Computer virus detection

• US 7,093,293 B1
• Filed: 10/19/2004
• Issued: 08/15/2006
• Est. Priority Date: 09/12/2000
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Rothwell, Anton Christian, Bolin, Christopher Scott, Woodruff, Andrew Arlin, Green, Jeffrey Martin, Smithson, Robert Hugh
• Primary Examiner(s): Revak, Christopher
• Application Number:
  US10/969,368
• Time in Patent Office: 665 Days
• Field of Search: None
• US Class Current: 726/24
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A computer virus outbreak is detected by comparing one or more measurement parameters determined over a measurement period against a threshold level. The measurement parameters can include a measurement of how many E-mail messages are sent having an identical file attachment, file type or simply in total. The threshold levels may be varied with the time of day and day of week as well as the tests applied.

Claims

1. A computer program product embodied on a computer readable medium for detecting an outbreak of a computer virus on a computer apparatus, said computer program product comprising:

(i) measurement computer code operable to measure one or more measurement parameters indicative of non virus specific activity of said computer apparatus over a respective measurement period;

(ii) comparison computer code operable to compare said one or more measurement parameters with respective predetermined threshold levels; and

(iii) signal generating computer code operable to generate a signal indicative of an outbreak of a computer virus if one or more of said one or more measurement parameters crosses a respective predetermined threshold level;

wherein one of said measurement parameters is e-mail throughput associated with said computer apparatus, where said e-mail throughput is measured in a form dependent upon at least one of a number of e-mails, and a total of size values for said e-mails within a predetermined time period.

2. A computer program product as claimed in claim 1, wherein one of said measurement parameters is how many e-mail messages are sent having an identical message title.

3. A computer program product as claimed in claim 1, wherein one of said measurement parameters is how many e-mail messages are sent having an identical file attachment.

4. A computer program product as claimed in claim 1, wherein one of said measurement parameters is how many e-mail messages are sent having a file attachment of a given file type.

5. A computer program product as claimed in claim 4, wherein said given file type is an executable file type.

6. A computer program product as claimed in claim 1, wherein said e-mail throughput is measured in a form dependent upon said number of e-mails and said total of size values for said e-mails.

7. A computer program product is claimed in claim 1, wherein said e-mail throughput is measured in a form dependent upon said number of e-mails multiplied by said total of size values for said e-mails.

8. A computer program product as claimed in claim 1, wherein said respective predetermined threshold levels are varied in dependence upon time of day.

9. A computer program product as claimed in claim 1, wherein said respective predetermined threshold levels are varied in dependence upon day of week.

10. A computer program product as claimed in claim 1, wherein said one or more measurement parameters are user selectable.

11. A computer program product as claimed in claim 1, wherein said respective measurements periods are user selectable.

12. A computer program product as claimed in claim 1, wherein said respective predetermined threshold levels are user selectable.

13. A method of detecting an outbreak of a computer virus on a computer apparatus, said method comprising the steps of:

(i) measuring one or more measurement parameters indicative of non virus specific activity of said computer apparatus over a respective measurement period;

(ii) comparing said one or more measurement parameters with respective predetermined threshold levels; and

(iii) generating a signal indicative of an outbreak of a computer virus if one or more of said one or more measurement parameters crosses a respective predetermined threshold level;

wherein one of said measurement parameters is e-mail throughput associated with said computer apparatus, where said e-mail throughput is measured in a form dependent upon at least one of a number of e-mails, and a total of size values for said e-mails within a predetermined time period.

14. A method as claimed in claim 13, wherein one of said measurement parameters is how many e-mail messages are sent having an identical message title.

15. A method as claimed in claim 13, wherein one of said measurement parameters is how many e-mail messages are sent having an identical file attachment.

16. A method as claimed in claim 13, wherein one of said measurement parameters is how many e-mail messages are sent having a file attachment of a given file type.

17. A method as claimed in claim 16, wherein said given file type is an executable file type.

18. A method as claimed in claim 13, wherein said e-mail throughput is measured in a form dependent upon said number of e-mails and said total of size values for said e-mails.

19. A method as claimed in claim 13, wherein said e-mail throughput is measured in a form dependent upon said number of e-mails multiplied by said total of size values for said e-mails.

21. A method as claimed in claim 13, wherein said respective predetermined threshold levels are varied in dependence upon day of week.

22. A method as claimed in claim 13, wherein said one or more measurement parameters are user selectable.

23. A method as claimed in claim 13, wherein said respective measurements periods are user selectable.

24. A method as claimed in claim 13, wherein said respective predetermined threshold levels are user selectable.

20. A method as claimed in claim a 13, wherein said respective predetermined threshold levels are varied in dependence upon time of day.

25. Apparatus for detecting an outbreak of a computer virus on a computer apparatus, said apparatus comprising:

(i) measuring logic operable to measure one or more measurement parameters indicative of non virus specific activity of said computer apparatus over a respective measurement period;

(ii) comparing logic operable to compare said one or more measurement parameters with respective predetermined threshold levels; and

(iii) signal generating logic operable to generate a signal indicative of an outbreak of a computer virus if one or more of said one or more measurement parameters crosses a respective predetermined threshold level;

wherein one of said measurement parameters is e-mail throughput associated with said computer apparatus, where said e-mail throughput is measured in a form dependent upon at least one of a number of e-mails, and a total of size values for said e-mails within a predetermined time period.

26. Apparatus as claimed in claim 25, wherein one of said measurement parameters is how many e-mail messages are sent having an identical message title.

27. Apparatus as claimed in claim 25, wherein one of said measurement parameters is how many e-mail messages are sent having an identical file attachment.

28. Apparatus as claimed in claim 25, wherein one of said measurement parameters is how many e-mail messages are sent having a file attachment of a given file type.

29. Apparatus as claimed in claim 28, wherein said given file type is an executable file type.

30. Apparatus as claimed in claim 25, wherein said e-mail throughput is measured in a form dependent upon said number of e-mails and said total of size values for said e-mails.

31. Apparatus as clammed in claim 25, herein said e-mail throughput is measured in a form dependent upon said number of e-mails multiplied by said total of size values for said e-mails.

32. Apparatus as claimed in claim 25, wherein said respective predetermined threshold levels are varied in dependence upon time of day.

33. Apparatus as claimed in claim 25, wherein said respective predetermined threshold levels are varied in dependence upon day of week.

34. Apparatus as claimed in claim 25, wherein said one or more measurement parameters are user selectable.

36. Apparatus as claimed in claim 25, wherein said respective predetermined threshold levels are user selectable.

35. Apparatus as claimed in clam in 25, wherein said respective measurements periods are user selectable.