Method and system for protecting against computer viruses

• US 20050177868A1
• Filed: 07/09/2004
• Published: 08/11/2005
• Est. Priority Date: 07/11/2003
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Kwan, Tony
• Granted Patent: US 7,424,609 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for delivering an update to at least one user, including creating an electronic communication including an update and a unique signature identifying, the electronic communication as including the update and sending the electronic communication to the user.

Claims

1. A method for delivering an update to at least one user, comprising:

creating an electronic communication comprising an update and a unique signature identifying said electronic communication as including said update; and

sending said electronic communication to said at least one user.

2. The method of claim 1, wherein said electronic communication is an email.

3. The method of claim 1, wherein said electronic communication is an instant message.

4. The method of claim 1, wherein said update includes one or more virus signatures.

5. The method of claim 1, wherein said update includes one or more heuristics.

6. The method of claim 1, wherein said update includes a program update.

7. A method for receiving an update, comprising:

receiving an electronic communication;

identifying whether said electronic communication includes an update; and

applying said update when said electronic communication has been identified as including an update.

8. The method of claim 7, wherein said electronic communication is an email.

9. The method of claim 7, wherein said electronic communication is an instant message.

10. The method of claim 7, wherein said update includes one or more virus signatures.

11. The method of claim 7, wherein said update includes one or more heuristics.

12. The method of claim 7, wherein said update includes a program update.

13. A method for delivering an update to at least one user, comprising:

creating an electronic communication comprising an alert message; and

sending said electronic communication comprising said alert message to said at least one user.

14. The method of claim 13, wherein said alert message includes a link to an update.

15. The method of claim 14, wherein said update includes one or more virus signatures.

16. The method of claim 14, wherein said update includes one or more heuristics.

17. The method of claim 14, wherein said update includes a program update.

18. The method of claim 13, wherein said alert message includes instructions for obtaining an update.

19. The method of claim 18, wherein said update includes one or more virus signatures.

20. The method of claim 18, wherein said update includes one or more heuristics.

21. The method of claim 18, wherein said update includes a program update.

22. The method of claim 13, wherein said electronic communication additionally comprises a unique signature identifying said electronic communication as including said alert message.

23. The method of claim 13, wherein said electronic communication is an email.

24. The method of claim 13, wherein said electronic communication is an instant message.

25. A method for receiving an update, comprising:

receiving an electronic communication;

identifying whether said electronic communication includes an alert message; and

displaying said alert message.

26. The method of claim 25, wherein said alert message includes a link to an update.

27. The method of claim 26, wherein said update includes one or more virus signatures.

28. The method of claim 26, wherein said update includes one or more heuristics.

29. The method of claim 26, wherein said update includes a program update.

30. The method of claim 25, wherein said alert message includes instructions for obtaining an update.

31. The method of claim 30, wherein said update includes one or more virus signatures.

32. The method of claim 30, wherein said update includes one or more heuristics.

33. The method of claim 30, wherein said update includes a program update.

34. The method of claim 25, wherein said electronic communication additionally comprises a unique signature identifying said electronic communication as including said alert message.

35. The method of claim 25, wherein said electronic communication is an email.

36. The method of claim 25, wherein said electronic communication is an instant message.

37. A method for delivering a sample, comprising:

performing a heuristic virus scan on a sample;

creating an electronic communication comprising said sample when said sample is found to have at least a low risk of being infected by a malicious program; and

sending said electronic communication to a provider.

38. The method of claim 37, wherein said electronic communication is an email.

39. The method of claim 37, wherein said electronic communication is an instant message.

40. A system for delivering an update to at least one user, comprising:

a creating unit for creating an electronic communication comprising an update and a unique signature identifying said electronic communication as including said update; and

a sending unit for sending said electronic communication to said at least one user.

41. The system of claim 40, wherein said electronic communication is an email.

42. The system of claim 40, wherein said electronic communication is an instant message.

43. The system of claim 40, wherein said update includes one or more virus signatures.

44. The system of claim 40, wherein said update includes one or more heuristics.

45. The system of claim 40, wherein said update includes a program update.

46. A system for receiving an update, comprising:

a receiving unit for receiving an electronic communication;

an identifying unit for identifying whether said electronic communication includes an update; and

an applying unit for applying said update when said electronic communication has been identified as including an update.

47. The system of claim 46, wherein said electronic communication is an email.

48. The system of claim 46, wherein said electronic communication is an instant message.

49. The system of claim 46, wherein said update includes one or more virus signatures.

50. The system of claim 46, wherein said update includes one or more heuristics.

51. The system of claim 46, wherein said update includes a program update.

52. A system for delivering an update to at least one user, comprising:

a creating unit for creating an electronic communication comprising an alert message; and

a sending unit for sending said electronic communication comprising said alert message to said at least one user.

53. The system of claim 52, wherein said alert message includes a link to an update.

54. The system of claim 53, wherein said update includes one or more virus signatures.

55. The system of claim 53, wherein said update includes one or more heuristics.

56. The system of claim 53, wherein said update includes a program update.

57. The system of claim 52, wherein said alert message includes instructions for obtaining an update.

58. The system of claim 57, wherein said update includes one or more virus signatures.

59. The system of claim 57, wherein said update includes one or more heuristics.

60. The system of claim 57, wherein said update includes a program update.

61. The system of claim 52, wherein said electronic communication additionally comprises a unique signature identifying said electronic communication as including said alert message.

62. The system of claim 52, wherein said electronic communication is an email.

63. The system of claim 52, wherein said electronic communication is an instant message.

64. A system for receiving an update comprising:

a receiving unit for receiving an electronic communication;

an identifying unit for identifying whether said electronic communication includes an alert message; and

a displaying unit for displaying said alert message.

65. The system of claim 64, wherein said alert message includes a link to an update.

66. The system of claim 65, wherein said update includes one or more virus signatures.

67. The system of claim 65, wherein said update includes one or more heuristics.

68. The system of claim 65, wherein said update includes a program update.

69. The system of claim 64, wherein said alert message includes instructions for obtaining an update.

70. The system of claim 69, wherein said update includes one or more virus signatures.

71. The system of claim 69, wherein said update includes one or more heuristics.

72. The system of claim 69, wherein said update includes a program update.

73. The system of claim 64, wherein said electronic communication additionally comprises a unique signature identifying said electronic communication as including said alert message.

74. The system of claim 64, wherein said electronic communication is an email.

75. The system of claim 64, wherein said electronic communication is an instant message.

76. A system for delivering a sample, comprising:

a performing unit for performing a heuristic virus scan on a sample;

a creating unit for creating an electronic communication comprising said sample when said sample is found to have at least a low risk of being infected by a malicious program; and

a sending unit for sending said electronic communication to a provider.

77. The system of claim 76, wherein said electronic communication is an email.

78. The system of claim 76, wherein said electronic communication is an instant message.

79. A computer system comprising:

a processor; and

a program storage device readable by the computer system, embodying a program of instructions executable by the processor to perform method steps for delivering an update to at least one user, the method comprising the following steps;

creating an electronic communication comprising an update and a unique signature identifying said electronic communication as including said update; and

sending said electronic communication to said at least one user.

80. The computer system of claim 79, wherein said electronic communication is an email.

81. The computer system of claim 79, wherein said electronic communication is an instant message.

82. The computer system of claim 79, wherein said update includes one or more virus signatures.

83. The computer system of claim 79, wherein said update includes one or more heuristics.

84. The computer system of claim 79, wherein said update includes a program update.

85. A computer system comprising:

a processor; and

a program storage device readable by the computer system, embodying a program of instructions executable by the processor to perform method steps for receiving an update, the method comprising the following steps;

receiving an electronic communication;

identifying whether said electronic communication includes an update; and

applying said update when said electronic communication has been identified as including an update.

86. The computer system of claim 85, wherein said electronic communication is an email.

87. The computer system of claim 85, wherein said electronic communication is an instant message.

88. The computer system of claim 85, wherein said update includes one or more virus signatures.

89. The computer system of claim 85, wherein said update includes one or more heuristics.

90. The computer system of claim 85, wherein said update includes a program update.

91. A computer system comprising:

a processor; and

a program storage device readable by the computer system, embodying a program of instructions executable by the processor to perform method steps for delivering an update to at least one user, the method comprising the following steps;

creating an electronic communication comprising an alert message; and

sending said electronic communication comprising said alert message to said at least one user.

92. The computer system of claim 91, wherein said alert message includes a link to an update.

93. The computer system of claim 92, wherein said update includes one or more virus signatures.

94. The computer system of claim 92, wherein said update includes one or more heuristics.

95. The computer system of claim 92, wherein said update includes a program update.

96. The computer system of claim 91, wherein said alert message includes instructions for obtaining an update.

97. The computer system of claim 96, wherein said update includes one or more virus signatures.

98. The computer system of claim 96, wherein said update includes one or more heuristics.

99. The computer system of claim 96, wherein said update includes a program update.

100. The computer system of claim 91, wherein said electronic communication additionally comprises a unique signature identifying said electronic communication as including said alert message.

101. The computer system of claim 91, wherein said electronic communication is an email.

102. The computer system of claim 91, wherein said electronic communication is an instant message.

103. A computer system comprising:

a processor; and

a program storage device readable by the computer system embodying a program of instructions executable by the processor to perform method steps for receiving an update, the method comprising the following steps;

receiving an electronic communication;

identifying whether said electronic communication, includes an alert message; and

displaying said alert message.

104. The computer system of claim 103, wherein said alert message includes a link to an update.

105. The computer system of claim 104, wherein said update includes one or more virus signatures.

106. The computer system of claim 104, wherein said update includes one or more heuristics.

107. The computer system of claim 104, wherein said update includes a program update.

108. The computer system of claim 103, wherein said alert message includes instructions for obtaining an update.

109. The computer system of claim 108, wherein said update includes one or more virus signatures.

110. The computer system of claim 108, wherein said update includes one or more heuristics.

111. The computer system of claim 108, wherein said update includes a program update.

112. The computer system of claim 103, wherein said electronic communication additionally comprises a unique signature identifying said electronic communication as including said alert message.

113. The computer system of claim 103, wherein said electronic communication is an email.

114. The computer system of claim 103, wherein said electronic communication is an instant message.

115. A computer system comprising:

a processor; and

a program storage device readable by the computer system, embodying a program of instructions executable by the processor to perform method steps for delivering a sample, the method comprising the following steps;

performing a heuristic virus scan on a sample;

creating an electronic communication comprising said sample when said sample is found to have at least a low risk of being infected by a malicious program; and

sending said electronic communication to a provider.

116. The computer system of claim 115, wherein said electronic communication is an email.

117. The computer system of claim 115, wherein said electronic communication is an instant message.