System, method, and computer program product for tailoring security responses for local and remote file open requests

• US 7,415,727 B1
• Filed: 06/24/2004
• Issued: 08/19/2008
• Est. Priority Date: 06/24/2004
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Edwards, Jonathan L., Lowe, Joseph C., Kumar, Srin N.
• Primary Examiner(s): LAFORGIA, CHRISTIAN A
• Application Number:
  US10/876,523
• Time in Patent Office: 1,517 Days
• Field of Search: 726/24, 713/188
• US Class Current: 726/24
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

A security system, method and computer program product are provided. In use, a request is received to open a file on a local computer. Thereafter, it is determined whether the request is received from a local process operating on a local computer or from a remote computer, so that such determination may be used for security purposes.

Claims

1. A security method, comprising:

receiving a request to open a file on a local computer;

determining whether the request is a local request received from a local process operating on the local computer or a remote request received from a remote computer coupled to the local computer via a network, by identifying a thread associated with the request and determining whether a start address of code associated with the thread is within a kernel component; and

categorizing the request as a remote request received via the network or a local request received locally based on the determination;

wherein the remote request is handled with more scrutiny with respect to the local request by at least one of denying the remote request to open the file and utilizing more virus signatures during scanning.

2. The method as recited in claim 1, wherein the kernel component is a component of the local computer and handles the request if the request is received from the remote computer via a network, and the determination is carried out utilizing the kernel component.

3. The method as recited in claim 2, wherein the kernel component includes a srv.sys file.

4. The method as recited in claim 2, wherein the kernel component creates a plurality of threads to process a plurality of the requests received from a plurality of the remote computers via the network.

5. The method as recited in claim 1, wherein the thread associated with the request identified utilizing a virus scanner.

6. The method as recited in claim 1, wherein the request is handled based on the determination for tailoring the handling in accordance with the type of the request.

7. The method as recited in claim 1, wherein access to the file is conditionally given based on the determination.

8. The method as recited in claim 1, wherein the security method is utilized to counter terrorism by preventing infection of cyber-frameworks with malware initiated by terrorists.

9. The method as recited in claim 1, wherein the remote request is handled with more scrutiny by preventing the remote request from changing any executable while only preventing the local request from changing an executable associated with an operating system.

10. A security method, comprising:

receiving a request to open a file on a local computer;

determining whether the request is a local request received from a local process operating on the local computer or a remote request received from a remote computer coupled to the local computer via a network;

wherein the remote request is handled with more scrutiny with respect to the local request by at least one of denying the remote request to open the file and utilizing more virus signatures during scanning;

wherein a kernel component of the local computer handles the request if the request is received from the remote computer via a network, and the determination is carried out utilizing the kernel component;

wherein the kernel component creates a plurality of threads to process a plurality of the requests received from a plurality of the remote computers via the network;

wherein at least one of the threads associated with the requests is identified utilizing a virus scanner;

wherein the virus scanner obtains a start address of code associated with the identified thread.

11. The method as recited in claim 10, wherein the virus scanner determines whether the start address is within the kernel component.

12. The method as recited in claim 11, wherein, if it is determined that the start address is within the kernel component, the associated request is categorized as a request received via the network.

13. The method as recited in claim 12, wherein, if it is determined that the start address is not within the kernel component, the associated-request is categorized as a request received locally.

14. The method as recited in claim 13, wherein the requests received via the network are handled utilizing a first process associated with the virus scanner.

15. The method as recited in claim 14, wherein the requests received locally are handled utilizing a second process associated with the virus scanner.

16. A security computer program product embodied on a computer readable medium, comprising:

computer code for receiving a request to open a file on a local computer;

computer code for determining whether the request is a local request received from a local process operating on the local computer or a remote request received from a remote computer coupled to the local computer via a network, by identifying a thread associated with the request and determining whether a start address of code associated with the thread is within a kernel component;

computer code for categorizing the request as a remote request received via the network or a local request received locally based on the determination; and

computer code for scanning the file based on the determination for tailoring the scanning in accordance with the type of the request;

wherein the remote request is handled with more scrutiny with respect to the local request by at least one of denying the remote request to open the file and utilizing more virus signatures during scanning.

17. A security system, comprising:

means for receiving a request to open a file on a local computer;

means for determining whether the request is a local request received from a local process operating on the local computer or a remote request received from a remote computer coupled to the local computer via a network, by identifying a thread associated with the request and determining whether a start address of code associated with the thread is within a kernel component;

means for categorizing the request as a remote request received via the network or a local request received locally based on the determination; and

means for scanning the file based on the determination for tailoring the scanning in accordance with the type of the request;

wherein the remote request is handled with more scrutiny with respect to the local request by at least one of denying the remote request to open the file and utilizing more virus signatures during scanning.

18. A security system, comprising:

a virus scanner adapted for determining whether a request to open a file on a local computer is a local request received from a local process operating on the local computer or a remote request received from a remote computer coupled to the local computer via a network, by identifying a thread associated with the request and determining whether a start address of code associated with the thread is within a kernel component;

wherein the virus scanner is further adapted to categorize the request as a remote request received via the network or a local request received locally based on the determination;

wherein the file is scanned based on the determination for tailoring the scanning in accordance with the type of the request;

wherein the remote request is handled with more scrutiny with respect to the local request by at least one of denying the remote request to open the file and utilizing more virus signatures during scanning.

19. A security method, comprising:

receiving a plurality of requests to open files on a local computer, wherein the requests received via a network are handled by a kernel component which creates a plurality of threads to process the requests received from the network;

intercepting the requests, utilizing a virus scanner;

identifying one of the threads associated with one of the requests, utilizing the virus scanner;

obtaining a start address of code associated with the identified thread, utilizing the virus scanner;

determining whether the start address is within the kernel component;

if it is determined that the start address is within the kernel component, categorizing the associated request as a remote request received via the network;

if it is determined that the start address is not within the kernel component, categorizing the associated request as a local request received locally;

scanning the files based on the determination for tailoring the scanning in accordance with the type of the request;

wherein the remote request is handled with more scrutiny with respect to the local request by at least one of denying the remote request to open the files and utilizing more virus signatures during scanning.