System and method having an antivirus virtual scanning processor with plug-in functionalities

• US 7,188,369 B2
• Filed: 10/03/2002
• Issued: 03/06/2007
• Est. Priority Date: 10/03/2002
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Lo, Chien Ping, Ho, Chih-Kun
• Primary Examiner(s): Wright; Norman M.
• Application Number:
  US10/264,653
• Publication Number:
  US 20040068662A1
• Time in Patent Office: 1,615 Days
• Field of Search: 726/22, 726/24, 726/25, 726/23, 726/26
• US Class Current: 726/24
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

The invention generally provides an antivirus network system and method having a virtual scanning processor with plug-in functionalities. A preferred embodiment of the system according to the invention primarily comprises an antivirus scanning module operable with an operating system (OS), an antivirus database comprising a plurality of computer virus signatures, a library of external antivirus instructions wherein an antivirus system external to the network system is operable to update the external instructions, a virtual scanning processor further comprising a processor emulator operable to execute a plurality of internal antivirus instructions in detecting computer viruses based on the virus signatures, and a plug-in module connected to the processor emulator and the library and receiving the external instructions from the library, wherein the processor emulator is operable to execute the external instructions. The virtual scanning processor according to the invention is advantageously hardware-independent, i.e., is operable transparently to the hardware of a computer or network system. Moreover, the virtual scanning processor according to the invention is advantageously cross-platform, i.e., is operable transparently to, and regardless of the type of, the operating system (OS) it is operating in conjunction with.

Claims

1. A computer system comprising:

an antivirus scanning engine operable with an operating system (OS);

a virus signature database including a plurality of computer virus signatures;

a library of external antivirus functions, said library being arranged to be updated by an antivirus service provider external to said computer system; and

a scanning processor virtual machine including

a plurality of internal antivirus functions for detecting computer viruses based on said virus signatures;

a processor emulator operable to execute said internal antivirus functions and said external antivirus functions; and

a plug-in module connected to said processor emulator and to said library, said plug-in module being arranged to receive said external antivirus functions from said library and to deliver said external functions to said processor emulator for execution.

2. The computer system of claim 1 wherein execution of said internal antivirus functions and said external antivirus functions in said scanning processor virtual machine is independent of hardware in said computer system.

3. The computer system of claim 1 wherein execution of said internal antivirus functions and said external antivirus functions in said scanning processor virtual machine is independent of said operating system (OS).

4. The computer system of claim 1 wherein said virus signature database further includes computer virus pattern files.

5. The computer system of claim 1 wherein said external antivirus service provider provides an e-mail notification to said scanning processor virtual machine if there is an upgrade for said external instructions.

6. The computer system of claim 1 wherein said external antivirus service provider provides an automatic download to said scanning processor virtual machine if there is an upgrade for said external instructions.

7. The computer system of claim 1 wherein said external antivirus service provider provides an incremental download to said scanning processor virtual machine.

8. The computer system of claim 1 further comprising:

an Internet browser arranged to access said external antivirus service provider for upgrading said scanning processor virtual machine.

9. The computer system of claim 1 further comprising:

a Uniform Resource Locator (URL) arranged to access said library for upgrading said external instructions.

10. The computer system of claim 1 further comprising:

a Uniform Resource Locator (URL) arranged to access said virus signature database for upgrading said computer virus signatures.

11. An antivirus method for a computer system comprising:

operating an antivirus scanning engine within an operating system (OS), said scanning engine including a scanning processor virtual machine;

storing a plurality of computer virus signatures in a virus signature database;

storing a plurality of external antivirus functions in a library;

updating said external antivirus functions in said library with an antivirus service provider external to said computer system;

executing a plurality of internal antivirus functions in a processor emulator in said scanning processor virtual machine for detecting computer viruses in said computer system based on said virus signatures;

receiving said external functions from said library in a plug-in module connected to said processor emulator; and

executing said external functions in said processor emulator.

12. The method of claim 11 wherein said internal and external functions are executed independent of said operating system (OS).

13. The method of claim 11 wherein said internal and external functions are executed independent of hardware in said computer system.

14. The method of claim 11 further comprising:

storing computer virus pattern files in said virus signature database.

15. The method of claim 11 further comprising:

providing an e-mail notification to said scanning processor virtual machine if there is an upgrade for said external instructions.

16. The method of claim 11 further comprising:

providing an automatic download to said scanning processor virtual machine if there is an upgrade for said external instructions.

17. The method of claim 11 further comprising:

providing an incremental download to said scanning processor virtual machine.

18. The method of claim 11 further comprising:

providing an Internet browser arranged to access said external antivirus service provider for upgrading said scanning processor virtual machine.

19. The method of claim 11 further comprising:

providing Uniform Resource Locator (URL) arranged to access said library for upgrading said external instructions.

20. The method of claim 11 further comprising:

providing a Uniform Resource Locator (URL) arranged to access said virus signature database for upgrading said computer virus signatures.