Security and software testing of pre-release anti-virus updates on client and transmitting the results to the server

• US 7,231,637 B1
• Filed: 07/26/2001
• Issued: 06/12/2007
• Est. Priority Date: 07/26/2001
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: McEwan, William Alexander
• Primary Examiner(s): INGBERG, TODD D
• Application Number:
  US09/916,609
• Time in Patent Office: 2,147 Days
• Field of Search: 717168-178, 717124-127, 713/1, 713/2, 713/100, 713/170, 713187-189, 713/191, 713/200, 713/201
• US Class Current: 717/171
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

A system, method and computer program product for testing scanner updates. Initially, a full-release scanner update is distributed from a server to a plurality of computers utilizing a network. A pre-release scanner update is also distributed from the server to the computers utilizing the network. The full-release scanner update is executed on the computers for security scanning. Further, the pre-release scanner update is executed on the computers for testing purposes. Results of the testing are transmitted from the computers to the server utilizing the network.

Claims

1. A method for testing scanner updates executing on a computer including computer readable medium, comprising:

(a) distributing a full-release scanner update from a server to a plurality of computers utilizing a network;

(b) distributing a pre-release scanner update from the server to the computers utilizing the network;

(c) executing the full-release scanner update on the computers for security scanning;

(d) executing the pre-release scanner update on the computers for testing purposes;

(e) transmitting results of the testing from the computers to the server utilizing the network; and

(f) utilizing the results to modify the pre-release scanner update before releasing the pre-release scanner update as a full-release scanner update.

2. The method as recited in claim 1, wherein the full-release scanner update and the pre-release scanner update are distributed simultaneously.

3. The method as recited in claim 1, wherein the full-release scanner update and the pre-release scanner update are distributed together.

4. The method as recited in claim 1, wherein the pre-release scanner update is distributed on a periodic basis.

5. The method as recited in claim 1, wherein the pre-release scanner update is distributed with virus signatures.

6. The method as recited in claim 1, and further comprising automatically determining whether a pre-release scanner update exists, and conditionally distributing the pre-release scanner update from the server if the pre-release scanner update exists.

7. The method as recited in claim 1, wherein the pre-release scanner update is executed when the computers are idle.

8. The method as recited in claim 1, wherein the pre-release scanner update is executed automatically when the computers are idle.

9. The method as recited in claim 1, wherein the results are transmitted to a quality assurance administrator.

10. The method as recited in claim 1, and further comprising comparing results of the execution of the full-release scanner update and the pre-release scanner update.

11. The method as recited in claim 10, wherein the comparison occurs on the computers.

12. The method as recited in claim 11, and further comprising transmitting results of the comparison from the computers to the server utilizing the network.

13. The method as recited in claim 10, and further comprising determining whether a virus is detected by the execution of the pre-release scanner update and not the full-release scanner update based on the comparison.

14. The method as recited in claim 13, and further comprising removing the virus.

15. The method as recited in claim 13, and further comprising storing a record of the virus.

16. The method as recited in claim 13, and further comprising reporting the virus.

17. The method as recited in claim 1, wherein the network includes the Internet.

18. The method as recited in claim 1, and further comprising detecting faults associated with the execution of the pre-release scanner update.

19. The method as recited in claim 18, and further comprising transmitting a record of the faults from the computers to the server utilizing the network.

20. The method as recited in claim 18, and further comprising ceasing the execution of the pre-release scanner update on the computers in response to the detection of the faults.

21. The method as recited in claim 20, and further comprising re-executing the pre-release scanner update on the computers after ceasing the execution.

22. The method as recited in claim 18, and further comprising counting a number of the faults, and conditionally terminating the pre-release scanner update on the computers based on the number.

23. The method as recited in claim 22, wherein the faults include at least one of delays, failures, crashes, and false alarms.

24. The method as recited in claim 1, and further comprising detecting a duration of the execution of the pre-release scanner update.

25. The method as recited in claim 24, and further comprising transmitting a record of the duration from the computers to the server utilizing the network.

26. The method as recited in claim 1, further comprising recording operations of the full-release scanner update during the execution of the full-release scanner update.

27. The method as recited in claim 26, wherein the recorded operations are performed by the pre-release scanner update during the execution of the pre-release scanner update.

28. The method as recited in claim 26, wherein the operations are recorded in a queue.

29. The method as recited in claim 26, wherein results of the operations during the execution of the full-release scanner update and the pre-release scanner update are compared.

30. A computer program product for testing scanner updates, comprising:

(a) computer code for distributing a full-release scanner update from a server to a plurality of computers utilizing a network;

(b) computer code for distributing a pre-release scanner update from the server to the computers utilizing the network;

(c) computer code for executing the full-release scanner update on the computers for security scanning;

(d) computer code for executing the pre-release scanner update on the computers for testing purposes; and

(e) computer code for transmitting results of the testing from the computers to the server utilizing the network;

(f) wherein a result of code execution is stored on a computer readable medium.

31. A system for testing scanner updates, comprising:

(a) logic for distributing a full-release scanner update from a server to a plurality of computers utilizing a network;

(b) logic for distributing a pre-release scanner update from the server to the computers utilizing the network;

(c) logic for executing the full-release scanner update on the computers for security scanning;

(d) logic for executing the pre-release scanner update on the computers for testing purposes; and

(e) logic for transmitting results of the testing from the computers to the server utilizing the network;

(f) wherein a result of system execution is stored on a computer readable medium.

32. A server-based method for testing scanner updates executing on a computer including computer readable medium, comprising:

(a) distributing a full-release scanner update from a server to a plurality of computers utilizing a network;

(b) distributing a pre-release scanner update from the server to the computers utilizing the network;

(c) receiving results of the execution of the full-release scanner update and the pre-release scanner update from the computers;

(d) modifying the pre-release scanner update before releasing the pre-release scanner update as a full-release scanner update based on the results.

33. A client-based method for testing scanner updates executing on a computer including computer readable medium, comprising:

(a) receiving from a server a full-release scanner update at a computer utilizing a network;

(b) receiving from the server a pre-release scanner update at the computer utilizing the network;

(c) executing the full-release scanner update on the computer for security scanning;

(d) executing the pre-release scanner update on the computer for testing purposes;

(e) transmitting results of the testing from the computer to the server utilizing the network; and

(f) utilizing the results to modify the pre-release scanner update before releasing the pre-release scanner update as a full-release scanner update.

34. A method for testing scanner updates executing on a computer including computer readable medium, comprising:

(a) distributing a full-release scanner update from a server to a plurality of computers utilizing a network;

(b) distributing a pre-release scanner update from the server to the computers simultaneously with the full-release update utilizing the network;

(c) executing the full-release scanner update on the computers for security scanning;

(d) determining whether the computers are idle;

(e) automatically executing the pre-release scanner update on the computers for testing purposes upon the computers being determined to be idle;

(f) comparing results of the execution of the full-release scanner update and the pre-release scanner update;

(g) determining whether a virus is detected by the execution of the pre-release scanner update and not by the full-release scanner update based on the comparison;

(h) storing a record of the detected virus;

(i) removing the detected virus;

(j) detecting faults associated with the execution of the pre-release scanner update;

(k) ceasing the execution of the pre-release scanner update on the computers in response to the detection of at least one fault;

(l) re-executing the pre-release scanner update on the computers after ceasing the execution;

(m) counting a number of the faults;

(n) conditionally re-executing the pre-release scanner update on the computers if the number exceeds a predetermined number within a predetermined amount of time;

(o) storing a record of the faults;

(p) transmitting results relating to the viruses and faults from the computers to the server utilizing the network; and

(q) modifying the pre-release scanner update at the server before releasing the pre-release scanner update as a full-release scanner update based on the results.