Virus scanning on thin client devices using programmable assembly language

• US 6,792,543 B2
• Filed: 11/30/2001
• Issued: 09/14/2004
• Est. Priority Date: 08/01/2001
• Status: Expired due to Fees

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Palmer, David W., Pak, Michael C., Kouznetsov, Victor
• Primary Examiner(s): HUA, LY
• Application Number:
  US10/006,413
• Publication Number:
  US 20030033536A1
• Time in Patent Office: 1,019 Days
• Field of Search: 713/153, 713/154, 713/156, 713/188, 713/189, 713/200, 713/201, 707/10, 707/100, 707/102, 705/51, 705/64
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 8/245 from a network towards a terminal

Abstract

A system, method and article of manufacture are provided for programmable scanning for malicious content on a wireless client device. Initially, an anti-virus program having an instruction set is assembled in a programmable computing language. The anti-virus program is implemented in a wireless client device. A scan for malicious code is performed on the wireless client device utilizing the anti-virus program. A method for programmable scanning for malicious content on a thin client device is also provided. An anti-virus engine is assembled in a programmable computing language. The anti-virus engine is installed on a thin client device. A signature file is also assembled in a programmable computing language, the signature file containing an identifier uniquely identifying a computer virus and a virus detection section comprising object code providing operations to detect the identified computer virus on the thin client device. The signature file is also installed on the thin client device. The anti-virus engine is initiated for scanning for malicious code on the thin client device utilizing the signature file.

Claims

1. A method for programmable scanning for malicious content, comprising:

(a) assembling an anti-virus program having an instruction set;

(b) implementing the anti-virus program in a wireless client device; and

(c) scanning for malicious code on the wireless client device utilizing the anti-virus program;

(d) wherein the anti-virus program is assembled in a programmable computing language.

2. The method as recited in claim 1, wherein the instruction set in the programmable computing language is based on instructions from a pre-existing anti-virus program.

3. The method as recited in claim 2, wherein signature information of the pre-existing anti-virus program is merged into a single instruction in the programmable computing language.

4. The method as recited in claim 1, wherein the instruction set implements discrete function automation for signature matching.

5. The method as recited in claim 4, wherein discreet function automations for several types of malicious code are combined in a single discrete function automation for scanning for multiple types of malicious code simultaneously.

6. The method as recited in claim 1, wherein the wireless client device is selected from a group consisting of:

a wireless telephone, a personal digital assistant, a handheld computer, and a pager.

7. The method as recited in claim 1, wherein the instruction set includes instructions for:

(i) deleting an item;

(ii) truncating a file;

(iii) copying bytes from one location to another; and

(iv) overwriting bytes in a stream.

8. The method as recited in claim 1, wherein the anti-virus program includes a signature file used to identify malicious code, wherein the signature file is compiled utilizing the programmable computing language.

9. The method as recited in claim 8, wherein the signature file includes:

(i) an identifier uniquely identifying an instance of malicious code;

(ii) a malicious code detection section comprising object code providing operations to detect the identified instance of malicious code in the wireless client device; and

(iii) an extension sentence comprising object code providing reusable operations implemented in the programmable computing language.

10. A system for programmable scanning for malicious content, comprising:

(a) a signature file compiled from computing language source code, the signature file being used to identify malicious code; and

(b) an anti-virus engine assembled in a programmable computing language and implemented in a wireless environment, the anti-virus engine being for scanning for malicious code on a client device utilizing the signature file.

11. A computer program product for programmable scanning for malicious content, comprising:

(a) computer code for assembling an anti-virus program having an instruction set, wherein the anti-virus program is assembled utilizing a programmable computing language;

(b) computer code for implementing the anti-virus program in a wireless environment; and

(c) computer code for scanning for malicious code on a client device utilizing the anti-virus program.

12. A method for programmable scanning for malicious content, comprising:

(a) assembling an anti-virus engine written in a programmable computing language;

(b) installing the anti-virus engine on a thin client device;

(c) assembling a signature file in a programmable computing language, the signature file containing an identifier uniquely identifying a computer virus and a virus detection section comprising object code providing operations to detect the identified computer virus on the thin client device;

(d) installing the signature file on the thin client device;

(e) initiating the anti-virus engine for scanning for malicious code on the thin client device utilizing the signature file.

13. The method as recited in claim 12, further comprising adding to the signature file:

an extension sentence comprising object code providing reusable operations implemented in the programmable computing language.

14. The method as recited in claim 12, wherein the anti-virus engine utilizes discrete function automation for pattern matching during scanning.

15. The method as recited in claim 14, wherein discrete function automations for several types of malicious code are combined in a single discrete function automation for scanning for multiple types of malicious code simultaneously.

16. The method as recited in claim 12, wherein the thin client device is selected from a group consisting of:

a wireless telephone, a personal digital assistant, a handheld computer, and a pager.

17. The method as recited in claim 12, further comprising disabling malicious code detected during the scanning, wherein the malicious code is disabled by performing at least one of:

(i) deleting an item;

(ii) truncating a file;

(iii) copying bytes from one location to another; and

(iv) overwriting bytes in a stream.

18. A method for programmable scanning for malicious content, comprising:

(a) assembling an anti-virus engine in a programmable computing language;

(b) installing the anti-virus engine on a wireless device;

(c) assembling a signature file using a programmable computing language, the signature file containing an identifier uniquely identifying a computer virus and a virus detection section comprising object code providing operations to detect the identified computer virus on the wireless device;

(d) installing the signature file on the wireless device; and

(e) initiating the anti-virus engine for scanning for malicious code on the wireless device utilizing the signature file.

19. The method as recited in claim 18, further comprising adding to the signature file:

an extension sentence comprising object code providing reusable operations implemented in the programmable computing language.

20. The method as recited in claim 18, wherein the anti-virus engine utilizes discrete function automation for pattern matching during scanning.

21. The method as recited in claim 20, wherein discrete function automations for several types of malicious code are combined in a single discrete function automation for scanning for multiple types of malicious code simultaneously.

22. The method as recited in claim 18, wherein the wireless device is selected from a group consisting of:

a wireless telephone, a personal digital assistant, a handheld computer, and a pager.

23. The method as recited in claim 18, further comprising disabling malicious code detected during the scanning, wherein the malicious code is disabled by performing at least one of:

(i) deleting an item;

(ii) truncating a file;

(iii) copying bytes from one location to another; and

(iv) overwriting bytes in a stream.

24. A method for programmable scanning for malicious content, comprising:

(a) assembling an anti-virus engine using a programmable computing language;

(b) installing the anti-virus engine on a thin client device;

(c) said thin client device being selected from a group consisting of;

a wireless telephone, a personal digital assistant, a handheld computer, and a pager;

(d) assembling a signature file using a programmable computing language, the signature file containing an identifier uniquely identifying a computer virus and a virus detection section comprising object code providing operations to detect the identified computer virus on the thin client device;

(e) adding to the signature file;

an extension sentence comprising object code providing reusable operations implemented in the programmable computing language;

(f) combining discrete function automations for several types of malicious code in a single discrete function automation for scanning for the types of malicious code simultaneously;

(g) installing the signature file on the thin client device;

(h) initiating the anti-virus engine for scanning for malicious code on a client device utilizing the signature file;

(i) said anti-virus engine utilizing discrete function automation for pattern matching during scanning; and

(j) disabling malicious code detected during the scanning, wherein the malicious code is disabled by performing at least one of;

(i) deleting an item;

(ii) truncating a file;

(iii) copying bytes from one location to another; and

(iv) overwriting bytes in a stream.