Computer Virus Screening Methods and Systems

• US 20100313272A1
• Filed: 07/28/2010
• Published: 12/09/2010
• Est. Priority Date: 02/12/1998
• Status: Active Grant

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Inventors: BENNETT, Raymond Walden III, FRANCZEK, Edward J., BRETSCHER, John Thomas
• Granted Patent: US 8,407,796 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method includes receiving a status update from a client device, the status update reflects at least one change associated with the client device, updating a model of the client device based on the status update, receiving data to be screened for a virus, the data is received after an updating of the model of the client device, and screening the model of the client device for the virus. Systems and articles of manufacture are also disclosed.

Claims

1. A method comprising:

receiving a status update from a client device, wherein the status update reflects at least one change associated with the client device;

updating a model of the client device based on the status update;

receiving data to be screened for a virus, wherein the data is received after an updating of the model of the client device; and

screening the model of the client device for the virus.

2. The method of claim 1, further comprising:

executing a program included in the data;

intercepting a read request generated by the program; and

generating a response to the read request using parameters of the model of the client device.

3. The method of claim 1, further comprising:

executing a program included in the data;

intercepting a write request generated by the program; and

updating the model of the client device in response to the write request.

4. The method of claim 3, further comprising:

communicating to the client device, in response to an acceptance of the data by the client device, modifications made to the model of the client device during execution of the program.

5. The method of claim 4, wherein the communicating further comprises communicating via the Internet, and wherein the modifications allow the client device to execute the program without performing a full installation of the program.

6. The method of claim 1, further comprising:

communicating a result of the screening to the client device.

7. The method of claim 1, wherein the screening further comprises screening the model of the client device for at least one of:

a trojan, or

a worm.

8. The method of claim 1, further comprising:

generating the model of the client device, wherein the model of the client device is implemented as a virtual channel in an interactive session.

9. An article of manufacture including a computer-readable medium having instructions stored thereon, execution of which by a computing device causes the computing device to perform operations comprising:

receiving a status update from a client device, wherein the status update reflects at least one change associated with the client device;

receiving data to be screened for a virus, wherein the data is received after an updating of a model of the client device based on the status update; and

screening the model of the client device for a virus.

10. The article of manufacture of claim 9, wherein the operations further comprise:

executing a program included in the data;

intercepting a write request generated by the program; and

updating the model of the client device in response to the write request.

11. The article of manufacture of claim 10, wherein the operations further comprise:

communicating, in response to an acceptance of the data by the client device, modifications made to the model of the client device during execution of the program, wherein the modifications enable the client device to execute the program without performing a full installation of the program.

12. The article of manufacture of claim 9, wherein the screening further comprises screening the model of the client device for at least one of:

a trojan, or

a worm.

13. The article of manufacture of claim 9, wherein the operations further comprise:

generating the model of the client device, wherein the model of the client device is implemented as a virtual channel in an interactive session.

14. A system comprising:

a processor; and

a memory storing instructions, execution of the instructions by a computing device causing the computing device to perform operations comprising;

receiving a status update from a client device, wherein the status update reflects at least one change associated with the client device;

receiving data to be screened for a virus, wherein the data is received after an updating of a model of the client device based on the status update; and

screening the model of the client device for a virus.

15. The system of claim 14, wherein the operations further comprise:

executing a program included in the data;

intercepting a write request generated by the program; and

updating the model of the client device in response to the write request.

16. The system of claim 15, wherein the operations further comprise:

communicating, in response to an acceptance of the data by the client device, modifications made to the model of the client device during execution of the program, wherein the modifications enable the client device to execute the program without performing a full installation of the program.

17. The system of claim 14, wherein the screening further comprises screening the model of the client device for at least one of:

a trojan, or

a worm.

18. The system of claim 14, wherein the operations further comprise:

generating the model of the client device, wherein the model of the client device is implemented as a virtual channel in an interactive session.

22. The system of claim 14, further comprising:

means for implementing the model of the client device as a virtual channel in an interactive session.

19. A system comprising:

means for receiving a status update from a client device, wherein the status update reflects at least one change associated with the client device;

means for receiving data to be screened for a virus, wherein the data is received after an updating of a model of the client device based on the status update; and

means for screening the model of the client device for a virus.

20. The system of claim 19, further comprising:

means for executing a program included in the data;

means for intercepting a write request generated by the program; and

means for updating the model of the client device in response to the write request.

21. The system of claim 20, further comprising:

means for communicating, in response to an acceptance of the data by the client device, modifications made to the model of the client device during execution of the program, wherein the modifications enable the client device to execute the program without performing a full installation of the program.