Method And System For Spam, Virus, and Spyware Scanning In A Data Network

• US 20070283440A1
• Filed: 05/03/2007
• Published: 12/06/2007
• Est. Priority Date: 05/03/2006
• Status: Abandoned Application

• Current Assignee: Gatefocus Networks Limited
• Original Assignee: Anchiva Systems, Inc.
• Inventors: Patil, Rahul, Nguyen, Baodung, Lu, Gordon, Yao, Hao
• Application Number:
  US11/744,055
• Publication Number:
  US 20070283440A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A method and system for spam, virus, and spyware scanning in a data network are disclosed. In one embodiment, the method comprises receiving a data packet. A character sequence is created by a first processor from a binary representation of the data packet. The character sequence is sent to a coprocessor. A malware keyword database is scanned for the character sequence with the coprocessor. The character sequence is further processed if the malware keyword database contains the character sequence.

Claims

1. A computer-implemented method, comprising:

receiving a data packet;

creating with a first processor, a character sequence from a binary representation of the data packet;

sending the character sequence to a coprocessor;

scanning a malware keyword database for the character sequence with the coprocessor; and

processing the character sequence if the malware keyword database contains the character sequence.

2. The computer-implemented method of claim 1, wherein processing the character sequence further comprises at least one of:

blocking the data packet, quarantining the data packet, and deletion of the data packet.

3. The computer-implemented method of claim 2, wherein the malware keyword database contains entries relating to at least one of:

trojans, spyware, spam and viruses.

4. The computer-implemented method of claim 1, further comprising pre-indexing the malware keyword database.

5. The computer-implemented method of claim 4, further comprising malware string searching.

6. The computer-implemented method of claim 1, wherein the malware keyword database is scanned in a single memory access.

7. The computer-implemented method of claim 1, further comprising maintaining a score associated with a spam keyword in the malware keyword database.

8. A computer program product tangibly embodied in a computer readable medium, the computer program product comprising instructions operable to cause a data processing equipment to:

receive a data packet;

create with a first processor, a character sequence from a binary representation of the data packet;

send the character sequence to a coprocessor;

scan a malware keyword database for the character sequence with the coprocessor; and

process the character sequence if the malware keyword database contains the character sequence.

9. The computer program product of claim 8, wherein processing the character sequence further comprises at least one of:

blocking the data packet, quarantining the data packet, and deletion of the data packet.

10. The computer program product of claim 9, wherein the malware keyword database contains entries relating to at least one of:

trojans, spyware, spam and viruses.

11. The computer program product of claim 8, further comprising instructions operable to cause the data processing equipment to pre-index the malware keyword database.

12. The computer program product of claim 11, further comprising instructions operable to cause the data processing equipment to string search malware.

13. The computer program product of claim 8, wherein the malware keyword database is scanned in a single memory access.

14. The computer program product of claim 8, further comprising instructions operable to cause the data processing equipment to maintain a score associated with a spam keyword in the malware keyword database.