Computer network malicious code scanner method and apparatus

• US 6,272,641 B1
• Filed: 11/09/1999
• Issued: 08/07/2001
• Est. Priority Date: 09/10/1997
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Ji, Shuang
• Primary Examiner(s): Wright, Norman M.
• Application Number:
  US09/437,578
• Time in Patent Office: 637 Days
• Field of Search: 713/200, 713/201, 713/154, 714/38, 714/37, 380/23, 380/24, 380/25, 380/3, 380/252
• US Class Current: 726/24
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A network scanner for security checking of application programs (e.g. Java applets or Active X controls) received over the Internet or an Intranet has both static (pre-run time) and dynamic (run time) scanning. Static scanning at the HTTP proxy server identifies suspicious instructions and instruments them e.g. a pre-and-post filter instruction sequence or otherwise. The instrumented applet is then transferred to the client (web browser) together with security monitoring code. During run time at the client, the instrumented instructions are thereby monitored for security policy violations, and execution of an instruction is prevented in the event of such a violation.

Claims

1. A method of detecting and preventing execution of problematic instructions in an application program provided from a computer network to a client, comprising:

providing the application program over the computer network;

determining, prior to downloading the application program to the client, whether the provided application program includes any instructions that are members of a particular set of instructions;

downloading the application program without alteration and executing the application program if it is determined that no members of the set are included in the application program;

if it is determined that an instruction is a member of the set, then downloading the application program to the client along with a security monitoring package, thereby allowing monitoring of execution of the instruction at the client.

2. The method of claim 1 wherein the security monitoring package includes a first predefined call inserted before the instruction and a second predefined call inserted after the instruction.

3. The method of claim 2, wherein the first predefined call is a call to check a security policy.

4. The method of claim 3, wherein the security policy is a state machine.

5. The method of claim 2, wherein the first or second predefined call changes a session state of the application program.

6. The method of claim 2, wherein the security monitoring package is repeated for each instruction in the application program that is a member of the particular set.

7. The method of claim 1, wherein the security monitoring package includes a predefined second instruction replacing the instruction.

8. The method of claim 1, wherein the application program is an applet.

9. The method of claim 8, wherein the applet is in the Java language.

10. The method of claim 1, wherein the computer network is an Intranet or the Internet.

11. The method of claim 1, wherein the particular set of instructions includes instructions that access a predefined set of files.

12. The method of claim 1, further comprising:

determining if the application program includes an authentication;

verifying the authentication; and

replacing the verified authentication with a second authentication.

13. The method of claim 1, further comprising:

providing all dependency files associated with the application program;

providing a single monitoring package performing the step of determining for the application program and its associated dependency files; and

executing the application program and its associated dependency files.

14. A scanner for detecting and preventing execution of instructions in an application program provided from a computer network to a client, wherein the scanner determines whether the provided application program includes any instructions that are members of a particular set of instructions, allowing downloading of the application program to the client and execution of the application program if it is determined that no members of the set are included in the application program;

and comprising

an instrumenter which associates a security monitoring package with the application program at an instruction which is determined to be a member of the set, thereby allowing monitoring of execution of such instruction at the client.

15. The scanner of claim 14, further comprising a packer which associates the security monitoring package with the application program.

16. The scanner of claim 14 wherein the security monitoring package includes a first predefined call inserted before the instruction and a second predefined call inserted after the instruction.

17. The scanner of claim 16, wherein the first predefined call is a call to check a security policy.

18. The scanner of claim 17, wherein the security policy is a state machine.

19. The scanner of claim 16, wherein the first or second predefined call changes a session state of the application program.

20. The scanner of claim 16, wherein the instrumenter associates the security monitoring package with each instruction in the application program that is a member of the particular set.

21. The scanner of claim 14, wherein the instrumenter replaces the instruction with a predefined second instruction.

22. The scanner of claim 14, wherein the application program is an applet.

23. The scanner of claim 22, wherein the applet is in the Java language.

24. The scanner of claim 14, wherein the computer network is an Intranet or the Internet.

25. The scanner of claim 14, wherein the particular set of instructions includes instructions that access a predefined set of files.

26. The scanner of claim 14, further comprising:

a verifier which determines if the application program includes an authentication and verifies the authentication; and

a signer which replaces the verified authentication with a second authentication.

27. The scanner of claim 14, further comprising:

a prefetcher which fetches all dependency files associated with the application program; and

a security policy generator which provides a single security monitoring package for the application program and its associated dependency files.