Method and apparatus for predicting the incidence of a virus

• US 7,010,696 B1
• Filed: 07/26/2001
• Issued: 03/07/2006
• Est. Priority Date: 03/30/2001
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Cambridge, Rodney D., Ali, Fearuz
• Primary Examiner(s): Moise, Emmanuel L.
• Assistant Examiner(s): POPHAM, JEFFREY D
• Application Number:
  US09/916,969
• Time in Patent Office: 1,685 Days
• Field of Search: 713200-202, 713/188
• US Class Current: 713/188
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Methods and apparatus for predicting the incidence of a new virus a within a system based upon previous infections recorded within the system. According to one aspect of the present invention, a method for responding to a virus alert that provides information pertaining to a new virus includes obtaining the virus alert and assessing a risk level associated with the new virus. The risk level indicates the predicted likelihood that the first virus will cause significant damage in the event that the new virus infects the computer system. Finally, the method includes obtaining computer code such as a driver and/or a dat when the risk level indicates that the new virus may pose a significant risk to the computer system.

Claims

1. A computer-implemented method for responding to a virus alert, the virus alert containing information pertaining to a new virus, the method comprising:

receiving the virus alert;

assessing a risk level associated with the new virus, the assessing including;

obtaining information associated with at least one previous virus which has caused a previous infection on a computer system, and comparing the information pertaining to the new virus with the information associated with the previous virus which has cause the previous infection on the computer system; and

obtaining a program code based on the risk level;

wherein the previous virus and the new virus are of a first type, and the information associated with the previous virus which has caused the previous infection on the computer system includes data associated with a duration of the previous infection and a scope of the previous infection.

2. The method as recited in claim 1 wherein the information associated with the previous virus which has caused the previous infection on the computer system is stored in a profile on a database associated with the computer system.

3. The method as recited in claim 1 wherein the virus alert is received from an anti-virus information source.

4. The method as recited in claim 3 wherein the virus alert is automatically received from the anti-virus information source.

5. The method as recited in claim 4 wherein receiving the virus alert includes acquiring the virus alert from the anti-virus information source.

6. The method as recited in claim 1 wherein the computer system is a computer network, the computer network including a plurality of computing devices.

7. A computer program product responding to a virus alert, the virus alert being arranged to provide information pertaining to a new virus, the computer program product comprising:

computer code for receiving the virus alert;

computer code for assessing a risk level associated with the new virus, the assessing including;

obtaining information associated with at least one previous virus which has caused a previous infection on a computer system, and comparing the information pertaining to the new virus with the information associated with the previous virus which has caused the previous infection on the computer system;

computer code for obtaining program code based on the risk level; and

a computer-readable medium that stores the computer codes;

wherein the previous virus and the new virus are of a first type, and the information associated with the previous virus which has caused the previous infection on the computer system includes data associated with a duration of the previous infection and a scope of the previous infection.

8. The computer program product as recited in claim 7 wherein the computer-readable medium is one selected from the group consisting of a hard disk, a CD-ROM, a DVD, a computer disk, a tape drive, and a computer memory.

9. The computer program product as recited in claim 7 wherein the information associated with the previous virus which has caused the previous infection on the computer system is stored in a profile on a database associated with the computer system.

10. The computer program product as recited in claim 7 wherein the virus alert is received from an anti-virus information source.

11. The computer program product as recited in claim 10 wherein the virus alert is automatically received from the anti-virus information source.

12. The computer program product as recited in claim 11 wherein receiving the virus alert includes acquiring the virus alert from the anti-virus information source.

13. The computer program product as recited in claim 7 wherein the computer system is a computer network, the computer network including a plurality of computing devices.

14. A computer system suitable for responding to a virus alert, the virus alert being providing information pertaining to a new virus, the computer system comprising:

computer code for receiving the virus alert;

computer code for assessing a risk level associated with the new virus, the assessing including;

obtaining information associated with at least one previous virus which has caused a previous infection on the computer system, and comparing the information pertaining to the new virus with the information associated with the previous virus which has caused the previous infection on the computer system;

computer code for obtaining code based on the risk level;

a computer-readable medium that stores the computer codes; and

a processor that executes the computer codes;

wherein the previous virus and the new virus are of a first type, and the information associated with the previous virus which has caused the previous infection on the computer system includes data associated with a duration of the previous infection and a scope of the previous infection.

15. The computer system as recited in claim 14 wherein the information associated with the previous virus which has caused the previous infection on the computer system is stored in a profile on a database associated with the computer system.

16. The computer system as recited in claim 14 wherein the virus alert is received from an anti-virus information source.

17. The computer system as recited in claim 16 wherein the virus alert is automatically received from the anti-virus information source.

18. The computer system as recited in claim 17 wherein receiving the virus alert includes acquiring the virus alert from the anti-virus information source.

19. The computer system as recited in claim 14 wherein the computer system is a computer network, the computer network including a plurality of computing devices.