Distributed virus scanning arrangements and methods therefor

• US 6,728,886 B1
• Filed: 12/01/1999
• Issued: 04/27/2004
• Est. Priority Date: 12/01/1999
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Ji, Shuang, Tao, Renkui
• Primary Examiner(s): Moise, Emmanuel L.
• Application Number:
  US09/452,918
• Time in Patent Office: 1,609 Days
• Field of Search: 713/200, 713/201, 713/188, 713/155, 714/25, 714/26, 714/38, 709/202, 709/222, 709/228, 709/229, 709/224, 709/245
• US Class Current: 726/24
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

Detecting viruses that may be transferred between a distributed computer network, such as the Internet, and a host computer. A host computer performs its own virus scanning on data, using executables code downloaded to its browser upon a request for data from the Internet, such as an HTTP request. Code is downloaded to the host computer, and is configured to create a virus scan module on the host computer upon such a request. The module is used to detect viruses in data transferred between the host computer and the Internet. Virus scanning is performed thereafter on the host computer. In cases where certain browsers may not be capable of supporting local virus scanning, code is first downloaded to determine whether local scanning is possible. If so, the virus scan module is then downloaded and executed.

Claims

1. A method for detecting a virus from data transferred between a host computer and the Internet, comprising:

downloading to said host computer a first set of codes from a designated computer different from said host computer, said first set of codes being configured to create a virus scan module on said host computer;

creating said virus scan module on said host computer responsive to a request for said data; and

thereafter, employing said virus scan module to detect said virus in said data transferred between said host computer and said Internet.

2. The method of claim 1 wherein said data is transferred between said host computer and said Internet via a browser.

3. The method of claim 2 wherein said data represents active content.

4. The method of claim 2 wherein said data pertains to an e-commerce transaction.

5. The method of claim 2 wherein said data pertains to data received in an email.

6. The method of claim 2 wherein said request is made according to an HTTP protocol.

7. The method of claim 6 further comprising:

receiving at said host computer a second set of codes from said designated computer prior to said downloading, said second set of codes causing said host computer to download said first set of codes from said designated computer when a request for said data is issued.

8. The method of claim 7 wherein said first set of codes represents an applet.

9. The method of claim 8 wherein said browser is configured to support signed applets.

10. The method of claim 8 wherein said first set of codes represents executable instructions written in one of Java and ActiveX.

11. The method of claim 7 wherein said second set of codes represents an auto-config script.

12. The method of claim 7 further comprising:

downloading to said host computer a third set of codes from said designated computer, said third set of codes being configured to create a local proxy server module at said host computer;

creating said local proxy server module on said host computer responsive to a receipt of said third set of codes at said host computer; and

thereafter, employing said local proxy server module to facilitate data transfer between said host computer and said Internet.

13. A method for detecting a virus from data transferred between a browser running on a host computer and the Internet, said host computer being coupled to other host computers on a local area network (LAN), comprising:

receiving at said host computer a first set of codes, said first set of codes being configured to cause said host computer to download a second set of codes from a server coupled to said LAN when a request for data from said Internet is issued from said browser, said second set of codes being configured to create a virus scan module locally on said host computer;

downloading to said host computer said second set of codes from said server when said request for data from said Internet is issued from said browser;

creating said virus scan module on said host computer responsive to a receipt of said second set of codes at said host computer; and

thereafter, employing said virus scan module to detect said virus for said data transferred between said host computer and said Internet.

14. The method of claim 13 wherein said receiving is performed each time said browser is started on said host computer in response to a setting in said browser.

15. The method of claim 13 wherein said request for data represents an HTTP request.

16. The method of claim 13 wherein said second set of codes represents a Java applet.

17. The method of claim 13 wherein said browser is configured to support signed applets.

18. The method of claim 13 wherein said set of codes represents executable instructions written in one of Java and ActiveX.

19. The method of claim 13 wherein said first set of codes represents an auto-config script.

20. The method of claim 13 wherein said data pertains to an e-commerce transaction.

21. The method of claim 13 wherein said data pertains to data received in an email.

22. A method for detecting a virus from data transferred between a browser running on a host computer and the Internet, said host computer being coupled to other host computers on a local area network (LAN), comprising:

receiving at said host computer a first set of codes, said first set of codes being configured to cause, if said browser is determined to be capable of supporting local virus scanning, said host computer to download a second set of codes from a server coupled to said LAN when a request for data from said Internet is issued from said browser, said second set of codes being configured to create a virus scan module locally on said host computer;

determining, using said first set of codes, whether said browser is capable of performing said local virus scanning;

if said browser is determined to be capable of supporting said local virus scanning, performing steps a) through c) below;

a) downloading to said host computer said second set of codes from said server when said request for data from said Internet is issued from said browser,

b) creating said virus scan module on said host computer responsive to a receipt of said second set of codes at said host computer, and

c) thereafter, employing said virus scan module to detect said virus for said data transferred between said host computer and said Internet.

23. The method of claim 22 further comprising:

if said browser is determined to be incapable of supporting said local virus scanning, employing a centrally implemented virus scanning module to perform said detecting said virus.

24. The method of claim 22 wherein said determining includes determining whether said browser supports signed applet technology.

25. The method of claim 22 wherein said determining includes determining whether said browser permits said second set of codes to bind a local port at said host machine.

26. The method of claim 22 wherein said receiving said first set of codes is performed each time said browser is started on said host computer in response to a setting in said browser.

27. The method of claim 22 wherein said request for data represents an HTTP request.

28. The method of claim 22 wherein said second set of codes represents a Java applet.