Virus checking and reporting for computer database search results

• US 7,096,215 B2
• Filed: 01/13/2004
• Issued: 08/22/2006
• Est. Priority Date: 06/15/2000
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Bates, Cary Lee, Crenshaw, Robert James, Day, Paul Reuben, Santosuosso, John Matthew
• Primary Examiner(s): Kindred, Alford
• Assistant Examiner(s): Nguyen, Merilyn
• Application Number:
  US10/756,666
• Publication Number:
  US 20040148281A1
• Time in Patent Office: 952 Days
• Field of Search: 707/1, 707/3, 707/4, 707/10, 707/100, 707/104.1, 707/102, 713/200, 713/201, 713/188, 709/229, 709/232, 709/202, 709/245, 726/22, 726/24, 726/25, 345821-823, 345/968, 345/810
• US Class Current: 1/1
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface
• CPC Class Codes: Y10S 715/968 interface for database querying and retrieval

Abstract

An apparatus, program product and method integrate virus checking functionality into a computer database search environment to assist in protecting a user computer from contracting a computer virus when accessing search results. The generation of a display representation of a result set generated in response to a search request may be based at least in part upon virus status information associated with at least a portion of a plurality of result records identified in the generated result set. Moreover, an apparatus, program product, and method configure a first computer to receive virus status information generated by a plurality of computers, with such received virus status information stored in a virus database that is accessible by the first computer.

Claims

1. A computer-implemented method of processing a search request, the method comprising, in response to the search request:

accessing a computer database to generate a result set, the result set identifying a plurality of result records;

accessing virus status information associated with at least a portion of the plurality of result records subsequent to generation of the result set; and

generating a display representation of at least a portion of the result set based upon the virus status information, wherein generating the display representation includes excluding from the display representation a first result record from the result set if virus status information associated with the first result record indicates that the first result record is not trusted to be a low risk for infection by a computer virus, and including in the display representation a second result record from the result set if virus status information associated with the second result record indicates that the second result record is trusted to be a low risk for infection by a computer virus.

2. The method of claim 1, further comprising determining whether the first and second result records from the result set are trusted to be a low risk for infection by a computer virus by comparing virus status information associated with each of the first and second result records with a virus criterion, and wherein the virus criterion specifies at least one of whether a result record has ever been found to be infected by a computer virus, whether a result record has been found to be infected by a computer virus within a first predetermined time period, and whether a result record has been virus checked within a second predetermined time period.

3. A computer-implemented method of processing a search request, the method comprising:

accessing a computer database in response to a search request to generate a result set, the result set identifying a plurality of result records;

accessing virus status information associated with at least a portion of the plurality of result records; and

generating a display representation of at least a portion of the result set based upon the virus status information, wherein generating the display representation includes highlighting display information associated with a selected result record from the result set in the display representation based upon a risk the selected result record is infected by a computer virus as determined by the virus status information associated with the selected result record.

4. The method of claim 3, wherein highlighting display information associated with the selected result record from the result set in the display representation based upon the risk the selected result record is infected by a computer virus as determined by the virus status information associated with the selected result record includes highlighting display information associated with the selected result record from the result set in the display representation if the virus status information associated with the selected result record indicates that the selected result record is trusted to be a low risk for infection by a computer virus.

5. The method of claim 3, wherein highlighting display information associated with the selected result record from the result set in the display representation based upon the risk the selected result record is infected by a computer virus as determined by the virus status information associated with the selected result record includes highlighting display information associated with the selected result record from the result set in the display representation if the virus status information associated with the selected result record indicates that the selected result record is not trusted to be a low risk for infection by a computer virus.

6. The method of claim 3, wherein highlighting the display information associated with the selected result record includes displaying an icon proximate the display information associated with the selected result record.

7. The method of claim 3, further comprising displaying at least a portion of the virus status information associated with the selected result record in response to user input.

8. The method of claim 7, wherein displaying the virus status information includes displaying the virus status information in a pop-up window in response to user input directed to an icon displayed proximate the display information.

9. The method of claim 7, wherein displaying the virus status information includes displaying at least one of an infected file name and a timestamp that indicates when the selected result record was last checked for viruses.

10. The method of claim 3, further comprising determining whether a selected result record from the result set is trusted to be a low risk for infection by a computer virus by comparing virus status information associated with the selected result record with a virus criterion, and wherein the virus criterion specifies at least one of whether a result record has ever been found to be infected by a computer virus, whether a result record has been found to be infected by a computer virus within a first predetermined time period, and whether a result record has been virus checked within a second predetermined time period.

11. A method of generating search results, the method comprising:

receiving a search request from a client;

accessing a computer database in response to the search request to obtain a result set from the computer database, the result set identifying a plurality of result records from the computer database that match the search request;

returning at least a portion of the result set to the client in response to the search request; and

after obtaining the result set from the computer database and prior to returning the portion of the result set to the client, accessing virus status information associated with at least a portion of the plurality of result records in the result set and modifying the result set based upon the accessed virus status information.

12. The method of claim 11, wherein modifying the result set includes removing a selected result record from the result set if virus status information associated with the selected result record indicates that the selected result record is not trusted to be a low risk for infection by a computer virus.

13. The method of claim 11, wherein modifying the result set includes modifying a display representation of at least a portion of the result set to highlight display information associated with a selected result record from the result set in the display representation based upon a risk the selected result record is infected by a computer virus as determined by the virus status information associated with the selected result record.

14. The method of claim 13, wherein modifying the display representation includes highlighting display information associated with the selected result record from the result set in the display representation if the virus status information associated with the selected result record indicates that the selected result record is trusted to be a low risk for infection by a computer virus.

15. The method of claim 13, wherein modifying the display representation includes highlighting display information associated with the selected result record from the result set in the display representation if the virus status information associated with the selected result record indicates that the selected result record is not trusted to be a low risk for infection by a computer virus.

16. The method of claim 11, further comprising:

(a) performing virus checking for at least a portion of the records in the computer database to generate virus status information associated therewith; and

(b) storing the virus status information generated during virus checking within a virus database;

wherein accessing virus status information associated with the portion of the plurality of result records includes accessing the virus database.

17. The method of claim 16, wherein performing virus checking includes performing a crawling operation, the method further comprising performing virus checking for a selected record in the database in response to at least one of a modification to a file associated with the selected record and an expiration of a time period since the selected record was last virus checked.

18. The method of claim 16, wherein performing virus checking includes performing virus checking for at least a portion of the plurality of result records prior to generation of the result set.

19. The method of claim 16, wherein performing virus checking further includes performing virus checking in a plurality of computers, the method further comprising collecting virus status information from at least a portion of the plurality of computers.

20. The method of claim 19, wherein collecting virus status information further comprises authenticating the collected virus status information prior to storing the received virus status information in the virus database.

21. The method of claim 19, wherein performing virus checking in the plurality of computers includes performing virus checking in a client computer used by the client to issue the search request.

22. The method of claim 21, wherein performing virus checking includes performing virus checking on a selected file in the client computer responsive to a user request to retrieve the selected file.

23. The method of claim 19, further comprising:

sending a storage location identifier to a selected computer from the plurality of computers;

performing virus checking on a selected file identified by the storage location identifier to generate virus status information for the selected file; and

sending the virus status information associated for the selected file from the selected computer for inclusion in the virus database.

24. An apparatus for generating search results, comprising:

a program configured to process a search request by accessing a computer database in response to the search request to generate a result set that identifies a plurality of result records, accessing virus status information associated with at least a portion of the plurality of result records subsequent to generation of the result set, and generating a display representation of at least a portion of the result set based upon the virus status information, wherein the program is configured to generate the display representation by excluding from the display representation a first result record from the result set if virus status information associated with the first result record indicates that the first result record is not trusted to be a low risk for infection by a computer virus, and including in the display representation a second result record from the result set if virus status information associated with the second result record indicates that the second result record is trusted to be a low risk for infection by a computer virus; and

a computer recordable medium storing the program.

25. The apparatus of claim 24, further comprising at least one processor configured to execute the program.

26. An apparatus for generating search results, comprising:

a program configured to process a search request by accessing a computer database in response to the search request to generate a result set that identifies a plurality of result records, accessing virus status information associated with at least a portion of the plurality of result records, and generating a display representation of at least a portion of the result set based upon the virus status information, wherein the program is configured to generate the display representation by highlighting display information associated with a selected result record from the result set in the display representation based upon a risk the selected result record is infected by a computer virus as determined by the virus status information associated with the selected result record; and

a computer recordable medium storing the program.

27. The apparatus of claim 26, further comprising at least one processor configured to execute the program.

28. An apparatus for generating search results, comprising:

a program configured to process a search request by receiving a search request from a client, accessing a computer database in response thereto to obtain a result set therefrom that identifies a plurality of result records from the computer database that match the search request, and returning at least a portion of the result set to the client in response to the search request, wherein the program is further configured to, after obtaining the result set from the computer database and prior to returning the portion of the result set to the client, access virus status information associated with at least a portion of the plurality of result records in the result set and modify the result set based upon the accessed virus status information; and

a computer recordable medium storing the program.

29. The apparatus of claim 28, further comprising at least one processor configured to execute the program.

30. A computer-implemented method of building a virus database, the method comprising:

collecting virus status information generated by a plurality of remote parties, the virus status information generated by each of the plurality of remote parties associated with at least one file accessible by such remote party, and the virus status information associated with each file indicating whether such file is trusted to be a low risk for infection by a computer virus;

storing the collected virus status information for each file in a virus database; and

responding to a request for virus status information for a requested file by accessing the virus database to retrieve any virus status information associated with such requested file, wherein the request is issued on behalf of a different party from that which generated the virus status information for the requested file.

31. The method of claim 30, wherein at least one of the remote parties comprises a user of a search engine, wherein the virus status information generated by the user is performed by a user computer that is additionally configured to issue a search request via a web browser installed on such user computer, and to receive and display a display representation of a result set generated in response to the search request in the web browser.

32. The method of claim 30, wherein at least one of the remote parties comprises a third party, wherein the virus status information generated by the third party is performed by a computer that additionally hosts a web site.

33. The method of claim 30, wherein the virus database is a first computer database, the method further comprising:

accessing a second computer database in response to a search request to generate a result set, the result set identifying a plurality of result records;

accessing the virus database to retrieve virus status information associated with at least a portion of the plurality of result records; and

generating a display representation of at least a portion of the result set based upon the virus status information.

34. The method of claim 30, further comprising performing virus checking of a plurality of files during a crawling operation.

35. The method of claim 30, further comprises authenticating received virus status information prior to storing the collected virus status information in the virus database.

36. The method of claim 30, further comprising:

sending a storage location identifier to a selected party from the plurality of parties;

performing virus checking on a selected file identified by the storage location identifier to generate virus status information for the selected file; and

sending the virus status information for the selected file from the selected party for inclusion in the virus database.

37. An apparatus for building a virus database, comprising:

a program configured to collect virus status information generated by a plurality of remote parties and store the collected virus status information in a virus database, the virus status information generated by each of the plurality of remote parties associated with at least one file accessible by such remote party, and the virus status information associated with each file indicating whether such file is trusted to be a low risk for infection by a computer virus, wherein the program is further configured to respond to a request for virus status information for a requested file by accessing the virus database to retrieve any virus status information associated with such requested file, wherein the request is issued on behalf of a different party from that which generated the virus status information for the requested file; and

a computer recordable medium storing the program.

38. The apparatus of claim 37, further comprising at least one processor configured to execute the program.

39. The apparatus of claim 37, wherein at least one of the remote parties comprises a user of a search engine, wherein the virus status information generated by the user is performed by a user computer that is additionally configured to issue a search request via a web browser installed on such user computer, and to receive and display a display representation of a result set generated in response to the search request in the web browser.

40. The apparatus of claim 37, wherein at least one of the remote parties comprises a third party, wherein the virus status information generated by the third party is performed by a computer that additionally hosts a web site.

41. The apparatus of claim 37, wherein the virus database is a first computer database, and wherein the program is further configured to access a second computer database in response to a search request to generate a result set that identifies a plurality of result records, access the virus database to retrieve virus status information associated with at least a portion of the plurality of result records, and generate a display representation of at least a portion of the result set based upon the virus status information.

42. The apparatus of claim 37, wherein the program is further configured to perform virus checking of a plurality of files during a crawling operation.

43. The apparatus of claim 37, wherein the program is further configured to authenticate received virus status information prior to storing the collected virus status information in the virus database.

44. The apparatus of claim 37, wherein the program code is further configured to send a storage location identifier to a selected party from the plurality of parties such that virus checking is performed on a selected file identified by the storage location identifier to generate virus status information for the selected file.

45. A computer system, comprising:

a virus database;

a plurality of distributed computers configured to virus scan a plurality of files accessible to the plurality of computers and generate virus status information associated therewith that indicates whether the respective associated file is trusted to be a low risk for infection by a computer virus; and

a program configured to collect the virus status information generated by the plurality of distributed computers and stored the collected virus status information in the virus database, wherein the program is further configured to respond to a request for virus status information for a requested file by accessing the virus database to retrieve any virus status information associated with such requested file, wherein the request is issued on behalf of a different party computer from that which generated the virus status information for the requested file.

46. The computer system of claim 45, wherein at least one of the plurality of distributed computers comprises a user computer that is additionally configured to issue a search request via a web browser installed on such user computer, and to receive and display a display representation of a result set generated in response to the search request in the web browser.

47. The computer system of claim 46, further comprising a plugin coupled to the web browser on the user computer and configured to perform virus scanning and send virus status information to the program for inclusion in the virus database.

48. The computer system of claim 45, wherein at least one of the plurality of distributed computers comprises a third party computer that additionally hosts a web site.

49. The computer system of claim 45, wherein the program is further configured to send a storage location identifier to a selected computer from the plurality of distributed computers, and wherein the selected computer is configured to perform virus checking on a selected file identified by the storage location identifier to generate virus status information for the selected file, and to send the virus status information associated with the selected file from the selected computer for inclusion in the virus database.