Event reporting between a reporting computer and a receiving computer

• US 7,228,565 B2
• Filed: 05/15/2001
• Issued: 06/05/2007
• Est. Priority Date: 05/15/2001
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Tarbotton, Lee Codel Lawson, Wolff, Daniel Joseph, Moore, Edward
• Primary Examiner(s): Moise; Emmanuel L.
• Assistant Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US09/854,492
• Publication Number:
  US 20020174358A1
• Time in Patent Office: 2,212 Days
• Field of Search: 713/200, 713/188, 726/24
• US Class Current: 726/24
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

An event report, such as a virus detection event, is sent from a reporting computer 2 to a receiving computer 6 via an internet link 4. The report data may take the form of a URL requesting a web page 28 to be provided by the receiving computer 6, the URL bearing an encrypted form 24 of the report data that is used to identify the requested web page as well as pass further information to the receiving computer 6. Alternatively, the report data may be collated in the reporting computer 2 and passed to the receiving computer 6 when a computer virus definition data update is requested. The report data seeks to uniquely identify the event by incorporating the MAC address of the reporting computer 2, the date, time, computer product identifier, version identifier, update identifier and driver triggered. Additionally, a checksum derived from the infected file together with an indication of the corrective action, if any, taken by the reporting computer 2 may be included. The report data sent to the receiving computer 6 may be used to obtain real life information concerning the prevalence of particular viruses together with information characterising the anti-virus programs and their update status being employed by the user community.

Claims

1. A computer program product comprising a computer program operable to control a reporting computer to report occurrence of an event to a receiving computer, said computer program comprising:

report generating logic operable to generate report data identifying said reporting computer and said event;

data retrieving logic operable to fetch requested data from said receiving computer to said reporting computer upon a request of said reporting computer; and

report sending logic operable to send said report data from said reporting computer to said receiving computer during said fetch of said requested data;

wherein said data retrieving logic and said report sending logic use an interact URL to specify said requested data to said receiving computer, said internet URL specifying said requested data also containing said report data to be sent to said receiving computer;

wherein said report data includes;

an identifier of a set of event detecting data used by a computer program used by said reporting computer to detect said event and

a checksum of a file that triggered said event.

2. A computer program product as claimed in claim 1, wherein said event is detection of a computer file containing an unwanted computer program.

3. A computer program product as claimed in claim 2, wherein said unwanted computer program is a computer virus.

4. A computer program product as claimed in claim 1, wherein said requested data is a description of said event.

5. A computer program product as claimed in claim 1, wherein said event is detection of a computer file containing a computer virus and said requested data is a description of said computer virus.

6. A computer prepare product as claimed in claim 1, wherein said event is detection of a computer file containing a computer virus and said requested data is an updated set of computer virus detecting data for use in detecting computer viruses.

7. A computer program product as claimed in claim 1, wherein said reporting computer collates report data specifying one or more events that is sent together from said reporting computer to said receiving computer during said fetch of said requested data.

8. A computer program product as claimed in claim 1, wherein said report data is encrypted by said reporting computer and decrypted by said receiving computer.

9. A computer program product as claimed in claim 1, wherein said reporting computer and said receiving computer communicate via an internet link.

10. A computer program product as claimed in claim 1, wherein said report data further includes one or more of:

a MAC address identifying a network card of said reporting computer;

a date of said event;

a time of said event;

an identifier of a computer program used by said reporting computer to detect said event;

an identifier of a version of a computer program used by said reporting computer to detect said event;

an identifier of an event type detected by said reporting computer; and

an action taken by said reporting computer upon detection of said event.

11. A computer program product as claimed in claim 1, wherein said report data further includes:

a MAC address identifying a network card of said reporting computer;

a date of said event;

a time of said event;

an identifier of a computer program used by said reporting computer to detect said event;

an identifier of a version of a computer program used by said reporting computer to detect said event;

an identifier of an event type detected by said reporting computer; and

an action taken by said reporting computer upon detection of said event.

12. A computer program product as claimed in claim 1, wherein said interact URL includes a name of a script running on said receiving computer and encrypted report data.

13. A computer program product as claimed in claim 12, wherein said script decrypts said encrypted report data.

14. A computer program product as claimed in claim 1, wherein said report data includes an identifier of a driver triggered during said event.

15. A computer program claimed in claim 14, wherein said identifier of said driver is mapped to an identity of a virus that triggered mid event.

16. A computer program product as claimed in claim 1, wherein said UR.L is not displayed on said reporting computer.

17. A computer program product as claimed in claim 16, wherein said URL is in the form of a hypertext link that is associated with a description of said event.

18. A computer program product as claimed in claim 17, wherein selection of said hypertext link results in a URL request being passed to said receiving computer.

19. A computer program product comprising a computer program operable to control a receiving computer to receive a report of occurrence of an event from a reporting computer, said computer program comprising:

data request receiving logic operable to receive a request for requested data from said reporting computer;

data providing logic operable to provide said requested data to said reporting computer;

and

report receiving logic operable to receive report data identifying said reporting computer and said event from said reporting computer during providing of said requested data to said reporting computer;

wherein said data retrieving logic and said report sending logic use an interact URL to specify said requested data to said receiving computer, said internet URL specifying said requested data also containing said report data to be sent to said receiving computer;

wherein said report data includes;

an identifier of a set of event detecting data used by a computer program used by said reporting computer to detect said event and

a checksum of a file that triggered said event.

20. A computer program product as claimed in claim 19, wherein said event is detection of a computer file containing an unwanted computer program.

21. A computer program product as claimed in claim 20, wherein said unwanted computer program is a computer virus.

22. A computer program product as claimed in claim 19, wherein said requested data is a description of said event.

23. A computer program product as claimed in claim 19, wherein said event is detection of a computer file containing a computer virus and said requested data is a description of said computer virus.

24. A computer program product as claimed in claim 19, wherein said event is detection of a computer file containing a computer virus and said requested data is an updated set of computer virus detecting data for use in detecting computer viruses.

25. A computer program product as claimed in claim 19, wherein said report data specifies one or more events and is sent together from said reporting computer to said receiving computer during providing of said requested dam.

26. A computer program product as claimed in claim 19, wherein said report data is encrypted by said reporting computer and decrypted by said receiving computer.

27. A computer program product as claimed in claim 19, wherein said reporting computer and said receiving computer communicate via an internet link.

28. A computer program product as claimed in claim 19, wherein said report data further includes one or more of:

a MAC address identifying a network card of said reporting computer;

a date of said event;

a time of said event;

an identifier of a computer program used by said reporting computer to detect said event;

an identifier of a version of a computer program used by said reporting computer to detect said event;

an identifier of an event type detected by said reporting computer; and

an action taken by said reporting computer upon detection of said event.

29. A method of controlling a reporting computer to report occurrence of an event to a receiving computer, said method comprising the steps of:

generating report data identifying said reporting computer and said event;

fetching requested data from said receiving computer to said reporting computer upon a request of said reporting computer; and

sending said report data from said reporting computer to said receiving computer during fetching of said requested data;

wherein an interact URL is used to specify said requested data to said receiving computer, said internet URL specifying said requested data also containing said report data to be sent to said receiving computer;

wherein said report data includes;

an identifier of a set of event detecting data used by a computer program used by said reporting computer to detect said event and

a checksum of a file that triggered said event.

30. A method as claimed in claim 29, wherein said event is detection of a computer file containing an unwanted computer program.

31. A method as claimed in claim 30, wherein said unwanted computer program is a computer virus.

32. A method as claimed in claim 29, wherein said requested data is a description of said event.

33. A method as claimed in claim 29, wherein said event is detection of a computer file containing a computer virus and said requested data is a description of said computer virus.

34. A method as claimed in claim 29, wherein said event is detection of a computer file containing a computer virus and said requested data is an updated set of computer virus detecting data for use in detecting computer viruses.

35. A method as claimed in claim 29, wherein said reporting computer collates report data specifying one or more events that is sent together from said reporting computer to said receiving computer during fetching of said requested data.

36. A method as claimed in claim 29, wherein said report data is encrypted by said reporting computer and decrypted by said receiving computer.

37. A method as claimed in claim 29, wherein said reporting computer and said receiving computer communicate via an internet link.

38. A method as claimed in claim 29, wherein said report data further includes one or more of:

a MAC address identifying a network card of said reporting computer;

a date of said event;

a time of said event;

an identifier of a computer program used by said reporting computer to detect said event;

an identifier of a version of a computer program used by said reporting computer to detect said event;

an identifier of an event type detected by said reporting computer; and

an action taken by said reporting computer upon detection of said event.

39. A method of controlling a receiving computer to receive a report of occurrence of an event from a reporting computer, said method comprising the steps of:

receiving a request tot requested data from said reporting computer;

providing said requested data to said reporting computer; and

receiving report data identifying said reporting computer and said event from said reporting computer during providing of said requested data to said reporting computer;

wherein an internet URL is used to specify said requested data to said receiving computer, said interact URL specifying said requested data also containing said report data to be sent to said receiving computer;

wherein said report data includes;

an identifier of a set of event detecting data used by a computer program used by said reporting computer to detect said event and

a checksum of a file that triggered said event.

40. A method as claimed in claim 39, wherein said event is detection of a computer file containing an unwanted computer program.

41. A method as claimed in claim 40, wherein said unwanted computer program is a computer virus.

42. A method as claimed in claim 39, wherein said requested data is a description of said event.

43. A method as claimed in claim 39, wherein said event is detection of a computer file containing a computer virus and said requested data is a description of said computer virus.

44. A method as claimed in claim 39, wherein said event is detection of a computer file containing a computer virus and said requested data is an ,updated sot of computer virus detecting data for use in detecting computer viruses.

45. A method as claimed in claim 39, wherein said report data specifies one or more events and is sent together from said reporting computer to said receiving computer during providing of said requested data.

46. A method as claimed in claim 39, wherein said report data is encrypted by said reporting computer and decrypted by said receiving computer.

47. A method as claimed in claim 39, wherein said reporting computer and said receiving computer communicate via an internet link.

48. A method as claimed in claim 39, wherein said report data further includes one or more of:

a MAC address identifying a network card of said reporting computer;

a date of said event;

a time of said event;

an identifier of a computer program used by said reporting computer to detect said event;

an identifier of a version of a computer program used by said reporting computer to detect said event;

an identifier of an event type detected by said reporting computer; and

an action taken by said reporting computer upon detection of said event.

49. A reporting computer operable to report occurrence of an event to a receiving computer, said reporting computer comprising:

a report generator operable to generate report data identifying said reporting computer and said event;

a data retriever operable to fetch requested data from said receiving computer to said reporting computer upon a request of said reporting computer; and

a report sender operable to send said report data from said reporting computer to said receiving computer during said fetch of said requested data;

wherein an internet URL is used to specify said requested data to said receiving computer, said interact URL specifying said requested data also containing said report data to be sent to said receiving computer;

wherein said report data includes;

an identifier of a set of event detecting data used by a computer program used by said reporting computer to detect said event and

a checksum of a file that triggered said event.

50. A reporting computer as claimed in claim 49, wherein said event is detection of a computer file containing an unwanted computer program.

51. A reporting computer as claimed in claim 50, wherein said unwanted computer program is a computer virus.

52. A reporting computer as claimed in claim 49, wherein said requested data is a description of said event.

53. A reporting computer as claimed in claim 49, wherein said event is detection of a computer file containing a computer virus and said requested data is a description of said computer virus.

54. A reporting computer as claimed in claim 49, wherein said event is detection of a computer file containing a computer virus and said requested data is an updated set of computer virus detecting data for use in detecting computer viruses.

55. A reporting computer as claimed in claim 49, wherein said reporting computer generates report data specifying one or more events that is sent together from said reporting computer to said receiving computer during said fetch of said requested data.

56. A reporting computer as claimed in claim 49, wherein said report data is encrypted by said reporting computer and decrypted by said receiving computer.

57. A reporting computer as claimed in claim 49, wherein said reporting computer and said receiving computer communicate via an interact link.

58. A reporting computer as claimed in claim 49, wherein said report data further includes one or more of:

a MAC address identifying a network card of said reporting computer;

a date of said event;

a time of said event;

an identifier of a computer program used by said reporting computer to detect said event;

an identifier of a version of a computer program used by said reporting computer to detect said event;

an identifier of an event type detected by said reporting computer; and

an action taken by said reporting computer upon detection of said event.

59. A receiving computer operable to receive a report of occurrence of an event from a reporting computer, said receiving computer comprising:

a data request receiver operable to receive a request for requested data from said reporting computer;

a data provider operable to provide said requested data to said reporting computer; and

a report receiver operable to receive report data identifying said reporting computer and said event from said reporting computer during providing of said requested data to said reporting computer;

wherein an internet URL is used to specify said requested data to said receiving computer, said interact URL specifying said requested data also containing said report data to be sent to said receiving computer;

wherein said report data includes;

an identifier of a set of event detecting data used by a computer program used by said reporting computer to detect said event and

a checksum of a file that triggered said event.

60. A receiving computer as claimed ha claim 59, wherein said event is detection of a computer file containing an unwanted computer program.

61. A receiving computer as claimed in claim 60, wherein said unwanted computer program is a computer virus.

62. A receiving computer as claimed in claim 59, wherein said requested data is a description of said event.

63. A receiving computer as claimed in claim 59, wherein said event is detection of a computer file containing a computer virus and said requested data is a description of said computer virus.

64. A receiving computer as claimed in claim 59, wherein said event is detection of a computer file containing a computer virus and said requested data is an updated set of computer virus detecting data for use in detecting computer viruses.

65. A receiving computer as claimed in claim 59, wherein said report data specifies one or more events and is sent together from said reporting computer to said receiving computer during providing of said requested data.

66. A receiving computer as claimed in claim 59, wherein said report data is encrypted by said reporting computer and decrypted by said receiving computer.

67. A receiving computer as claimed in claim 59, wherein said reporting computer and said receiving computer communicate via an interact link.

68. A receiving computer as claimed in claim 59, wherein said report data further includes one or more of:

a MAC address identifying a network card of said reporting computer;

a date of said event;

a time of said event;

an identifier of a computer program used by said reporting computer to detect said event;

an identifier of a version of a computer program used by said reporting computer to detect said event;

an identifier of an event type detected by said reporting computer; and

an action taken by said reporting computer upon detection of said event.