Method and system for protecting against computer viruses

• US 7,424,609 B2
• Filed: 07/09/2004
• Issued: 09/09/2008
• Est. Priority Date: 07/11/2003
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Kwan, Tony
• Primary Examiner(s): Peeso; Thomas R
• Application Number:
  US10/888,738
• Publication Number:
  US 20050177868A1
• Time in Patent Office: 1,523 Days
• Field of Search: 713/161, 713/188, 713/189, 713/193, 713/194, 713/168
• US Class Current: 713/161
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for delivering an update to at least one user, including creating an electronic communication including an update and a unique signature identifying, the electronic communication as including the update and sending the electronic communication to the user.

Claims

1. A method for delivering an update to at least one user, comprising:

initiating, by a program provider, delivery of an update to at least one user;

creating an electronic communication comprising the update and a unique signature identifying said electronic communication as including said update; and

sending said electronic communication to said at least one user.

2. The method of claim 1, wherein said electronic communication is an email.

3. The method of claim 1, wherein said electronic communication is an instant message.

4. The method of claim 1, wherein said update includes one or more virus signatures.

5. The method of claim 1, wherein said update includes one or more heuristics.

6. The method of claim 1, wherein said update includes a program update.

7. A method for receiving an update, comprising:

receiving an electronic communication using a receiving unit;

scanning the electronic communication, using the receiving unit, for a unique signature, wherein the unique signature identifies that the electronic communication contains an update;

identifying whether said electronic communication includes the update;

passing the electronic communication to an applying unit capable of applying the update if the electronic communication has been identified as including an update; and

applying said update.

8. The method of claim 7, wherein said electronic communication is an email.

9. The method of claim 7, wherein said electronic communication is an instant message.

10. The method of claim 7, wherein said update includes one or more virus signatures.

11. The method of claim 7, wherein said update includes one or more heuristics.

12. The method of claim 7, wherein said update includes a program update.

13. A method for delivering an update to at least one user, comprising:

creating an electronic communication comprising an alert message, wherein the alert message comprises information about a virus outbreak; and

sending said electronic communication comprising said alert message to said at least one user.

14. The method of claim 13, wherein said alert message includes a link to an update.

15. The method of claim 14, wherein said update includes one or more virus signatures.

16. The method of claim 14, wherein said update includes one or more heuristics.

17. The method of claim 14, wherein said update includes a program update.

18. The method of claim 13, wherein said alert message includes instructions for obtaining an update.

19. The method of claim 18, wherein said update includes one or more virus signatures.

20. The method of claim 18, wherein said update includes one or more heuristics.

21. The method of claim 18, wherein said update includes a program update.

22. The method of claim 13, wherein said electronic communication additionally comprises a unique signature identifying said electronic communication as including said alert message.

23. The method of claim 13, wherein said electronic communication is an email.

24. The method of claim 13, wherein said electronic communication is an instant message.

25. A method for receiving an update, comprising:

receiving an electronic communication;

identifying whether said electronic communication includes an alert message, wherein the alert message comprises information about a virus outbreak; and

displaying said alert message.

26. The method of claim 25, wherein said alert message includes a link to an update.

27. The method of claim 26, wherein said update includes one or more virus signatures.

28. The method of claim 26, wherein said update includes one or more heuristics.

29. The method of claim 26, wherein said update includes a program update.

30. The method of claim 25, wherein said alert message includes instructions for obtaining an update.

31. The method of claim 30, wherein said update includes one or more virus signatures.

32. The method of claim 30, wherein said update includes one or more heuristics.

33. The method of claim 30, wherein said update includes a program update.

34. The method of claim 25, wherein said electronic communication additionally comprises a unique signature identifying said electronic communication as including said alert message.

35. The method of claim 25, wherein said electronic communication is an email.

36. The method of claim 25, wherein said electronic communication is an instant message.

37. A method for delivering a sample, comprising:

performing a heuristic virus scan on a sample;

creating an electronic communication comprising said sample when said sample is found to have at least a low risk of being infected by a malicious program; and

sending said electronic communication to a provider.

38. The method of claim 37, wherein said electronic communication is an email.

39. The method of claim 37, wherein said electronic communication is an instant message.

40. A system for delivering an update to at least one user, comprising:

a program provider being operable to initiate delivery of an update to at least one user;

a creating unit for creating an electronic communication comprising the update and a unique signature identifying said electronic communication as including said update; and

a sending unit for sending said electronic communication to said at least one user.

41. The system of claim 40, wherein said electronic communication is an email.

42. The system of claim 40, wherein said electronic communication is an instant message.

43. The system of claim 40, wherein said update includes one or more virus signatures.

44. The system of claim 40, wherein said update includes one or more heuristics.

45. The system of claim 40, wherein said update includes a program update.

46. A system for receiving an update, comprising:

a receiving unit for receiving an electronic communication and scanning the electronic communication for a unique signature, wherein the unique signature identifies that the electronic communication contains an update;

an identifying unit for identifying whether said electronic communication includes an update and passing the electronic communication to an applying unit; and

the applying unit for applying said update when said electronic communication has been identified as including an update.

47. The system of claim 46, wherein said electronic communication is an email.

48. The system of claim 46, wherein said electronic communication is an instant message.

49. The system of claim 46, wherein said update includes one or more virus signatures.

50. The system of claim 46, wherein said update includes one or more heuristics.

51. The system of claim 46, wherein said update includes a program update.

52. A system for delivering an update to at least one user, comprising:

a creating unit for creating an electronic communication comprising an alert message, wherein the alert message comprises information about a virus outbreak; and

a sending unit for sending said electronic communication comprising said alert message to said at least one user.

53. The system of claim 52, wherein said alert message includes a link to an update.

54. The system of claim 53, wherein said update includes one or more virus signatures.

55. The system of claim 53, wherein said update includes one or more heuristics.

56. The system of claim 53, wherein said update includes a program update.

57. The system of claim 52, wherein said alert message includes instructions for obtaining an update.

58. The system of claim 57, wherein said update includes one or more virus signatures.

59. The system of claim 57, wherein said update includes one or more heuristics.

60. The system of claim 57, wherein said update includes a program update.

61. The system of claim 52, wherein said electronic communication additionally comprises a unique signature identifying said electronic communication as including said alert message.

62. The system of claim 52, wherein said electronic communication is an email.

63. The system of claim 52, wherein said electronic communication is an instant message.

64. A system for receiving an update, comprising:

a receiving unit for receiving an electronic communication;

an identifying unit for identifying whether said electronic communication includes an alert message, wherein the alert message comprises information about a virus outbreak; and

a displaying unit for displaying said alert message.

65. The system of claim 64, wherein said alert message includes a link to an update.

66. The system of claim 65, wherein said update includes one or more virus signatures.

67. The system of claim 65, wherein said update includes one or more heuristics.

68. The system of claim 65, wherein said update includes a program update.

69. The system of claim 64, wherein said alert message includes instructions for obtaining an update.

70. The system of claim 69, wherein said update includes one or more virus signatures.

71. The system of claim 69, wherein said update includes one or more heuristics.

72. The system of claim 69, wherein said update includes a program update.

73. The system of claim 64, wherein said electronic communication additionally comprises a unique signature identifying said electronic communication as including said alert message.

74. The system of claim 64, wherein said electronic communication is an email.

75. The system of claim 64, wherein said electronic communication is an instant message.

76. A system for delivering a sample, comprising:

a performing unit for performing a heuristic virus scan on a sample;

a creating unit for creating an electronic communication comprising said sample when said sample is found to have at least a low risk of being infected by a malicious program; and

a sending unit for sending said electronic communication to a provider.

77. The system of claim 76, wherein said electronic communication is an email.

78. The system of claim 76, wherein said electronic communication is an instant message.

79. A computer system comprising:

a processor; and

a program storage device readable by the computer system, embodying a program of instructions executable by the processor to perform method steps for delivering an update to at least one user, the method comprising the following steps;

initiating, by a program provider, delivery of an update to at least one user;

creating an electronic communication comprising the update and a unique signature identifying said electronic communication as including said update; and

sending said electronic communication to said at least one user.

80. The computer system of claim 79, wherein said electronic communication is an email.

81. The computer system of claim 79, wherein said electronic communication is an instant message.

82. The computer system of claim 79, wherein said update includes one or more virus signatures.

83. The computer system of claim 79, wherein said update includes one or more heuristics.

84. The computer system of claim 79, wherein said update includes a program update.

85. A computer system comprising:

a processor; and

a program storage device readable by the computer system, embodying a program of instructions executable by the processor to perform method steps for receiving an update, the method comprising the following steps;

receiving an electronic communication using a receiving unit;

scanning the electronic communication, using the receiving unit, for a unique signature, wherein the unique signature identifies that the electronic communication contains an update;

identifying whether said electronic communication includes the update; and

passing the electronic communication to an applying unit capable of applying the update if the electronic communication has been identified as including an update; and

applying said update.

86. The computer system of claim 85, wherein said electronic communication is an email.

87. The computer system of claim 85, wherein said electronic communication is an instant message.

88. The computer system of claim 85, wherein said update includes one or more virus signatures.

89. The computer system of claim 85, wherein said update includes one or more heuristics.

90. The computer system of claim 85, wherein said update includes a program update.

91. A computer system comprising:

a processor; and

a program storage device readable by the computer system, embodying a program of instructions executable by the processor to perform method steps for delivering an update to at least one user, the method comprising the following steps;

creating an electronic communication comprising an alert message, wherein the alert message comprises information about a virus outbreak; and

sending said electronic communication comprising said alert message to said at least one user.

92. The computer system of claim 91, wherein said alert message includes a link to an update.

93. The computer system of claim 92, wherein said update includes one or more virus signatures.

94. The computer system of claim 92, wherein said update includes one or more heuristics.

95. The computer system of claim 92, wherein said update includes a program update.

96. The computer system of claim 91, wherein said alert message includes instructions for obtaining an update.

97. The computer system of claim 96, wherein said update includes one or more virus signatures.

98. The computer system of claim 96, wherein said update includes one or more heuristics.

99. The computer system of claim 96, wherein said update includes a program update.

100. The computer system of claim 91, wherein said electronic communication additionally comprises a unique signature identifying said electronic communication as including said alert message.

101. The computer system of claim 91, wherein said electronic communication is an email.

102. The computer system of claim 91, wherein said electronic communication is an instant message.

103. A computer system comprising:

a processor; and

a program storage device readable by the computer system, embodying a program of instructions executable by the processor to perform method steps for receiving an update, the method comprising the following steps;

receiving an electronic communication;

identifying whether said electronic communication includes an alert message, wherein the alert message comprises information about a virus outbreak; and

displaying said alert message.

104. The computer system of claim 103, wherein said alert message includes a link to an update.

105. The computer system of claim 104, wherein said update includes one or more virus signatures.

106. The computer system of claim 104, wherein said update includes one or more heuristics.

107. The computer system of claim 104, wherein said update includes a program update.

108. The computer system of claim 103, wherein said alert message includes instructions for obtaining an update.

109. The computer system of claim 108, wherein said update includes one or more virus signatures.

110. The computer system of claim 108, wherein said update includes one or more heuristics.

111. The computer system of claim 108, wherein said update includes a program update.

112. The computer system of claim 103, wherein said electronic communication additionally comprises a unique signature identifying said electronic communication as including said alert message.

113. The computer system of claim 103, wherein said electronic communication is an email.

114. The computer system of claim 103, wherein said electronic communication is an instant message.

115. A computer system comprising:

a processor; and

a program storage device readable by the computer system, embodying a program of instructions executable by the processor to perform method steps for delivering a sample, the method comprising the following steps;

performing a heuristic virus scan on a sample;

creating an electronic communication comprising said sample when said sample is found to have at least a low risk of being infected by a malicious program; and

sending said electronic communication to a provider.

116. The computer system of claim 115, wherein said electronic communication is an email.

117. The computer system of claim 115, wherein said electronic communication is an instant message.