METHOD TO SCAN A FORENSIC IMAGE OF A COMPUTER SYSTEM WITH MULTIPLE MALICIOUS CODE DETECTION ENGINES SIMULTANEOUSLY FROM A MASTER CONTROL POINT

• US 20140181975A1
• Filed: 11/05/2013
• Published: 06/26/2014
• Est. Priority Date: 11/06/2012
• Status: Abandoned Application

• Current Assignee: Daniel Garrie, William Spernow
• Original Assignee: Daniel Garrie, William Spernow
• Inventors: Spernow, William, Garrie, Daniel
• Application Number:
  US14/072,367
• Publication Number:
  US 20140181975A1
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system

Abstract

A multi-engine malicious code scanning method for scanning data sets from a storage device is provided. The method includes, among other steps obtaining at least one data set from a storage device and generating a single forensic image of the data set and also applying a recover data application to the data set to generate a single recovered data set. A scanning is initiated of the single forensic image and the single recovered data set using the selected plurality of malware engines, where each of the malware engines, installed on the independent operating systems of the virtual operating system may be run concurrently on the single forensic image and the single recovered data set. A report is generated combining each of the malware engines reporting the results of the scans.

Claims

1. A multi-engine malicious code scanning method for scanning data sets from a storage device, said method comprising the steps of:

installing a virtual operating system on at least one computer, along with a plurality of independent operating systems on said computer;

for each of said independent operating systems, installing a malware engine, such that said computer includes a plurality of malware engines, each operating separately on its respective independent operating system;

obtaining at least one data set from a storage device;

generating a single forensic image of said data set;

applying a recover data application to said data set to generate a single recovered data set;

selecting a plurality of malware engines for analyzing said single forensic image and said single recovered data set;

initiating a scanning of said single forensic image and said single recovered data set using said selected plurality of malware engines, wherein each of said malware engines, installed on said independent operating systems of said virtual operating system, may be run concurrently on said single forensic image and said single recovered data set; and

generating a combined report for each of said malware engines reporting the results of said scans.

2. The method as claimed in claim 1, further comprising the step of initiating a scanning of said single forensic image and said single recovered data set using said selected plurality of malware engines using a master control point dashboard on said virtual operating system.

3. The method as claimed in claim 2, further comprising the step of operating a sub-routine for acquiring and verifying selection of said data stored on a storage device.

4. The method as claimed in claim 2, further comprising the step of operating a sub-routine for acquiring and verifying said single recovered data set via said master control point dashboard.

5. The method as claimed in claim 2, further comprising the step of operating a sub-routine for registering, unregistering and updating malware engines via said master control point dashboard.

6. The method as claimed in claim 2, further comprising the step of operating a sub-routine for selecting the sequency and timing of said malware engines scanning of said data stored on a storage device and said recovered data set via said master control point dashboard.

7. The method as claimed in claim 2, further comprising the step of operating a sub-routine for monitoring the progress of said malware engines scanning of said data stored on a storage device and said recovered data set via said master control point dashboard.

8. The method as claimed in claim 2, further comprising the step of operating a sub-routine for generating a combined report for each of said malware engines reporting the results of said scans, including normalizing reports between said malware engines, via said master control point dashboard.

9. A system for employing a multi-engine malicious code scanning method for scanning data sets from a storage device, said system comprising:

a physical server unit having at least a CPU unit, a memory unit, and a duplicator arrangement, wherein said server is configured to accept the installation of a virtual operating system, along with a plurality of independent operating systems;

where for each of said independent operating systems, a malware engine may be installed, such that said server is configured to maintain a plurality of malware engines, each operating separately on its respective independent operating system;

said server configured to be physically deliverable to a remote location and to receive at least one data set from a storage device and to generate a single forensic image of said data set;

said server configured to apply a recover data application to said data set to generate a single recovered data set,

wherein a user of said server may select a plurality of malware engines for analyzing said single forensic image and said single recovered data set by initiating a scanning of said single forensic image and said single recovered data set using said selected plurality of malware engines,

wherein each of said malware engines, installed on said independent operating systems of said virtual operating system are run concurrently on said single forensic image and said single recovered data set; and

said server configured to generate and output a combined report for each of said malware engines reporting the results of said scans.