower level of the OSI model.

9. A method according to claim 10, wherein said at least one lower level is the Network layer of the OSI model.