Virus checking and reporting for computer database search results

• US 6,721,721 B1
• Filed: 06/15/2000
• Issued: 04/13/2004
• Est. Priority Date: 06/15/2000
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Bates, Cary Lee, Crenshaw, Robert James, Day, Paul Reuben, Santosuosso, John Matthew
• Primary Examiner(s): Metjahic, Safet
• Assistant Examiner(s): NGUYEN, MERILYN P
• Application Number:
  US09/594,882
• Time in Patent Office: 1,398 Days
• Field of Search: 707/1, 707/3, 707/102, 709/213, 709/245, 709/229, 709/202, 713/201, 345/968, 345/821-823, 345/810, 345/835, 345/966, 345/845
• US Class Current: 1/1
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface
• CPC Class Codes: Y10S 715/968 interface for database querying and retrieval

Abstract

An apparatus, program product and method integrate virus checking functionality into a computer database search environment to assist in protecting a user computer from contracting a computer virus when accessing search results. The generation of a display representation of a result set generated in response to a search request may be based at least in part upon virus status information associated with at least a portion of a plurality of result records identified in the generated result set. Moreover, an apparatus, program product, and method configure a first computer to receive virus status information generated by a plurality of computers, with such received virus status information stored in a virus database that is accessible by the first computer.

Claims

1. A computer-implemented method of processing a search request, the method comprising:

(a) accessing a computer database in response to a search request to generate a result set, the result set identifying a plurality of result records;

(b) accessing virus status information associated with at least a portion of the plurality of result records; and

(c) generating a display representation of at least a portion of the result set based upon the virus status information, wherein generating the display representation includes highlighting display information associated with a selected result record from the result set in the display representation if virus status information associated with the selected result record indicates one of (1) that the selected result record is trusted to be a low risk for infection by a computer virus, and (2) that the selected result record is not trusted to be a low risk for infection by a computer virus.

2. The method of claim 1, wherein the computer database includes at least one of a web page index and a web page directory that includes a plurality of database records, each of which identifying a Uniform Resource Locator (URL) of an associated computer file.

3. The method of claim 1, wherein generating the display representation includes generating display information associated with a selected result record from the result set in the display representation only if virus status information associated with the selected result record indicates that the selected result record is trusted to be a low risk for infection by a computer virus.

4. The method of claim 1, further comprising determining whether a selected result record from the result set is trusted to be a low risk for infection by a computer virus by comparing virus status information associated with the selected result record with a virus criterion.

5. The method of claim 4, wherein the virus criterion specifies at least one of whether a result record has ever been found to be infected by a computer virus, whether a result record has been found to be infected by a computer virus within a first predetermined time period, and whether a result record has been virus checked within a second predetermined time period.

6. The method of claim 1, further comprising:

(a) performing virus checking for at least a portion of the records in the computer database to generate virus status information associated therewith; and

(b) storing the virus status information generated during virus checking within a virus database;

wherein accessing virus status information associated with the portion of the plurality of result records includes accessing the virus database.

7. The method of claim 6, wherein performing virus checking is performed during a crawling operation, the method further comprising performing virus checking for a selected record in the database in response to at least one of a modification to a file associated with the selected record and an expiration of a time period since the selected record was last virus checked.

8. The method of claim 6, wherein performing virus checking includes performing virus checking for a selected record from the computer database by virus checking at least one of a file associated with the selected record and each virus-susceptible file linked to the associated file.

9. The method of claim 6, wherein performing virus checking includes performing virus checking for at least a portion of the plurality of result records prior to generation of the result set.

10. The method of claim 6, wherein performing virus checking further includes performing virus checking in a plurality of computers, the method further comprising receiving virus status information from at least a portion of the plurality of computers.

11. The method of claim 10, wherein receiving virus status information further comprises authenticating the received virus status information prior to storing the received virus status information in the virus database.

12. The method of claim 10, wherein performing virus checking in the plurality of computers includes performing virus checking in a client computer, the method further comprising:

(a) issuing the search request from the client computer; and

(b) receiving and displaying the display representation of the portion of the result set using the client computer.

13. The method of claim 12, wherein performing virus checking includes performing virus checking on a selected file in the client computer responsive to a user request to retrieve the selected file.

14. The method of claim 10, further comprising:

(a) sending a storage location identifier to a selected computer from the plurality of computers;

(b) performing virus checking on a selected file identified by the storage location identifier to generate virus status information for the selected file; and

(c) sending the virus status information associated for the selected file from the selected computer for inclusion in the virus database.

15. The method of claim 10, wherein performing virus checking in the plurality of computers includes performing virus checking in a selected computer by virus checking a plurality of files accessible by the selected computer.

16. A computer-implemented method of processing a search request, the method comprising:

(a) accessing a computer database in response to a search request to generate a result set, the result set identifying a plurality of result records;

(b) accessing virus status information associated with at least a portion of the plurality of result records; and

(c) generating a display representation of at least a portion of the result set based upon the virus status information, wherein generating the display representation includes highlighting display information associated with a selected result record from the result set in the display representation if virus status information associated with the selected result record indicates that the selected result record is trusted to be a low risk for infection by a computer virus.

17. The method of claim 16, wherein highlighting the display information associated with the selected result record includes displaying an icon proximate the display information to indicate that the selected result record is trusted to be a low risk for infection by a computer virus.

18. A computer-implemented method of processing a search request, the method comprising:

(a) accessing a computer database in response to a search request to generate a result set, the result set identifying a plurality of result records;

(b) accessing virus status information associated with at least a portion of the plurality of result records; and

(c) generating a display representation of at least a portion of the result set based upon the virus status information, wherein generating the display representation includes highlighting display information associated with a selected result record from the result set in the display representation if virus status information associated with the selected result record indicates that the selected result record is not trusted to be a low risk for infection by a computer virus.

19. The method of claim 18, wherein highlighting the display information associated with the selected result record includes displaying an icon proximate the display information to indicate that the selected result record is not trusted to be a low risk for infection by a computer virus.

20. The method of claim 18, further comprising displaying at least a portion of the virus status information associated with the selected result record in response to user input.

21. The method of claim 20, wherein displaying the virus status information includes displaying the virus status information in a pop-up window in response to user input directed to an icon displayed proximate the display information.

22. The method of claim 20, wherein displaying the virus status information includes displaying at least one of an infected file name and a timestamp that indicates when the selected result record was last checked for viruses.

23. An apparatus, comprising:

(a) a computer database including a plurality of records; and

(b) a program configured to access the computer database in response to a search request to generate a result set, the result set identifying a plurality of result records from the plurality of records, and the program further configured to access virus status information associated with at least a portion of the plurality of result records, and generate a display representation of at least a portion of the result set based upon the virus status information, wherein the program is configured to generate the display representation by highlighting display information associated with a selected result record from the result set in the display representation if virus status information associated with the selected result record indicates one of (1) that the selected result record is trusted to be a low risk for infection by a computer virus, and (2) that the selected result record is not trusted to be a low risk for infection by a computer virus.

24. The apparatus of claim 23, wherein the computer database includes at least one of a web page index and a web page directory, and wherein each record identifies a Uniform Resource Locator (URL) of an associated computer file.

25. The apparatus of claim 23, wherein the program is configured to generate the display representation by generating display information associated with a selected result record from the result set in the display representation only if virus status information associated with the selected result record indicates that the selected result record is trusted to he a low risk for infection by a computer virus.

26. The apparatus of claim 23, wherein the program is further configured to determine whether a selected result record from the result set is trusted to be a low risk for infection by a computer virus by comparing virus status information associated with the selected result record with a virus criterion.

27. The apparatus of claim 26, wherein the virus criterion specifies at least one of whether a result record has ever been found to be infected by a computer virus, whether a result record has been found to be infected by a computer virus within a first predetermined time period, and whether a result record has been virus checked within a second predetermined time period.

28. The apparatus of claim 23, further comprising a crawler computer program configured to perform virus checking for a plurality of records from the computer database during a crawling operation, and wherein the crawler computer program is configured to performing virus checking for a selected record in the computer database in response to at least one of a modification to a file associated with the selected record and an expiration of a time period since the selected record was last virus checked.

29. The apparatus of claim 23, further comprising a virus database configured to store the virus status information, wherein the program is configured to access the virus status information by accessing the virus database, and wherein at least a portion of the virus status information is resident in the virus database prior to generation of the result set.

30. The apparatus of claim 29, wherein the program is resident in a first computer, the first computer further configured to receive virus status information from a second computer.

31. The apparatus of claim 30, wherein the second computer is among a plurality of computers in communication with the first computer, wherein at least a portion of the plurality of computers are configured to perform virus checking and send virus status information generated in response to virus checking.

32. The apparatus of claim 31, wherein the program is further configured to authenticate received virus status information prior to storing the received virus status information in the virus database.

33. The apparatus of claim 23, wherein the second computer is further configured to issue the search request, and to receive and display the display representation of a portion of the result set.

34. The apparatus of claim 33, wherein at least one of the plurality of computers is configured to perform virus checking on a selected file responsive to a user request to retrieve the selected file.

35. The apparatus of claim 23, wherein the program is further configured to send a storage location identifier to a selected computer from the plurality of computers, and wherein the selected computer is configured to perform virus checking on a selected file identified by the storage location identifier to generate virus status information for the selected file, and to send the virus status information associated with the selected file from the selected computer for inclusion in the virus database.

36. The apparatus of claim 23, wherein performing virus checking in the plurality of computers includes performing virus checking in a selected computer by virus checking a plurality of files accessible by the selected computer.

37. An apparatus, comprising:

(a) a computer database including a plurality of records, and

(b) a program configured to access the computer database in response to a search request to generate a result set, the result set identifying a plurality of result records from the plurality of records, and the program further configured to access virus status information associated with at least a portion of the plurality of result records, and generate a display representation of at least a portion of the result set based upon the virus status information, wherein the program is configured to generate the display representation by highlighting display information associated with a selected result record from the result set in the display representation if virus status information associated with the selected result record indicates that the selected result record is trusted to be a low risk for infection by a computer virus.

38. An apparatus, comprising:

(a) a computer database including a plurality of records; and

(b) a program configured to access the computer database in response to a search request to generate a result set, the result set identifying a plurality of result records from the plurality of records, and the program further configured to access virus status information associated with at least a portion of the plurality of result records, and generate a display representation of at least a portion of the result set based upon the virus status information, wherein the program is configured to generate the display representation by highlighting display information associated with a selected result record from the result set in the display representation if virus status information associated with the selected result record indicates that the selected result record is not trusted to be a low risk for infection by a computer virus.

39. A program product, comprising:

(a) a program configured to access a computer database in response to a search request to generate a result set, the result set identifying a plurality of result records from the computer database, and the program further configured to access virus status information associated with at least a portion of the plurality of result records, and to generate a display representation of at least a portion of the result set based upon the virus status information, wherein the program is configured to generate the display representation by highlighting display information associated with a selected result record from the result set in the display representation if virus status information associated with the selected result record indicates one of (1) that the selected result record is trusted to be a low risk for infection by a computer virus, and (2) that the selected result record is not trusted to be a low risk for infection by a computer virus; and

(b) a signal bearing medium bearing the program.

40. The program product of claim 39, wherein the signal bearing medium includes at least one of a recordable medium and a transmission medium.

41. A computer-implemented method of building a virus database, the method comprising:

(a) receiving with a first computer virus status information generated by a plurality of computers, the virus status information generated by each of the plurality of computers associated with at least one file accessible by the respective computer from the plurality of computers;

(b) storing the virus status information for each file in a virus database accessible by the first computer; and

(c) authenticating received virus status information prior to storing the received virus status information in the virus database.

42. The method of claim 41, further comprising:

(a) accessing a second computer database in response to a search request to generate a result set, the result set identifying a plurality of result records;

(b) accessing the virus database to retrieve virus status information associated with at least a portion of the plurality of result records; and

(c) generating a display representation of at least a portion of the result set based upon the virus status information.

43. The method of claim 41, further comprising, during a crawling operation performed by the first computer, performing virus checking of a plurality of files with the first computer.

44. The method of claim 41, further comprising performing virus checking in a client computer from the plurality of computers that is configured to issue a search request, and to receive and display a display representation of a result set generated in response to the search request.

45. The method of claim 44, wherein performing virus checking includes performing virus checking on a selected file in the client computer responsive to a user request to retrieve the selected file.

46. The method of claim 41, further comprising:

(a) sending a storage location identifier to a selected computer from the plurality of computers;

(b) performing virus checking on a selected file identified by the storage location identifier to generate virus status information for the selected file; and

(c) sending the virus status information for the selected file from the selected computer for inclusion in the virus database.

47. The method of claim 41, wherein performing virus checking in the plurality of computers includes performing virus checking in a selected computer from the plurality of computer by virus checking a plurality of files accessible by the selected computer.

48. An apparatus, comprising:

(a) a virus database configured to store virus status information for a plurality of files; and

(b) a first computer within which is resident a program configured to receive virus status information generated by a plurality of computers, the virus status information generated by each of the plurality of computers associated with at least one file accessible by the respective computer from the plurality of computers, the program further configured to store the virus status information for each file in the virus database, and to authenticate received virus status information prior to storing the received virus status information in the virus database.

49. The apparatus of claim 48, further comprising a plurality of computers in communication with the first computer, wherein at least a portion of the plurality of computers are configured to perform virus checking and send virus status information generated in response to virus checking.

50. The apparatus of claim 49, wherein plurality of computers includes a client computer configured to issue a search request, and receive and display a display representation of a portion of a result set generated in response to the search request.

51. The apparatus of claim 49, wherein the program is further configured to send a storage location identifier to a selected computer from the plurality of computers, and wherein the selected computer is configured to perform virus checking on a selected file identified by the storage location identifier to generate virus status information for the selected file, and to send the virus status information associated with the selected file from the selected computer for inclusion in the virus database.

52. A program product, comprising:

(a) a program resident in a first computer and configured to receive virus status information generated by a plurality of computers, the virus status information generated by each of the plurality of computers associated with at least one file accessible by the respective computer from the plurality of computers, the program further configured to store the virus status information for the file in a virus database accessible by the first computer, and to authenticate received virus status information prior to storing the received virus status information in the virus database; and

(b) a signal bearing medium bearing the program.

53. A computer-implemented method of building a virus database, the method comprising:

(a) receiving with a first computer virus status information generated by a plurality of computers, the virus status information generated by each of the plurality of computers associated with at least one file accessible by the respective computer from the plurality of computers;

(b) storing the virus status information for each file in a virus database accessible by the first computer;

(c) sending a storage location identifier to a selected computer from the plurality of computers to initiate the performance of virus checking on a selected file identified by the storage location identifier to generate virus status information for the selected file; and

(d) receiving the virus status information for the selected file from the selected computer for inclusion in the virus database.

54. A computer-implemented method of building a virus database, the method comprising:

(a) receiving with a first computer virus status information generated by a plurality of client computers, the virus status information generated by each of the plurality of client computers associated with at least one file accessible by the respective client computer from the plurality of client computers, wherein each client computer is further configured to issue a search request via a web browser installed on such client computer, and to receive and display a display representation of a result set generated in response to the search request in the web browser;

(b) storing the virus status information for each file in a virus database accessible by the first computer; and

(c) authenticating received virus status information prior to storing the received virus status information in the virus database.