Computer Virus Protection

• US 20110231669A1
• Filed: 05/26/2011
• Published: 09/22/2011
• Est. Priority Date: 06/22/2000
• Status: Active Grant

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Inventors: Hook, Robert G., Carrera, Marcelo, Stewart, Walter Mason
• Granted Patent: US 8,769,258 B2
• Time in Patent Office: Days
• US Class Current: 713/188
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: H04L 51/066 Format adaptation, e.g. format conversion or compression
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A network is protected from e-mail viruses through the use of a sacrificial server. Any executable programs or other suspicious parts of incoming e-mail messages are forwarded to a sacrificial server, where they are converted to non-executable format such as Adobe Acrobat PDF and sent to the recipient. The sacrificial server is then checked for virus activity. After the execution is completed, the sacrificial server is rebooted.

Claims

10-1. The method of claim 1, wherein the message is an e-mail message.

17. A non-transitory computer readable storage medium having instructions stored thereon, the instructions comprising:

instructions for receiving a message containing an attachment comprising an executable code;

instructions tor comparing a type of the attachment to one or more lists of attachment types;

if the type of the attachment is not in the one or more lists, instructions for converting the executable code from an executable format to a non-executable format, such that the executable code is rendered inoperable, using an application-level process that retains semantic content of the message; and

instructions for forwarding the attachment containing the non-executable format to a target recipient of the message.

18. A system, comprising:

means for receiving a message containing an attachment comprising an executable code;

means for comparing a type of the attachment to one or more lists of attachment types;

if the type of the attachment is not in the one or more lists, means for converting the executable code from an executable format to a non-executable format, such that the executable code is rendered inoperable, using an application-level process that retains semantic content of the message; and

means for forwarding the attachment containing the non-executable format to a target recipient of the message.