System and Method for Autonomic Peer-to-Peer Virus Inoculation

• US 20080127347A1
• Filed: 11/29/2006
• Published: 05/29/2008
• Est. Priority Date: 11/29/2006
• Status: Active Grant

• Current Assignee: Lenovo PC International Limited (Lenovo Group Ltd.)
• Original Assignee: Lenovo Singapore Pte Limited (Lenovo Group Ltd.)
• Inventors: Kapinos, Robert J., Saba, Alberto Jose Rojas, Ulrich, Sean Michael, Taylor, Simon David Nicholas, Branch, Shane Christopher, Salembier, James C., Benton, Farrel David, Octaviano, Raymond G.
• Granted Patent: US 8,091,134 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A system, method, and program product is provided that communicates virus information between a computer that detects a virus in a file (the detecting computer system) and the computer that sent the infected file (the infected computer system). When the infected computer system sends an infected file to the detecting computer system the detecting computer system detects the virus in the infected file, retrieves virus information corresponding to the virus (such as the name of the infected file, the identifier, or name, of the virus, the virus definitions used to identify the virus, and any instructions needed to eradicate the virus), and automatically sends the virus information back to the infected computer system over the network.

Claims

1. A computer-implemented method comprising:

receiving, at a detecting computer system, a computer file from an infected computer system, wherein the detecting computer system and the infected computer system are connected to a common computer network;

scanning the received computer file at the detecting computer system using a first plurality of virus definitions accessible to the detecting computer system;

detecting, based on the scanning, a virus in the received computer file;

retrieving virus information corresponding to the detected virus, wherein the virus information includes at least one virus definition selected from the plurality of virus definitions; and

automatically sending the virus information from the detecting computer system to the infected computer system over the common computer network.

2. The method of claim 1 further comprising:

establishing a peer-to-peer computer network between the detecting computer system and the infected computer system prior to the automatic sending of the virus information, wherein the peer-to-peer computer network is established over the common computer network, and wherein the virus information is automatically sent over the established peer-to-peer network.

3. The method of claim 2 wherein the establishing further comprises:

requesting, by the detecting computer system, the peer-to-peer network; and

receiving an acceptance of the peer-to-peer network request from the infected system, wherein the acceptance of the peer-to-peer network request is in response to the detecting computer system being a trusted computer system to the infected computer system.

4. The method of claim 2 further comprising:

digitally signing the virus information at the detecting computer system using a private encryption key corresponding to the detecting computer system, wherein the signed virus information is sent to the infected computer system over the established peer-to-peer network.

5. The method of claim 4 further comprising:

receiving the digitally signed virus information at the infected computer system; and

authenticating the digitally signed virus information at the infected computer system by using a public encryption key that corresponds to the detecting computer system.

6. The method of claim 1 further comprising:

receiving, at the infected computer system, the virus information that was automatically sent by the detecting computer system; and

updating a second plurality of virus definitions accessible to the infected computer system with the one or more selected virus definitions included in the virus information.

7. The method of claim 1 further comprising:

receiving, at the infected computer system, the virus information that was automatically sent by the detecting computer system; and

scanning a plurality of files stored at the infected computer system using the virus definitions included in the received virus information; and

removing the virus from one or more of the files stored at the infected computer system in response to the scanning.

8. A information handling system comprising:

one or more processors;

a memory accessible by at least one of the processors;

a nonvolatile storage area accessible by at least one of the processors;

a network interface adapter connecting the information handling system to a computer network; and

a set of instructions stored in the memory, wherein one or more of the processors executes the set of instructions in order to perform actions of;

receiving, at the network interface adapter, a computer file from an infected computer system, wherein the detecting computer system and the infected computer system are connected to the computer network;

scanning the received computer file using a first plurality of virus definitions stored in the nonvolatile storage area;

detecting, based on the scanning, a virus in the received computer file;

retrieving virus information corresponding to the detected virus, wherein the virus information includes at least one virus definition selected from the plurality of virus definitions; and

automatically sending the virus information to the infected computer system over the common computer network via the network interface adapter.

9. The information handling system of claim 8 wherein the set of instructions perform further actions comprising:

establishing a peer-to-peer computer network between the information handling system and the infected computer system prior to the automatic sending of the virus information, wherein the peer-to-peer computer network is established over the common computer network, and wherein the virus information is automatically sent over the established peer-to-peer network.

10. The information handling system of claim 9 wherein the set of instructions that perform the establishing perform further actions comprising:

requesting, by the information handling system, the peer-to-peer network; and

receiving an acceptance of the peer-to-peer network request from the infected system, wherein the acceptance of the peer-to-peer network request is in response to the information handling system being a trusted computer system to the infected computer system.

11. The information handling system of claim 9 wherein the set of instructions perform further actions comprising:

digitally signing the virus information at the information handling system using a private encryption key corresponding to the information handling system, wherein the signed virus information is sent to the infected computer system over the established peer-to-peer network.

12. The information handling system of claim 11 wherein the set of instructions perform further actions comprising:

receiving the digitally signed virus information at the infected computer system; and

authenticating the digitally signed virus information at the infected computer system by using a public encryption key that corresponds to the information handling system.

13. The information handling system of claim 8 wherein the set of instructions perform further actions comprising:

receiving, at the infected computer system, the virus information that was automatically sent by the information handling system;

updating a second plurality of virus definitions accessible to the infected computer system with the one or more selected virus definitions included in the virus information scanning a plurality of files stored at the infected computer system using the virus definitions included in the received virus information; and

removing the virus from one or more of the files stored at the infected computer system in response to the scanning.

14. A computer program product stored in a computer readable medium, comprising functional descriptive material that, when executed by a data processing system, causes the data processing system to perform actions that include:

receiving, at a detecting computer system, a computer file from an infected computer system, wherein the detecting computer system and the infected computer system are connected to a common computer network;

scanning the received computer file at the detecting computer system using a first plurality of virus definitions accessible to the detecting computer system;

detecting, based on the scanning, a virus in the received computer file;

retrieving virus information corresponding to the detected virus, wherein the virus information includes at least one virus definition selected from the plurality of virus definitions; and

automatically sending the virus information from the detecting computer system to the infected computer system over the common computer network.

15. The computer program product of claim 14 wherein the functional descriptive material causes the data processing system to perform further actions comprising:

establishing a peer-to-peer computer network between the detecting computer system and the infected computer system prior to the automatic sending of the virus information, wherein the peer-to-peer computer network is established over the common computer network, and wherein the virus information is automatically sent over the established peer-to-peer network.

16. The computer program product of claim 15 wherein the establishing further comprises wherein the functional descriptive material causes the data processing system to perform further actions comprising:

requesting, by the detecting computer system, the peer-to-peer network; and

receiving an acceptance of the peer-to-peer network request from the infected system, wherein the acceptance of the peer-to-peer network request is in response to the detecting computer system being a trusted computer system to the infected computer system.

17. The computer program product of claim 15 wherein the functional descriptive material causes the data processing system to perform further actions comprising:

digitally signing the virus information at the detecting computer system using a private encryption key corresponding to the detecting computer system, wherein the signed virus information is sent to the infected computer system over the established peer-to-peer network.

18. The computer program product of claim 17 wherein the functional descriptive material causes the data processing system to perform further actions comprising:

receiving the digitally signed virus information at the infected computer system; and

authenticating the digitally signed virus information at the infected computer system by using a public encryption key that corresponds to the detecting computer system.

19. The computer program product of claim 14 wherein the functional descriptive material causes the data processing system to perform further actions comprising:

receiving, at the infected computer system, the virus information that was automatically sent by the detecting computer system; and

updating a second plurality of virus definitions accessible to the infected computer system with the one or more selected virus definitions included in the virus information.

20. The computer program product of claim 14 wherein the functional descriptive material causes the data processing system to perform further actions comprising:

receiving, at the infected computer system, the virus information that was automatically sent by the detecting computer system; and

scanning a plurality of files stored at the infected computer system using the virus definitions included in the received virus information; and

removing the virus from one or more of the files stored at the infected computer system in response to the scanning.