Software virus detection methods and apparatus

• US 7,093,135 B1
• Filed: 05/11/2000
• Issued: 08/15/2006
• Est. Priority Date: 05/11/2000
• Status: Expired due to Term

• Current Assignee: Cybersoft, Inc.
• Original Assignee: Cybersoft, Inc.
• Inventors: Radatti, Peter V., Wells, Joseph W.
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): Arani, Taghi T.
• Application Number:
  US09/568,716
• Time in Patent Office: 2,287 Days
• Field of Search: 713/201, 713/176, 713/175, 713/200, 713/188, 380/255, 707/202, 707/1, 726/22, 726/24
• US Class Current: 713/188
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

The present invention is a system and method for identifying and securing code, as well as providing virus detection and code authentication. This detection and authentication occurs through modules or components which utilize certification identifiers to authenticate and validate code. Preferred embodiments include macro detection.

Claims

1. A process for identifying code in a document comprising:

providing code in said document to be certified;

generating an certification identifier for said code;

adding said certification identifier to said document;

adding said certification identifier to a database;

providing a second code to be authenticated;

authenticating said second code, wherein authenticating said second code further comprises an action chosen from the group consisting of;

referencing a second document containing said second code, referencing said database, and, generating an certification identifier for said code.

2. A process as in claim 1 further comprising:

de-certifying said second code upon failure to locate a certification identifier, wherein de-certifying said second code further comprises an action chosen from the group consisting of;

isolating said second code and, deleting said second code.

3. A process as in claim 1 further comprising:

executing said second code.

4. A process for identifying code comprising:

providing a code to be certified;

scanning said code;

generating a first certification identifier for said code;

storing said first certification identifier in a document;

providing a macro to be authenticated; and

,

authenticating said macro wherein authenticating said macro further comprises an action chosen from the group consisting of;

referencing a second document containing said macro, referencing a database containing said macro, and, generating an certification identifier for said macro.

5. A process as in claim 4 further comprising:

de-certifying said macro upon failure to locate a certification identifier, wherein de-certifying said macro further comprises an action chosen from the group consisting of;

isolating said macro and, deleting said macro.

6. A process as in claim 4 further comprising:

executing said macro.