Maintaining virus detection software

• US 7,266,845 B2
• Filed: 08/20/2001
• Issued: 09/04/2007
• Est. Priority Date: 08/31/2000
• Status: Active Grant

• Current Assignee: Withsecure Corporation
• Original Assignee: F-Secure Oyj
• Inventors: Hyppönen, Ari
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Baum; Ronald
• Application Number:
  US10/362,828
• Publication Number:
  US 20040083384A1
• Time in Patent Office: 2,206 Days
• Field of Search: None
• US Class Current: 726/24
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

A method of managing a virus signature database associated with an anti-virus application, both of which are resident in a memory of a mobile wireless device 2,4. Management messages containing for example new virus signatures are sent from the network 1 to the device 2,4. In accordance with instructions contained in the management messages, individual signature entries of the virus signature database are deleted or replaced, and new signatures added.

Claims

1. A method of managing a virus signature database associated with an anti-virus application, both of which are resident in a memory of a mobile wireless computer device, the method comprising:

receiving management messages over the wireless interface, the management messages containing respective add, delete, or replace virus signature instructions for adding, deleting and replacing individual signature entries of the virus signature database to maintain the effectiveness of the database;

wherein the method further comprises filtering the management messages either at the origin side of the wireless interface, prior to transmission over the wireless interface, or following receipt at a mobile device, to allow only messages relevant to a particular device or software installed on that device to be sent to that device or to be acted upon at the device.

2. A method according to claim 1, wherein in the case of an add or replace signature instruction, the message is accompanied by a new signature.

3. A method according to claim 1, wherein management messages are accompanied by respective sequence numbers and the anti-virus application, or a management agent, resident in the memory of the wireless device uses the sequence number of a received management message to determine whether or not one or more preceding management messages have not been received.

4. A method according to claim 3, wherein, if it is determined that a management message has not been received, the application or agent requests that message via the wireless interface.

5. A method according claim 1, wherein said mobile wireless device is a cellular communication device having an interface for allowing the device to communicate with a cellular telecommunications network.

6. A mobile wireless computer device having a memory and an anti-virus software application resident in the memory, the memory also containing an anti-virus signature database accessible in use by the anti-virus application, the device comprising:

a receiver for receiving management messages over a wireless interface, the management messages containing respective add, delete, or replace virus signature instructions for adding, deleting and replacing individual signature entries of the virus signature database to maintain the effectiveness of the database;

filtering means for filtering the management messages to allow only messages relevant to the device or software installed on the device to be acted upon at the device; and

processing means for adding, deleting, or replacing individual signature entries of the virus signature database.

7. A method of managing a virus signature database associated with an anti-virus application, both of which are resident in a memory of a mobile wireless device, the method comprising receiving management messages, relating to database or anti-virus application changes, at the device, the management messages being filtered either at the origin side of the wireless interface or at the mobile device to pass only messages relevant to the recipient device.

8. A method according to claim 7, wherein the filter at the mobile device or at the origin side of the wireless interface has a knowledge of the properties of the mobile device or of the software applications resident on the mobile device.

9. A method according to claim 7, wherein the filter exists at the origin side of the wireless interface, and properties of the mobile device or of the software applications resident on the mobile device are sent to the filter from the mobile device.

10. A method according to claim 7, wherein the management messages contain the identity of mobile devices or applications to which they are relevant, such that the filter may compare the applicability of messages to the properties/resident software of destination mobile devices.

11. A method of scanning information for the presence of a virus, the method comprising extracting predetermined virus signatures from a virus signature database and sequentially searching for the presence of signatures in the information, wherein the database contains for each of one or more viruses a plurality of signatures, and indicating the presence or absence of each of said one or more viruses based on a combination of the results of the plurality of searches.