Systems and methods for updating content detection devices and systems

• US 20050204151A1
• Filed: 11/30/2004
• Published: 09/15/2005
• Est. Priority Date: 03/12/2004
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Xie, Michael, Fang, Yu
• Granted Patent: US 8,051,483 B2
• Time in Patent Office: Days
• US Class Current: 713/188
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of updating a content detection module includes obtaining content detection data, and transmitting the content detection data to a content detection module, wherein the transmitting is performed not in response to a request from the content detection module. A method of sending content detection data includes obtaining content detection data, selecting an update station from a plurality of update stations, and sending the content detection data to the selected update station. A method of building a content detection system includes establishing a first communication link between a central station and an update station, the central station configured to transmit content detection data to the update station, and establishing a second communication link between the update station and a content detection module.

Claims

1. A method of updating a content detection module, comprising:

obtaining content detection data; and

transmitting the content detection data to a content detection module;

wherein the transmitting is performed not in response to a request from the content detection module.

2. The method of claim 1, wherein the obtaining comprises analyzing content data to determine the content detection data.

3. The method of claim 1, wherein the content detection data comprises a virus signature, a spammer identification, or a URL.

4. The method of claim 1, wherein the content detection data comprises a time data indicating a time at which the content detection data is created.

5. The method of claim 1, wherein the content detection module is configured to detect network content based on the content detection data.

6. The method of claim 1, wherein the transmitting comprises sending the content detection data to an update station, and using the update station to transmit the content detection data to the content detection module.

7. The method of claim 1, wherein the transmitting comprises:

determining an update station for receiving the content detection data;

sending the content detection data to the update station; and

sending the content detection data from the update station to the content detection module.

8. A system for updating a content detection module, comprising:

means for obtaining content detection data; and

means for transmitting the content detection data to a content detection module;

wherein the means for transmitting is configured to perform the transmitting not in response to a request from the content detection module.

9. A computer-program product having a medium, the medium having a set of instructions readable by a processor, an execution of the instructions by the processor causes a process to be performed, the process comprising:

obtaining content detection data; and

transmitting the content detection data to a content detection module;

wherein the transmitting is performed not in response to a request from the content detection module.

10. A content detection system, comprising:

a station having a computer-readable medium for storing content detection data, the content detection data usable by a content detection module to detect content;

wherein the station is configured to transmit the content detection data not in response to a request by the content detection module.

11. The system of claim 10, wherein the station is a central station.

12. The system of claim 11, further comprising a first update station configured to receive the content detection data from the central station and send the content detection data to the content detection module.

13. The system of claim 12, further comprising a second update station configured to receive the content detection data from the central station.

14. The system of claim 13, wherein the first update station is configured to determine whether the second update station received the content detection data.

15. The system of claim 11, wherein the central station is configured to select an update station to which the central station transmits the content detection data.

16. The system of claim 10, wherein the station is an update station.

17. The system of claim 10, wherein the station is configured to transmit the content detection data in substantially real time.

18. The system of claim 10, wherein the station is selected from the group consisting of a computer, a server, a device, and a software.

19. The system of claim 10, wherein the content detection data comprises a virus signature, a spammer identification, or a URL.

20. A method of sending content detection data, comprising:

determining whether a first update station received the content detection data; and

sending the content detection data to the first update station if the first update station did not receive the content detection data.

21. The method of claim 20, wherein the determining is performed by a second update station in communication with the first update station.

22. The method of claim 20, wherein the determining comprises sending a query to the first update station, the query requesting for confirmation of receipt of the content detection data.

23. A system for sending content detection data, comprising:

means for determining whether a first update station received the content detection data; and

means for sending the content detection data to the first update station if the first update station did not receive the content detection data.

24. A computer-program product having a medium, the medium having a set of instructions readable by a processor, an execution of the instructions by the processor causes a process to be performed, the process comprising:

determining whether a first update station received the content detection data; and

sending the content detection data to the first update station if the first update station did not receive the content detection data.

25. A method of sending content detection data, comprising:

obtaining content detection data;

selecting an update station from a plurality of update stations; and

sending the content detection data to the selected update station.

26. The method of claim 25, wherein the selecting comprises:

determining a load on each of the plurality of update stations; and

choosing the update station that has the least load.

27. The method of claim 25, wherein the selecting comprises using an order list.

28. The method of claim 25, wherein the selecting is performed based at least on a geographical location of one of the plurality of update stations.

29. A system for sending content detection data, comprising:

means for obtaining content detection data;

means for selecting an update station from a plurality of update stations; and

means for sending the content detection data to the selected update station.

30. A computer-program product having a medium, the medium having a set of instructions readable by a processor, an execution of the instructions by the processor causes a process to be performed, the process comprising:

obtaining content detection data;

selecting an update station from a plurality of update stations; and

sending the content detection data to the selected update station.

31. A method of building a content detection system, comprising:

establishing a first communication link between a central station and an update station, the central station configured to transmit content detection data to the update station; and

establishing a second communication link between the update station and a content detection module.

32. The method of claim 31, wherein the central station is selected from the group consisting of a computer, a server, a device, and a software.

33. The method of claim 31, wherein the update station is selected from the group consisting of a computer, a server, a device, and a software.

34. The method of claim 31, wherein the content detection data comprises a virus signature, a spammer identification, or a URL.

35. The method of claim 31, wherein the content detection data comprises a time data indicating a time at which the content detection data is created.

36. The method of claim 31, wherein each of the steps of establishing comprises creating a network connection.

37. A system for building a content detection system, comprising:

means for establishing a first communication link between a central station and an update station, the central station configured to transmit content detection data to the update station; and

means for establishing a second communication link between the update station and a content detection module.

38. A computer-program product having a medium, the medium having a set of instructions readable by a processor, an execution of the instructions by the processor causes a process to be performed, the process comprising:

establishing a first communication link between a central station and an update station, the central station configured to transmit content detection data to the update station; and

establishing a second communication link between the update station and a content detection module.