Protecting a computer coupled to a network from malicious code infections

• US 7,373,667 B1
• Filed: 05/14/2004
• Issued: 05/13/2008
• Est. Priority Date: 05/14/2004
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Millard, John
• Primary Examiner(s): Sheikh; Ayaz
• Assistant Examiner(s): CHEN, SHIN HON
• Application Number:
  US10/846,109
• Time in Patent Office: 1,460 Days
• Field of Search: 726/26, 726/24, 709/227, 707/10, 713/152, 713/188
• US Class Current: 726/24
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2221/2123 Dummy operation
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic

Abstract

Computer implement methods, apparati, and computer-readable media for enabling a first computer (12) to determine that it is safe to communicate with a second computer (10) coupled to the first computer (12) over a network (15). In a method embodiment of the present invention, the first computer (12) detects (21) that the second computer (10) has initiated a test open of a file (14) associated with the first computer (12). When the test open is followed by an actual open command by which the second computer (10) seeks to actually open the same file (14), the first computer (12) determines (23) that it is safe to communicate with the second computer (10).

Claims

1. A computer implemented method by which a first computer determines that it is safe to communicate with a second computer coupled to the first computer over a network, said method comprising the steps of the first computer:

detecting that the second computer has initiated a test open of a first file stored in association with the first computer;

sending to the second computer a message conveying information pertaining to malicious code scanning capabilities of the first computer;

detecting an actual open command for the first file from the second computer responsive to second computer determining that the first computer has acceptable malicious code scanning capabilities;

detecting a malicious code scan of the first file conducted over the network by the second computer responsive to the second computer determining that first computer does not contain malicious code scanning capabilities;

detecting an actual open command for the first file from the second computer when the malicious code scan of the first file over the network indicates that the first file does not contain malicious code; and

when the test open is followed by an actual open command from the second computer seeking to actually open the first file, determining that it is safe to communicate with the second computer.

2. The method of claim 1 wherein determining it is safe to communicate comprises allowing the actual open to proceed.

3. The method of claim 1 wherein the step of detecting a test open comprises observing that the second computer is requesting to open a dummy file having a pathname consisting of the pathname of said first file, plus a tag appended to said first file pathname.

4. The method of claim 3 wherein the tag comprises a globally unique identifier for the second computer and a date of last updating malicious code definitions within a malicious code scanning module associated with the second computer.

5. The method of claim 3 wherein the tag comprises at least one of:

an acceptable heuristic level for malicious code scans;

an acceptable definition window for malicious code scans;

name of the second computer; and

IP address of the second computer.

6. The method of claim 1 wherein, when the test open is not followed by an actual open command from the second computer seeking to actually open the first file, the first computer limits subsequent communications with the second computer.

7. The method of claim 1 wherein the message is sent from the first computer to the second computer over a file open channel.

8. The method of claim 1 wherein the message is sent from the first computer to the second computer over a channel other than a file open channel.

9. The method of claim 8 wherein the channel used for the message uses at least one of TCP, UDP, ICMP, DCOM, WMI, SNMP, and RPC.

10. The method of claim 1 wherein the message contains information as to whether the first computer has malicious code scanning means and whether definitions associated with said scanning means are at least as new as definitions associated with a malicious code scanning module associated with the second computer.

11. The method of claim 1 further comprising the step of the second computer decoding the message.

12. The method of claim 1 wherein the second computer issues an actual open command to actually open the first file when the message reveals that the first computer has malicious code scanning capabilities deemed to be acceptable according to pre-established acceptability criteria.

13. The method of claim 1 wherein the second computer conducts a malicious code scan of the first file over the network when the message reveals that the first computer does not contain malicious code scanning capabilities deemed to be acceptable according to pre-established acceptability criteria.

14. The method of claim 13 wherein, when the malicious code scan of the first file done over the network indicates that the first file may contain malicious code, the second computer performs at least one defensive measure from the group of measures comprising:

a false positive mitigation technique;

verification that malicious code is in fact present within the first file;

an alert to a system administrator;

aborting the opening of the first file;

quarantining the first file;

sending the first file to an antivirus research center;

precluding subsequent downloads from the first computer;

initiating an investigation as to why the first computer may have become infected with malicious code.

15. The method of claim 1 wherein the first computer asynchronously starts a scan of the first file when the first computer detects the test open.

16. The method of claim 1 wherein the first computer authenticates the second computer prior to detecting that the second computer has initiated has initiated a test open.

17. The method of claim 16 wherein the authentication is performed using public key cryptography.

18. The method of claim 16 wherein the authentication is performed by the first and second computers trading a malicious code fragment for a malicious code identifier.

19. The method of claim 18 wherein the first computer sends the malicious code fragment to the second computer, and the second computer sends the malicious code identifier to the first computer.

20. The method of claim 18 wherein the first computer sends the malicious code identifier to the second computer, and the second computer sends the malicious code fragment to the first computer.

21. The method of claim 18 wherein the malicious code fragment is augmented by a husk and subjected to a malicious code scan.

22. The method of claim 18 wherein the malicious code fragment is matched to the malicious code identifier via a malicious code scan interface.

23. The method of claim 1, further comprising the step of the first computer scanning the first file for the presence of malicious code when the test open discloses that the first computer has an acceptable malicious code scanning means.

24. Apparatus associated with a first computer desiring to communicate safely with a second computer coupled to the first computer over a network, said apparatus comprising:

test open detecting means for detecting that the second computer has initiated a test open of a file stored in association with the first computer;

coupled to the test open detecting means, sending means for sending to the second computer a message conveying information pertaining to malicious code scanning capabilities of the first computer;

coupled to the sending means, observing means for observing an actual open command for the first file from the second computer to actually open the same file responsive to second computer determining that the first computer has acceptable malicious code scanning capabilities;

coupled to the sending means, code scan detecting means for detecting a malicious code scan of the first file conducted over the network by the second computer responsive to the second computer determining that first computer does not contain malicious code scanning capabilities;

coupled to the code scan detecting means second observing means for observing an actual open command for the first file from the second computer to actually open the same file when the malicious code scan of the first file over the network indicates that the first file does not contain malicious code; and

coupled to the second observing means, safety means for determining that it is safe to communicate with the second computer.

25. A computer-readable medium containing computer program instructions for enabling a first computer to determine that it is safe to communicate with a second computer coupled to the first computer over a network, said computer program instructions performing the steps of:

detecting that the second computer has initiated a test open of a first file stored in association with the first computer;

sending to the second computer a message conveying information pertaining to malicious code scanning capabilities of the first computer;

detecting an actual open command for the first file from the second computer responsive to second computer determining that the first computer has acceptable malicious code scanning capabilities;

detecting a malicious code scan of the first file conducted over the network by the second computer responsive to the second computer determining that first computer does not contain malicious code scanning capabilities;

detecting an actual open command for the first file from the second computer when the malicious code scan of the first file over the network indicates that the first file does not contain malicious code; and

when the test open is followed by an actual open command from the second computer seeking to actually open the first file, determining that it is safe to communicate with the second computer.