Method and apparatus for the detection, notification, and elimination of certain computer viruses on a network using a promiscuous system as bait

• US 7,089,589 B2
• Filed: 04/10/2001
• Issued: 08/08/2006
• Est. Priority Date: 04/10/2001
• Status: Expired due to Term

• Current Assignee: Lenovo PC International Limited (Lenovo Group Ltd.)
• Original Assignee: Lenovo Singapore Pte Limited (Lenovo Group Ltd.)
• Inventors: Mohindra, Ajay, Mastrianni, Steven J., Chefalas, Thomas E.
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US09/829,761
• Publication Number:
  US 20020147915A1
• Time in Patent Office: 1,946 Days
• Field of Search: 713187-189, 713/193, 713200-202, 709223-225, 709227-229, 726 22- 26
• US Class Current: 726/22
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A method, computer program product, and network data processing system for identifying, locating, and deleting viruses is provided. In one embodiment, the network data processing system includes a local server, several client data processing systems, and a bait server. The address of the bait server is not published to the clients. Thus, any attempt to access the bait server would indicate the presence of a virus on the client attempting access. The bait server monitors itself and, responsive to an attempt from a client to access the bait server, broadcasts an indication that a virus attack is underway to all devices within the network. The bait server then ignores all further access requests by the offending client until it receives an indication that the offending client has been disinfected and directs the local server to disconnect the offending client(s) from the network. The bait server also notifies the local server and/or a network administrator of the problem and the identity of the offending client allowing appropriate action to be initiated to disinfect the offending client.

Claims

1. A method for detecting the presence of a computer virus, the method comprising;

receiving, at a bait server, a request for access to the bait server, wherein the bait server'"'"'s address is not published to a network and wherein receipt of the request indicates that a virus attack is in progress;

identifying an offending system from which the request originated;

alerting a local server that the virus attack is in progress and of the identity of the offending system; and

disconnecting the offending system from the network.

2. The method as recited in claim 1, further comprising:

prior to disconnecting the offending system, notifying the offending system that it is infected with a virus.

3. The method as recited in claim 1, further comprising:

receiving a reconnect request from the offending system;

verifying that the offending system is disinfected and available to reconnect to the network; and

reconnecting the offending system to the network.

4. The method as recited in claim 1, further comprising:

instructing all devices within the network to ignore all requests from the offending system until the offending system has been disinfected and is available for network communication.

5. A method in a bait server for detecting the presence of a computer virus, the method comprising:

not publishing the bait server'"'"'s address to a network;

receiving a request for access from the network, wherein receipt of the request indicates that a virus is present;

determining the identity of an offending system within the network from which to virus entered the network;

notifying a local server of the presence of the virus and the identity of the offending system;

instructing all devices within the network to ignore all requests from the offending system until the offending system has been disinfected and is available for network communication;

directing the local server to disconnect the offending system from the network; and

responsive to an indication that the offending system has been disinfected and responsive to a reconnect request from the offending system to the local server, reconnecting the offending system to the network.

6. A computer program product in a computer readable media for use in a data processing system for detecting the presence of a computer virus, the computer program product comprising;

first instructions for receiving, at a bait server, a request for access to the bait server, wherein the bait server'"'"'s address is not published to a network and wherein receipt of the request indicates that a virus attack is in progress;

second instructions for identifying an offending system from which the request originated;

third instructions for alerting a local server that the virus attack is in progress and the identity of the offending system; and

fourth instructions for disconnecting the offending system from the network.

7. The computer program product as recited in claim 6, further comprising:

fifth instructions for, prior to disconnecting the offending system, notifying the offending system that it is infected with a virus.

8. The computer program product as recited in claim 6, further comprising:

fifth instructions for receiving a reconnect request from the offending system;

sixth instructions for verifying that the offending system is disinfected and available to reconnect to the network; and

seventh instructions for reconnecting the offending system to the network.

9. The computer program product as recited in claim 6, further comprising:

fifth instructions for instructing all devices within the network to ignore all requests from the offending system until the offending system is reauthorized for network communication.

10. A computer program product in a computer readable media for use in a data processing system in a bait server for detecting the presence of a computer virus, the computer program product comprising:

first instructions for not publishing the bait server'"'"'s address published to a network;

second instructions for receiving a request for access from the network, wherein receipt of the request indicates that a virus is present;

third instructions for determining the identity of an offending system within the network from which the virus entered the network;

fourth instructions for notifying a local server of the presence of the virus and the identity of the offending system;

fifth instructions for instructing all devices within the network to ignore all requests from the offending system until the offending system is reauthorized for network communication;

sixth instructions for directing a local server to disconnect the offending system from the network; and

seventh instructions, responsive to an indication that the offending system has been disinfected and responsive to a reconnect request from the offending system to the local server, for reconnecting the offending system to the network.

11. A system for detecting the presence of a computer virus, the system comprising;

a receiver, at a bait server, which receives a request for access to the bait server, wherein the bait server'"'"'s address is not published to a network and wherein receipt of the request indicates that a virus attack is in progress;

an identifying unit which identifies an offending system from which the request originated;

a virus alert unit which alerts a local server that the virus attack is in progress and the identity of the offending system; and

a disconnection unit which disconnects the offending system from the network.

12. The system as recited in claim 11, further comprising:

a notification unit which, prior to disconnecting the offending system, notifies the offending system that it is infected with a virus.

13. The system as recited in claim 11, further comprising:

a reconnect request unit which receives a reconnect request from the offending system;

a verification unit which verifies that the offending system is authorized to reconnect to the network; and

a reconnecting unit which reconnects the offending system to the network.

14. The system as recited in claim 11, further comprising:

a network protection unit which instructs all devices within the network to ignore all requests from the offending system until the offending system is reauthorized for network communication.

15. A system in a bait server for detecting the presence of a computer virus, the system comprising:

a receiving unit which receives a request for access from a network, wherein the bait server'"'"'s address is not published to the network and wherein receipt of the request indicates that a virus is present;

an identifier unit which determines the identity of an offending system within the network from which the virus entered the network;

a notification unit which notifies a local server of the presence of the virus and the identity of the offending system;

a network protection unit which instructs all devices within the network to ignore all requests from the offending system until the offending system is reauthorized for network communication;

a disconnection unit which directs a local server to disconnect the offending system from the network; and

a reconnection unit which, responsive to an indication that the offending system has been disinfected and responsive to a reconnect request from the offending system to the local server, reconnects the offending system to the network.