PROXY-BASED MALWARE SCAN

• US 20080320548A1
• Filed: 06/19/2007
• Published: 12/25/2008
• Est. Priority Date: 06/19/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Tripathi, Ashutosh, Roychoudhuri, Subrata
• Granted Patent: US 8,181,245 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A system that employs out-of-process (‘out-of-proc’) architectures with respect to malware scanning related to network services applications is provided. The ‘out-of-proc’ malware (e.g., virus) scanning is employed in connection with a web conferencing server. This architecture enables more versatile options related to scanning, for example, selective bypass in a crisis situation.

Claims

1. A system that facilitates data scanning within a network conferencing service, comprising:

a proxy server that facilitates out-of-proc access to a scanning engine from the network conference service, wherein the scanning engine checks traffic to/from a plurality of members of the network conferencing service for harmful data; and

a management component that regulates operation of the scanning engine as a function of availability of the scanning engine.

2. The system of claim 1, further comprising a policy component that defines a procedure of regulating operation of the scanning engine.

3. The system of claim 1, the policy component employs an access control list to regulate operation of the scanning engine.

4. The system of claim 1, the policy component employs a type of data to regulate operation of the scanning engine.

5. The system of claim 1, further comprising:

an availability detection component that detects a performance issue related to the scanning engine; and

a recovery component that enables initiation of the scanning engine upon correction of the detected performance issue.

6. The system of claim 5, the performance issue is at least one of a failure, overload or timeout.

7. The system of claim 5, further comprising a notification component that notifies a subset of the members of the performance issue.

8. The system of claim 7, further comprising a logic component that selects the subset as a function of a policy.

9. The system of claim 1, further comprising machine learning and reasoning component that employs at least one of a probabilistic and a statistical-based analysis that infers an action that a user desires to be automatically performed.

10. A computer-implemented method of managing virus scanning operation in a conferencing application, comprising:

monitoring available of an out-of-proc malware scanning application;

determining an issue with the malware scanning application; and

notifying a plurality of users of the issue, wherein the plurality of users are connected via the conferencing application.

11. The computer-implemented method of claim 10, further comprising automatically recovering from the issue.

12. The computer-implemented method of claim 10, further comprising enabling a subset of the plurality of users to bypass operation of the malware scanning application.

13. The computer-implemented method of claim 10, further comprising:

monitoring load of the malware scanning application; and

determining the issue based upon the load in view of a threshold.

14. The computer-implemented method of claim 13, further comprising suspending operation of the malware scanning application when the load exceeds the threshold.

15. The computer-implemented method of claim 14, further comprising enabling a subset of the plurality of users to upload/download data while bypassing the malware scanning application.

16. The computer-implemented method of claim 10, further comprising detecting malicious use of the malware scanning operation, wherein the malicious use defines the issue.

17. A computer-executable network conferencing system, comprising:

means for identifying a problem with a remote malware scanning application;

means for suspending operation of the remote malware scanning application as a function of the problem; and

means for restarting the remote malware scanning application upon correction of the problem.

18. The computer-executable system of claim 17, further comprising means for determining availability of the remote malware scanning application, wherein the availability is employed to assess the problem.

19. The computer-executable system of claim 17, further comprising means for notifying a plurality of users of the problem.

20. The computer-executable system of claim 19, further comprising means for bypassing operation of the remote malware scanning application.