Network traffic intercepting method and system

• US 6,763,467 B1
• Filed: 02/03/1999
• Issued: 07/13/2004
• Est. Priority Date: 02/03/1999
• Status: Expired due to Term

• Current Assignee: Cybersoft, Inc., Service Medical Consulting Incorporated
• Original Assignee: Cybersoft, Inc.
• Inventors: Harding, David J., Radatti, Peter V.
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): JACKSON, JENISE E
• Application Number:
  US09/244,154
• Time in Patent Office: 1,987 Days
• Field of Search: 713/200, 713/201, 713/151, 713/152, 713/153, 713/154, 709/230, 709/229, 709/225, 709/227, 709/223, 709/224, 709/231
• US Class Current: 726/24
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A computer system and method for intercepting, examining, and controlling data streams flowing via transport connections between the transport layer of an operating system and the user application; which operates on a single computer. The system and method preferably operates with a single computer system. All data streams that pass from an external network, through the transport layer of an operating system to the user application or from the user application to the transport layer are intercepted by a network traffic interceptor. The network traffic interceptor processes all data streams for proscribed data that may include viruses, trojan horses, worms, and other hostile algorithms. The processing used by the network traffic interceptor can include monitoring, blocking or destroying data, thereby protecting the single computer system from being infected by hostile algorithms.

Claims

1. A method conducted within a single computer system connected to a network for intercepting, examining, and controlling data flowing via transport connections between the transport layer of an operating system and user applications, said method comprising the steps of:

(a) intercepting all said data flowing between said transport layer and said user application;

(b) examining said data for information content, which comprises examining said data streams to determine if they are scannable for information content or non-scannable for information content;

passing said non-scannable data streams to said user application; and

passing said scannable data streams to said processing step (c) wherein said information content includes the presence of proscribed data; and

,

(c) processing said data, including scanning said data for said proscribed data, based on said information content to protect the computer system and the network by preventing said computer system and network from accessing proscribed data,

wherein said operating system includes protocols implemented on top of said transport layer, said protocols having a plurality of states, and wherein said processing step (b) further includes the step of parsing, said parsing tracking the state of said protocols with a parser.