Computer virus protection

• US 7,979,691 B2
• Filed: 02/25/2009
• Issued: 07/12/2011
• Est. Priority Date: 06/22/2000
• Status: Expired due to Term

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Original Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC)
• Inventors: Hook, Robert G., Carrera, Marcelo, Stewart, Walter Mason
• Primary Examiner(s): Parthasarathy; Pramila
• Application Number:
  US12/392,768
• Publication Number:
  US 20090165138A1
• Time in Patent Office: 867 Days
• Field of Search: None
• US Class Current: 713/152
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: H04L 51/066 Format adaptation, e.g. format conversion or compression
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A network is protected from e-mail viruses through the use of a sacrificial server. Any executable program or other suspicious parts of incoming e-mail messages are forwarded to a sacrificial server, where they are converted to non-executable format such as Adobe Acrobat PDF and sent to the recipient. The sacrificial server is then checked for virus activity. After the execution is completed, the sacrificial server is rebooted.

Claims

1. A method comprising:

receiving a message containing a virus comprising executable code;

converting the executable code from an executable format to a non-executable format, such that the virus is rendered inoperable, using an application-level process that retains semantic content of the message; and

forwarding the non-executable format over a network to a target recipient of the message.

2. The method of claim 1, wherein the executable code is at least one of compiled code, interpretive code, and markup language code.

3. The method of claim 1, wherein the executable code is contained in a body of the message.

4. The method of claim 3, wherein the executable code comprises a hypertext link.

5. The method of claim 4, wherein the converting comprises deactivating the hypertext link.

6. The method of claim 5, wherein the deactivated link is identifiable as a hypertext link.

7. The method of claim 1, wherein the executable code is contained in an attachment.

8. The method of claim 7, wherein the converting comprises:

forwarding the executable code to a sacrificial server to convert the executable code from the executable format to the non-executable format; and

receiving from the sacrificial server the non-executable format.

9. The method of claim 8, wherein the converting further comprises examining the sacrificial server for virus activity.

10. The method of claim 9, wherein the converting further comprises:

rebooting the sacrificial server from a safe copy of an operating system obtained from a read-only device.

11. The method of claim 9, wherein communications with the sacrificial server are authenticated using a challenge and response technique.

12. The method claim 8, wherein the converting further comprises:

disconnecting a data link to the sacrificial server after the forwarding the executable code to the sacrificial server; and

establishing the data link to the sacrificial server before the receiving the non-executable format from the sacrificial server.

13. The method of claim 7, wherein the converting comprises:

maintaining a list of approved attachment types;

determining whether the attachment is of a type which is in the list of approved attachment types; and

if the attachment is not of a type which is in the list of approved attachment types, informing the target recipient that a message containing a non-approved attachment has been received.

14. The method of claim 1, wherein the converting comprises:

maintaining a list of approved executable code;

determining whether the executable code is in the list of approved executable code; and

deactivating the executable code if the executable code is not in the list of approved executable code.

15. The method of claim 14, wherein:

the list of approved executable code includes information for determining whether the approved executable code has been altered; and

the converting further comprises;

determining whether the executable code has been altered; and

deactivating the executable code if the executable code has been altered.

16. The method of claim 15, wherein the determining whether the executable code has been altered is performed through an algorithmic technique.

17. The method of claim 16, wherein the algorithmic technique is at least one of a check-summing technique and a hashing technique.

18. The method of claim 1, wherein the message is an e-mail message.

19. The method of claim 1, wherein the non-executable format is an image format.

20. The method of claim 1, wherein converting the executable code comprises:

forming a first copy and a second copy of at least a portion of the message containing the executable code;

executing the executable code in the first copy but not the second copy; and

after the executable code in the first copy has been executed, comparing the first copy to the second copy to determine an effect of the executable code.

21. A system comprising:

means for receiving a message containing a virus comprising executable code;

means for converting the executable code from an executable format to a non-executable format, such that the virus is rendered inoperable, using an application-level process that retains semantic content of the message; and

means for forwarding the non-executable format over a network to a target recipient of the message.

22. The system of claim 21, wherein the executable code is at least one of compiled code, interpretive code, and markup language code.

23. The system of claim 21, wherein the executable code is contained in a body of the message.

24. The system of claim 23, wherein the executable code comprises a hypertext link.

25. The system of claim 24, wherein the means for converting comprises means for deactivating the hypertext link.

26. The system of claim 25, wherein the deactivated link is identifiable as a hypertext link.

27. The system of claim 21, wherein the executable code is contained in an attachment.

28. The system of claim 27, wherein the means for converting comprises:

means for forwarding the executable code to a sacrificial server to convert the executable code from the executable format to the non-executable format; and

means for receiving from the sacrificial server the non-executable format.

29. The system of claim 28, wherein the means for converting further comprises means for examining the sacrificial server for virus activity.

30. The system of claim 29, wherein communications with the sacrificial server are authenticated using a challenge and response technique.

31. The system of claim 29, wherein the means for converting further comprises:

means for rebooting the sacrificial server from a safe copy of an operating system obtained from a read-only device.

32. The system claim 28, wherein the means for converting further comprises:

means for disconnecting a data link to the sacrificial server after the forwarding the executable code to the sacrificial server; and

means for establishing the data link to the sacrificial server before the receiving the non-executable format from the sacrificial server.

33. The system of claim 27, wherein the means for converting comprises:

means for maintaining a list of approved attachment types;

means for determining whether the attachment is of a type which is in the list of approved attachment types; and

if the attachment is not of a type which is in the list of approved attachment types, means for informing the target recipient that a message containing a non-approved attachment has been received.

34. The system of claim 21, wherein the means for converting comprises:

means for maintaining a list of approved executable code;

means for determining whether the executable code is in the list of approved executable code; and

means for deactivating the executable code if the executable code is not in the list of approved executable code.

35. The system of claim 34, wherein:

the list of approved executable code includes information for determining whether the approved executable code has been altered; and

the means for converting further comprises;

means for determining whether the executable code has been altered; and

means for deactivating the executable code if the executable code has been altered.

36. The system of claim 35, wherein the means for determining whether the executable code has been altered comprises means for performing an algorithmic technique.

37. The system of claim 36, wherein the algorithmic technique is at least one of a check-summing technique and a hashing technique.

38. The system of claim 21, wherein the message is an e-mail message.

39. The system of claim 21, wherein the non-executable format is an image format.

40. The system of claim 21, wherein the means for converting the executable code comprises:

means for forming a first copy and a second copy of at least a portion of the message containing the executable code;

means for executing the executable code in the first copy but not the second copy; and

means for comparing the first copy to the second copy to determine an effect of the executable code, after the executable code in the first copy has been executed.

41. A processor configured to execute program code that causes the processor to perform a method comprising:

receiving a message containing a virus comprising executable code;

converting the executable code from an executable format to a non-executable format, such that the virus is rendered inoperable, using an application-level process that retains semantic content of the message; and

forwarding the non-executable format over a network to a target recipient of the message.

42. The method of claim 41, wherein the executable code is at least one of compiled code, interpretive code, and markup language code.

43. The method of claim 41, wherein the executable code is contained in an attachment.

44. The method of claim 43, wherein converting the executable code comprises:

forwarding the executable code to a sacrificial server to convert the executable code from the executable format to the non-executable format; and

receiving from the sacrificial server the non-executable format.

45. A non-transitory computer readable storage medium having instructions stored thereon, the instructions comprising:

instructions to receive a message containing a virus comprising executable code;

instructions to convert the executable code from an executable format to a non-executable format, such that the virus is rendered inoperable, using an application-level process that retains semantic content of the message; and

instructions to forward the non-executable format over a network to a target recipient of the message.

46. A method comprising:

receiving a message containing executable code;

converting the executable code from an executable format to a non-executable format, such that the executable code is rendered inoperable, using an application-level process that retains semantic content of the message; and

forwarding the non-executable format over a network to a target recipient of the message.

47. The method of claim 46, wherein the executable code is contained in a body of the message.

48. The method of claim 47, wherein the executable code comprises one of a hypertext link and an e-mail address and the converting comprises deactivating one of the hypertext link and the e-mail address.