Efficient distribution of a malware countermeasure

• US 20070255723A1
• Filed: 07/14/2006
• Published: 11/01/2007
• Est. Priority Date: 04/27/2006
• Status: Active Grant

• Current Assignee: The Invention Science Fund I, L.L.C. (Intellectual Ventures LLC)
• Original Assignee: Searete LLC (Intellectual Ventures LLC)
• Inventors: Mangione-Smith, William Henry, Lord, Robert W., Jung, Edward K.Y., Levien, Royce A., Malamud, Mark A.
• Granted Patent: US 8,539,581 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Embodiments include a system, an apparatus, a device, computer-program product, and a method. An embodiment provides a network device. The network device includes an information store operable to save a countermeasure useable in at least substantially reducing a harm caused by a malware (hereafter the “malware countermeasure”). The network device also includes a transmission circuit for sending a packet to at least one node of a plurality of networked nodes. The network device further includes a protection circuit for implementing the malware countermeasure in the network device.

Claims

1. A network device:

a transmission circuit for communicating a packet to at least one node of a plurality of networked nodes;

a decision circuit for determining if a criterion is met for distribution of a countermeasure to at least one node of the plurality of networked nodes, the countermeasure useable in at least substantially reducing a harm caused by malware (hereafter a “

malware countermeasure”

); and

a distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure using a distribution schema to a first set of nodes of the plurality of networked nodes.

2. The network device of claim 1, wherein the transmission circuit for communicating a packet to at least one node of a plurality of networked nodes further includes:

a transmission circuit for receiving and forwarding a packet to at least one node of a plurality of networked nodes.

3. The network device of claim 1, wherein the transmission circuit for communicating a packet to at least one node of a plurality of networked nodes further includes:

a dedicated transmission circuit for receiving and forwarding only the malware countermeasure to at least one node of a plurality of networked nodes.

4. The network device of claim 1, wherein the transmission circuit for communicating a packet to at least one node of a plurality of networked nodes further includes:

a transmission circuit for communicating a packet to at least one node of a plurality of networked nodes over a primary path.

5. The network device of claim 1, wherein the transmission circuit for communicating a packet to at least one node of a plurality of networked nodes further includes:

a transmission circuit for communicating a packet to at least one node of a plurality of networked nodes over an alternative malware containment-coordination path.

6. The network device of claim 1, wherein the decision circuit for determining if a criterion is met for distribution of a malware countermeasure to at least one node of the plurality of networked nodes includes:

a decision circuit for determining if a criterion is met for distribution of a malware countermeasure to at least one node of the plurality of networked nodes, the criterion including a received instruction to distribute a malware countermeasure.

7. The network device of claim 1, wherein the decision circuit for determining if a criterion is met for distribution of the malware countermeasure to at least one node of the plurality of networked nodes further includes:

a decision circuit for determining if a criterion is met for distribution of the malware countermeasure to at least one node of the plurality of networked nodes, the criterion including an indicium of malware present in at least one of the network device, and/or in a node of the plurality of networked nodes.

8. The network device of claim 1, wherein the decision circuit for determining if a criterion is met for distribution of the malware countermeasure to at least one node of the plurality of networked nodes further includes:

a decision circuit for determining if a criterion is met for distribution of the malware countermeasure to at least one node of the plurality of networked nodes, and for selecting the distribution schema.

9. The network device of claim 1, wherein the decision circuit for determining if a criterion is met for distribution of the malware countermeasure to at least one node of the plurality of networked nodes further includes:

a decision circuit for determining if a criterion is met for distribution of the malware countermeasure to at least one node of the plurality of networked nodes, and for selecting a malware countermeasure from at least two malware countermeasures to be communicated to a first set of nodes of the plurality of networked nodes.

10. The network device of claim 1, wherein the distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure using a distribution schema to a first set of nodes of the plurality of networked nodes further includes:

a distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a hit list.

11. The network device of claim 1, wherein the distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure using a distribution schema to a first set of nodes of the plurality of networked nodes further includes:

a distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a hit list generated at least partially by a scanning technique.

12. The network device of claim 1, wherein the distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure using a distribution schema to a first set of nodes of the plurality of networked nodes further includes:

a distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a hit list based at least partially on a topology map of the plurality of networked nodes.

13. The network device of claim 1, wherein the distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure using a distribution schema to a first set of nodes of the plurality of networked nodes further includes:

a distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a list generated at least partially in response to listening to the plurality of networked nodes.

14. The network device of claim 1, wherein the distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure using a distribution schema to a first set of nodes of the plurality of networked nodes further includes:

a distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a quick-division hit list technique.

15. The network device of claim 1, wherein the distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure using a distribution schema to a first set of nodes of the plurality of networked nodes further includes:

a distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a received hit list.

16. The network device of claim 1, wherein the distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure using a distribution schema to a first set of nodes of the plurality of networked nodes further includes:

a distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a locally generated hit list.

17. The network device of claim 1, wherein the distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure using a distribution schema to a first set of nodes of the plurality of networked nodes further includes:

a distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a hit list selected from at least two hit lists.

18. The network device of claim 1, wherein the distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure using a distribution schema to a first set of nodes of the plurality of networked nodes further includes:

a distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a hit list based upon at least one of an assessment of at least one node of the plurality of networked nodes, a significance of at least one node of the plurality of networked nodes, a criticality of at least one node of the plurality of networked nodes, and/or a high bandwidth capacity of at least one node of the plurality of networked node.

19. The network device of claim 1, wherein the distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure using a distribution schema to a first set of nodes of the plurality of networked nodes further includes:

a distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes, the distribution schema corresponding to a list generated by a permutation scanning technique, and/or a partitioned permutation scan technique.

20. The network device of claim 1, wherein the distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure using a distribution schema to a first set of nodes of the plurality of networked nodes further includes:

a distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure using a distribution schema to a first set of nodes of the plurality of networked nodes, the distribution schema corresponding to a list generated at least partially in response to a permutation scanning technique and another scanning technique.

21. The network device of claim 1, wherein the distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure using a distribution schema to a first set of nodes of the plurality of networked nodes further includes:

a distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes, the first set of nodes of the plurality of networked nodes being selected in response to a node selection strategy.

22. The network device of claim 1, wherein the distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure using a distribution schema to a first set of nodes of the plurality of networked nodes further includes:

a distribution circuit for causing, in response to a determination that the criterion is met, a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes, and then for causing a communication of the malware countermeasure to a second set of nodes of the plurality of networked nodes.

23. The network device of claim 1, wherein the malware countermeasure includes an antivirus patch, a patch, a defense, a quarantine of at least one node of the plurality of networked nodes, a quarantine of at least one sub-network of the plurality of networked nodes, a containment measure, a blocking of a port of a host at a node of the plurality of networked nodes, and/or a transmitting a notification receivable by a device associatable with a human.

24. The network device of claim 1, further comprising:

an information store operable to save at least two malware countermeasures.

25. The network device of claim 1, further comprising:

a network analyzer circuit for respectively monitoring at least two nodes of the plurality of networked nodes.

26. The network device of claim 25, wherein the network analyzer circuit for respectively monitoring at least two nodes of the plurality of networked nodes further includes:

a network analyzer circuit for at least one of learning, mapping, scanning, protocol analyzing, and/or probing at least two respective nodes of the plurality of networked nodes.

27. The network device of claim 25, wherein the network analyzer circuit for respectively monitoring at least two nodes of the plurality of networked nodes further includes:

a network analyzer circuit for respectively monitoring at least two nodes of the plurality of networked nodes for an indicium of an activity.

28. The network device of claim 25, wherein the network analyzer circuit for respectively monitoring at least two nodes of the plurality of networked nodes further includes:

a network analyzer circuit for respectively monitoring at least two nodes of the plurality of networked nodes and for generating a node hit list based upon the monitoring.

29. The network device of claim 1, further comprising:

a network probe circuit for collecting information corresponding to at least one of a network address, a protocol, a host characteristic, a connection, an interface, and/or an activity respectfully associated with at least one node of the plurality of network nodes.

30. The network device of claim 1, further comprising:

a network scanning circuit for testing at least two network addresses, and/or a port of a node of the plurality of network nodes.

31. A method implemented in a computing device operable to facilitate communication of a packet to at least one node of a plurality of networked nodes, the method comprising:

determining if a criterion is met for distribution of a countermeasure useable in at least substantially reducing a harm caused by malware (hereafter a “

malware countermeasure”

) to at least one node of the plurality of networked nodes; and

causing a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a distribution schema if the criterion is met.

32. The method of claim 31, wherein the determining if a criterion is met for distribution of a malware countermeasure to at least one node of the plurality of networked nodes using a distribution schema further includes:

determining if a criterion is met for distribution of a malware countermeasure to at least one node of the plurality of networked nodes, the criterion including a received instruction to distribute a malware countermeasure.

33. The method of claim 31, wherein the determining if a criterion is met for distribution of a malware countermeasure to at least one node of the plurality of networked nodes further includes:

determining if a criterion is met for distribution of a malware countermeasure to at least one node of the plurality of networked nodes, the criterion including an indicium of malware presence in at least one of the network device, and/or in a node of the plurality of networked nodes.

34. The method of claim 31, wherein the causing a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a distribution schema if the criterion is met further includes:

causing a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a hit list distribution schema if the criterion is met.

35. The method of claim 31, wherein the causing a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a distribution schema if the criterion is met further includes:

if the criterion is met, causing a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a hit list generated at least partially in response to at least one of a scanning technique and/or a locally generated topology map of the plurality of networked nodes.

36. The method of claim 31, wherein the causing a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a distribution schema if the criterion is met further includes:

if the criterion is met, causing a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a hit list generated at least partially by at least one of a list generated at least partially by listening to the plurality of networked nodes and/or a probing of each respective node of the plurality of networked nodes.

37. The method of claim 31, wherein the causing a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a distribution schema if the criterion is met further includes:

if the criterion is met, causing a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a distribution schema, the first set of nodes of the plurality of networked nodes being selected in response to a node selection strategy.

38. The method of claim 31, wherein the causing a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a distribution schema if the criterion is met further includes:

if the criterion is met, causing a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes, and then causing a communication of the malware countermeasure to a second set of nodes of the plurality of networked nodes, the first set of nodes and the second set of nodes of the plurality of networked nodes respectively being selected in response to a node selection strategy.

39. The method of claim 31, wherein the causing a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a distribution schema if the criterion is met further includes:

selecting a distribution schema and causing a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using the selected distribution schema if the criterion is met.

40. The method of claim 31, wherein the causing a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a distribution schema if the criterion is met further includes:

selecting a malware countermeasure from at least two malware countermeasures and causing a communication of the selected malware countermeasure to a first set of nodes of the plurality of networked nodes using a distribution schema if the criterion is met.

41. The method of claim 31, further comprising:

saving the malware countermeasure in an information store coupled with the computing device.

42. The method of claim 31, further comprising:

collecting information corresponding to at least one of a network address, a protocol, a host characteristic, a connection, an interface, and/or an activity respectfully associated with at least one node of the plurality of network nodes.

43. The method of claim 31, further comprising:

testing at least two network addresses, and/or at least two ports of a node of the plurality of network nodes for an indicium of an activity.

44. A network device comprising:

means for determining if a criterion is met for distribution of a countermeasure useable in at least substantially reducing a harm caused by malware (hereafter a “

malware countermeasure”

) to at least one node of a plurality of networked nodes; and

means for causing a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a distribution schema if the criterion is met.

45. The network device of claim 44, further comprising:

means for saving the malware countermeasure in an information store coupled with the network device.

46. The network device of claim 44, further comprising:

means for collecting information corresponding to at least one of a network address, a protocol, a host characteristic, a connection, an interface, and/or an activity respectfully associated with at least one node of the plurality of network nodes.

47. The method of claim 44, further comprising:

means for testing at least two network addresses, and/or at least two ports of a node of the plurality of network nodes for an indicium of an activity.

48. A computer-program product comprising:

(a) program instructions operable to perform a process in a computing device, the process comprising;

determining if a criterion is met for distribution of a countermeasure useable in at least substantially reducing a harm caused by malware (hereafter a “

malware countermeasure”

) to at least one node of a plurality of networked nodes;

causing a communication of the malware countermeasure to a first set of nodes of the plurality of networked nodes using a distribution schema if the criterion is met; and

(b) a computer-readable signal-bearing medium bearing the program instructions.

49. The computer-program product of claim 48, wherein the process further comprises:

saving the malware countermeasure in an information store.

50. The computer-program product of claim 48, wherein the process further comprises:

collecting information corresponding to at least one of a network address, a protocol, a host characteristic, a connection, an interface, and/or an activity respectfully associated with at least one node of the plurality of network nodes.

51. The computer-program product of claim 48, wherein the process further comprises:

testing at least two network addresses, and/or at least two ports of a node of the plurality of network nodes for an indicium of an activity.

52. The computer program product of claim 48, wherein the computer-readable signal-bearing medium includes a computer storage medium.

53. The computer program product of claim 48, wherein the computer-readable signal-bearing medium includes a communication medium.