Virus detection and removal system and method for network-based systems

• US 7,080,407 B1
• Filed: 06/27/2000
• Issued: 07/18/2006
• Est. Priority Date: 06/27/2000
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Zhao, Guangyu, Badrinath, Subramaniam, Liu, Meyer
• Primary Examiner(s): Zand, Kambiz
• Application Number:
  US09/607,430
• Time in Patent Office: 2,212 Days
• Field of Search: 713/188, 713/200, 713/201, 709/230, 709238-240, 726/24
• US Class Current: 726/24
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

An enhanced virus detection monitoring (VDM) system and method suitable for use with network systems, and in particular electronic document control systems (EDCS) is disclosed. The VDM system intercepts files and documents before they are made available to other users (“check-in”) and inspects the files/documents for virus infection. If a virus infection is found in a file or document, the VDM system invokes anti-virus software to disinfect the file or document. Once the virus has been removed from the file or document, the file (or document) is then made available to other users of the system. If the virus cannot be removed, the file (or document) is not allowed to be checked-in.

Claims

1. In a networked server having a file system therein, a virus detection monitoring system comprising:

a) a check-in interceptor configured to monitor the network server for incoming files and intercept incoming files before said files are transferred to the file system of the server; and

b) an anti-virus interface operatively coupled to said check-in interceptor, said anti-virus interface configured to transfer the incoming files which are intercepted to an anti-virus application for virus detection and removal, wherein said check-in interceptor is further configured to prevent an intercepted incoming file from entering the file system if a virus is detected in the intercepted incoming file and the virus is not removed by the anti-virus application.

2. The virus detection monitoring system of claim 1 wherein said anti-virus interface is further configured to receive from said anti-virus application a signal indicating whether a virus was detected in the intercepted incoming file and whether the virus was removed.

3. The virus detection monitoring system of claim 1 wherein said anti-virus interface is further configured to receive from said anti-virus application a signal indicating whether a virus was detected in the intercepted incoming file, said check-in interceptor further configured to communicate the signal to a user submitting the intercepted incoming file.

4. The virus detection monitoring system of claim 1, further comprising a “

dat file updater and validater”

coupled to the anti-virus application, said dat file updater and validater configured to periodically download updated virus data, validate the updated virus data after download, and update said anti-virus application with said updated virus data after validating said virus data.

5. The virus detection monitoring system of claim 1, wherein said check-in interceptor inspects documents and files uploaded to an electronic document control system operating on the network server.

6. The virus detection monitoring system of claim 1, wherein said check-in interceptor intercepts document upload commands issued to the network server.

7. The virus detection monitoring system of claim 6, wherein said document upload commands comprise hypertext transfer protocol commands.

8. In a networked server having a file system therein, a method for virus detection monitoring comprising:

a) intercepting incoming files before the incoming files are transferred to the file system of the server;

b) transferring the incoming files which are intercepted to an anti-virus application for virus detection and removal; and

c) preventing an intercepted file from entering the file system if a virus is detected in the incoming file and the virus is not removed by the anti-virus application.

9. The method of claim 8, further comprising:

a) receiving a signal from said anti-virus application, said signal indicating whether a virus was detected in the intercepted incoming file; and

b) communicating the signal to a user submitting the intercepted incoming file.

10. The method of claim 8, further comprising:

a) periodically downloading updated virus data;

b) validating the updated virus data; and

c) updating said anti-virus application with said updated virus data.

11. The method of claim 8, wherein said network server comprises an electronic document control system.

12. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for virus detection monitoring, said method comprising:

a) intercepting incoming files before the files are transferred to a file system of a server;

b) transferring the incoming files which are intercepted to an anti-virus application for virus detection and removal; and

c) preventing the intercepted incoming file from entering the file system if a virus is detected in the intercepted incoming file and the virus was not removed by the anti-virus application.

13. The program storage device of claim 12, said method further comprising:

a) receiving a signal from said anti-virus application, said signal indicating whether a virus was detected in the intercepted incoming file; and

b) communicating the signal to a user submitting the intercepted incoming file.

14. The program storage device of claim 12, said method further comprising:

a) periodically downloading updated virus data;

b) validating the updated virus data; and

c) updating said anti-virus application with said updated virus data.

15. The program storage device of claim 12, wherein said network server comprises an electronic document control system.

16. In a networked server having a file system therein, a virus detection monitoring system comprising:

a) means for intercepting incoming files before the incoming files are transferred to the file system of the server;

b) means for transferring the incoming files which are intercepted to an anti-virus application for virus detection and removal; and

c) means for preventing an intercepted incoming file from entering the file system if a virus was detected in the intercepted incoming file and the virus is not removed by the anti-virus application.

17. The virus detection monitoring system of claim 16, further comprising:

a) means for receiving a signal from said anti-virus application, said signal indicating whether a virus was detected in the intercepted incoming file; and

b) means for communicating the signal to a user submitting the intercepted incoming file.

18. The virus detection monitoring system of claim 16, further comprising:

a) means for downloading updated virus data according to a schedule;

b) means for validating the updated virus data; and

c) means for updating said anti-virus application with said updated virus data.

19. The virus detection monitoring system of claim 16, wherein said network server comprises an electronic document control system.