Automated Internet Relay Chat malware monitoring and interception

• US 7,069,316 B1
• Filed: 02/19/2002
• Issued: 06/27/2006
• Est. Priority Date: 02/19/2002
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Gryaznov, Dmitry
• Primary Examiner(s): Wiley, David
• Assistant Examiner(s): DENNISON, JERRY B
• Application Number:
  US10/076,441
• Time in Patent Office: 1,589 Days
• Field of Search: 709217-219, 709/224, 709/229, 713200-202, 717/104, 717/124
• US Class Current: 709/224
• CPC Class Codes: H04L 12/1813 for computer conferences, e.g. chat rooms instant messaging H04L51/04; protocols for multimedia communication H04L65/1101; arrangements for multi-party communication H04L65/403; telephonic conference arrangements H04M3/56; television conference systems H04N7/15
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A method, system, and computer program product for providing monitoring and interception of malwares in Internet Relay Chat (IRC), which is secure, does not require significant system resources, and is capable of monitoring multiple IRC networks and servers. A method of detecting a computer malware comprises the steps of joining an Internet Relay Chat server, retrieving a list of channels of the Internet Relay Chat server, monitoring at least one channel in the list of retrieved channels, accepting data received from the monitored channel, and storing and logging the data received from the monitored channel.

Claims

1. A method of detecting a computer malware comprising the steps of:

joining an Internet Relay Chat server;

retrieving a list of channels of the Internet Relay Chat server;

monitoring at least one channel in the list of retrieved channels, by;

joining a channel,

waiting a time delay,

leaving the channel, and

simulating user activities by transmitting a message to the channel;

accepting data received from the monitored channel;

storing and logging the data received from the monitored channel; and

scanning the received data to detect a computer malware;

wherein an Internet Relay Chat client is utilized in the joining, the retrieving, and the monitoring;

wherein the Internet Relay Chat client scans the received data to detect the computer malware and collects statistics including a receipt time of the data and a sender of the data.

2. The method of claim 1, wherein the computer malware comprises at least one of a computer virus, a computer worm, or a computer Trojan horse program.

3. The method of claim 1, further comprising the step of:

analyzing the stored and logged data to detect the computer malware.

4. The method of claim 3, wherein the computer malware comprises at least one of a computer virus, a computer worm, or a computer Trojan horse program.

13. The method of claim 1, wherein transmitting the message to the channel is utilized for triggering the computer malware in the channel to be sent.

14. The method of claim 1, wherein the storing and logging includes storing and logging the receipt time of the data and the sender of the data.

15. The method of claim 1, wherein the Internet Relay Chat client automatically accepts and stores the data received from the monitored channel.

16. The method of claim 1, wherein the Internet Relay Chat client notifies an administrator of the computer malware.

17. The method of claim 1, wherein the received data includes direct client-to-client DCC send requests.

18. The method of claim 3, wherein the analyzing is automatically performed.

19. The method of claim 3, wherein the analyzing is performed manually.

20. The method of claim 1, wherein the monitoring is performed utilizing a restricted and secure scripting language.

21. The method of claim 1, wherein a plurality of Internet Relay Chat clients running on a single computer are each utilized in the joining, the retrieving, and the monitoring.

5. A system for detecting a computer malware comprising:

a processor operable to execute computer program instructions;

a memory operable to store computer program instructions executable by the processor; and

computer program instructions stored in the memory and executable to perform the steps of;

joining an Internet Relay Chat server;

retrieving a list of channels of the Internet Relay Chat server;

monitoring at least one channel in the list of retrieved channels, by;

joining a channel,

waiting a time delay,

leaving the channel, and

simulating user activities by transmitting a message to the channel,

accepting data received from the monitored channel;

storing and logging the data received from the monitored channel; and

scanning the received data to detect a computer malware;

wherein an Internet Relay Chat client is utilized in the joining, the retrieving, and the monitoring;

wherein the Internet Relay Chat client scans the received data to detect the computer malware and collects statistics including a receipt time of the data and a sender of the data.

6. The system of claim 5, wherein the computer malware comprises at least one of a computer virus, a computer worm, or a computer Trojan horse program.

7. The system of claim 5, further comprising the step of:

analyzing the stored and logged data to detect the computer malware.

8. The system of claim 7, wherein the computer malware comprises at least one of a computer virus, a computer worm, or a computer Trojan horse program.

9. A computer program product embodied on a computer readable medium for detecting a computer malware comprising:

computer program instructions, recorded on the computer readable medium, executable by a processor, for performing the steps of;

joining an Internet Relay Chat server;

retrieving a list of channels of the Internet Relay Chat server;

monitoring at least one channel in the list of retrieved channels, by;

joining a channel,

waiting a time delay,

leaving the channel, and

simulating user activities by transmitting a message to the channel;

accepting data received from the monitored channel;

storing and logging the data received from the monitored channel; and

scanning the received data to detect a computer malware;

wherein an Internet Relay Chat client is utilized in the joining, the retrieving, and the monitoring;

wherein the Internet Relay Chat client scans the received data to detect the computer malware and collects statistics including a receipt time of the data and a sender of the data.

10. The computer program product of claim 9, wherein the computer malware comprises at least one of a computer virus, a computer worm, or a computer Trojan horse program.

11. The computer program product of claim 9, further comprising the step of:

analyzing the stored and logged data to detect the computer malware.

12. The computer program product of claim 11, wherein the computer malware comprises at least one of a computer virus, a computer worm, or a computer Trojan horse program.