Alternated update system and method

• US 7,549,169 B1
• Filed: 08/26/2004
• Issued: 06/16/2009
• Est. Priority Date: 08/26/2004
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Sobel, William E., McCorkendale, Bruce, Szor, Peter
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Baum; Ronald
• Application Number:
  US10/928,687
• Time in Patent Office: 1,755 Days
• Field of Search: 726/26
• US Class Current: 726/26
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method includes generating new update name lists and providing malicious code protection update information including the new update name lists to host computer systems. In one embodiment, the new update name lists are generated by registering domain names, and only a subset of the registered domain names are used to create an update name list provided to any one of the host computer systems.

Claims

1. A method comprising:

generating a plurality of different update name lists comprising;

registering domain names of sites from which malicious code protection update information can be obtained; and

selecting subsets of said registered domain names to create said different update names lists, each of said different update name lists comprising a subset of said registered domain names that is different than subsets of said registered domain names of the other of said different update name lists; and

providing said malicious code protection update information including said different update name lists to host computer systems, wherein different ones of said host computer systems receive different ones of said different update names lists, said malicious code protection update information for use by security applications of said host computer systems to detect malicious code on said host computer systems.

2. The method of claim 1 further comprising:

obtaining said malicious code protection update information including a new update name list, said new update name list being one of said different update name lists;

determining whether said malicious code protection update information includes said new update name list; and

modifying update settings of malicious code protection information with said new update name list.

3. The method of claim 2 wherein said malicious code protection information comprises outdated virus definitions and wherein said malicious code protection update information includes updated virus definitions, said method further comprising:

replacing said outdated virus definitions with said updated virus definitions; and

using said updated virus definitions with said security application on a host computer system to detect said malicious code on said host computer system.

4. The method of claim 2 wherein said update settings comprise settings for updating said malicious code protection information.

5. The method of claim 4 wherein an update settings file of said malicious code protection information comprises said update settings.

6. The method of claim 2 further comprising obtaining an update name from said new update name list.

7. The method of claim 6 further comprising resolving an IP address of said update name.

8. The method of claim 7 further comprising attempting to obtain malicious code protection update information from said IP address.

9. The method of claim 8 further comprising determining whether said attempt was successful.

10. The method of claim 9 wherein upon a determination that said attempt was not successful, said method further comprising determining whether an attempt to obtain said malicious code protection update information from every update name on said update name list has been attempted.

11. The method of claim 10 wherein upon a determination that an attempt to obtain said malicious code protection update information has not been made from at least one update name on said update name list, said method further comprising obtaining an unattempted update name from said update name list.

12. The method of claim 10 wherein upon a determination that an attempt to obtain malicious code protection update information from every update name on said update name list has been unsuccessfully made, said method further comprising providing an error notification.

13. The method of claim 1 wherein said domain names are registered periodically.

14. The method of claim 13 wherein said domain names are registered monthly.

15. The method of claim 1 wherein said domain names are used to identify the IP address of a malicious code protection update information server computer system.

16. The method of claim 1 wherein said subsets are randomly selected.

17. The method of claim 1 wherein said different update name lists are distributed randomly to said host computer systems.

18. The method of claim 1 wherein said different update name lists are distributed based on a country in which a host computer system is located.

19. The method of claim 1 wherein said malicious code protection update information is provided in encrypted form.

20. The method of claim 1 further comprising:

obtaining an update name from an update name list;

resolving an IP address of said update name;

obtaining said malicious code protection update information from a server computer system located at said IP address, said malicious code protection update information including a new update name list, said new update name list being one of said different update name lists; and

modifying update settings with said new update name list.

21. A system comprising:

a means for generating a plurality of different update name lists comprising;

a means for registering domain names of sites from which malicious code protection update information can be obtained; and

a means for selecting subsets of said registered domain names to create said different update names lists, each of said different update name lists comprising a subset of said registered domain names that is different than subsets of said registered domain names of the other of said different update name lists; and

a means for providing said malicious code protection update information including said different update name lists to host computer systems, wherein different ones of said host computer systems receive different ones of said different update names lists, said malicious code protection update information for use by security applications of said host computer systems to detect malicious code on said host computer systems;

a means for obtaining said malicious code protection update information including a new update name list, said new update name list being one of said different update name lists;

a means for determining whether said malicious code protection update information includes said new update name list; and

a means for modifying update settings of malicious code protection information with said new update name list.

22. A computer-program product comprising a computer readable storage medium containing computer program code comprising:

an alternated update application for generating a plurality of different update name lists comprising;

registering domain names of sites from which malicious code protection update information can be obtained; and

selecting subsets of said registered domain names to create said different update names lists, each of said different update name lists comprising a subset of said registered domain names that is different than subsets of said registered domain names of the other of said different update name lists; and

said alternated update application further for providing said malicious code protection update information including said different update name lists to host computer systems, wherein different ones of said host computer systems receive different ones of said different update names lists, said malicious code protection update information for use by security applications of said host computer systems to detect malicious code on said host computer systems;

said alternated update application further for obtaining said malicious code protection update information including a new update name list, said new update name list being one of said different update name lists;

said alternated update application further for determining whether said malicious code protection update information includes said new update name list; and

said alternated update application further for modifying update settings of malicious code protection information with said new update name list.

23. A computer system comprising:

a memory having stored therein an alternated update application; and

a processor coupled to said memory, wherein execution of said alternated update application generates a method comprising;

generating a plurality of different update name lists comprising;

registering domain names of sites from which malicious code protection update information can be obtained; and

selecting subsets of said registered domain names to create said different update names lists, each of said different update name lists comprising a subset of said registered domain names that is different than subsets of said registered domain names of the other of said different update name lists; and

providing said malicious code protection update information including said different update name lists to host computer systems, wherein different ones of said host computer systems receive different ones of said different update names lists, said malicious code protection update information for use by security applications of said host computer systems to detect malicious code on said host computer systems.