Virus detection in a network

• US 20060005244A1
• Filed: 06/10/2004
• Published: 01/05/2006
• Est. Priority Date: 06/10/2004
• Status: Active Grant

• Current Assignee: Finjan Blue, Inc. (SoftBank Group Corp.)
• Original Assignee: International Business Machines Corporation
• Inventors: Garbow, Zachary Adam, Gordon, Michael David, Sanomi-Fleming, Emuejevoke Jane-Frances, Hamlin, Robert Hart, McDaniel, Clayton Lee, Marshall, William Russell
• Granted Patent: US 7,490,354 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A method, apparatus, system, and signal-bearing medium that in an embodiment count the number of times that a file or registry entry is added, changed, or deleted at clients in a network. If the count exceeds a threshold, then a warning is sent to the clients. The warning may prompt the clients to delete or rename the file or registry entry, run an anti-virus program, quarantine the file or registry entry, or issue a message. In this way, viruses may be detected at clients.

Claims

1. A method comprising:

determining a count of a number of times that a file is added to a plurality of clients in a network; and

deciding whether the file includes a suspected virus if the count exceeds a threshold.

2. The method of claim 1, further comprising:

if the deciding is true, sending a warning to the plurality of clients.

3. The method of claim 2, wherein the warning comprises an instruction to perform an operation, wherein the operation is selected from a group consisting of:

deleting the file, renaming the file, executing an anti-virus program, quarantining the file, and displaying a message.

4. The method of claim 1, wherein the threshold is selected based on whether the file is trusted.

5. An apparatus comprising:

means for determining a count of a number of times that a registry entry is added to a plurality of clients in a network; and

means for deciding whether the registry entry references a suspected virus based on whether the count exceeds a threshold.

6. The apparatus of claim 5, further comprising:

means for sending a warning to the plurality of clients if the means for deciding is true.

7. The apparatus of claim 6, wherein the warning comprises an instruction to perform an operation, wherein the operation is selected from a group consisting of:

deleting the registry entry, renaming the registry entry, executing an anti-virus program, and displaying a message.

8. The apparatus of claim 5, wherein the threshold is selected based on whether an entity that adds the registry entry is trusted.

9. A signal-bearing medium encoded with instructions, wherein the instructions when executed comprise:

determining a count of a number of times that an attribute of a file is changed in a plurality of clients in a network; and

deciding whether the file includes a suspected virus based on the count.

10. The signal-bearing medium of claim 9, further comprising:

if the deciding is true, sending a warning to the plurality of clients.

11. The signal-bearing medium of claim 10, wherein the warning comprises an instruction to perform an operation, wherein the operation is selected from a group consisting of:

deleting the file, renaming the file, executing an anti-virus program, quarantining the file, and displaying a message.

12. The signal-bearing medium of claim 9, wherein the deciding further comprises:

selecting a threshold to compare to the count based on whether the file is trusted to be free of the suspected virus.

13. The signal-bearing medium of claim 9, wherein the attribute comprises a size of the file.

14. The signal-bearing medium of claim 9, wherein the attribute comprises a certificate of authenticity.

15. The signal-bearing medium of claim 9, wherein the attribute comprises an extension of the file.

16. A computer system comprising:

a processor; and

memory encoded with instructions, wherein the instructions when executed on the processor comprise;

determining a count of a number of times that a registry entry is changed in a plurality of clients in a network, and

deciding whether to send a warning to the plurality of clients based on whether the count is greater than a threshold, wherein the threshold is selected based on whether an entity that changes the registry entry is trusted to be virus free.

17. The computer system of claim 16, wherein the warning comprises an instruction to delete the registry entry.

18. The computer system of claim 16, wherein the warning comprises an instruction to execute an anti-virus program.

19. The computer system of claim 16, wherein the warning comprises an instruction to display a message.

20. The computer system of claim 16, wherein the threshold is higher for entities that are trusted than for entities that are not trusted.