Systems and methods for updating content detection devices and systems

• US 8,051,483 B2
• Filed: 11/30/2004
• Issued: 11/01/2011
• Est. Priority Date: 03/12/2004
• Status: Expired due to Fees

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Xie, Michael, Fang, Yu
• Primary Examiner(s): LAFORGIA, CHRISTIAN A
• Application Number:
  US11/000,703
• Publication Number:
  US 20050204151A1
• Time in Patent Office: 2,527 Days
• Field of Search: 726 22- 25, 713/188, 717168-172
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of updating a content detection module includes obtaining content detection data, and transmitting the content detection data to a content detection module, wherein the transmitting is performed not in response to a request from the content detection module. A method of sending content detection data includes obtaining content detection data, selecting an update station from a plurality of update stations, and sending the content detection data to the selected update station. A method of building a content detection system includes establishing a first communication link between a central station and an update station, the central station configured to transmit content detection data to the update station, and establishing a second communication link between the update station and a content detection module.

Claims

1. A method of updating a content diction module by a central station, the method comprising:

receiving, by the central station, suspicious content data by the central station from a content detection module of a group of one or more content detection modules;

analyzing, on the central station, the suspicious content data to determine whether the suspicious content data contains or is a threat to detect;

if the suspicious content data contains or is a threat, generating, on the central station, content detection data as a function of the suspicious content data and including a time data indicating a time at which the content detection data is created;

transmitting, from the central station, the content detection data to be pushed to the group of content detection modules via an update station, the transmitting comprising;

determining, on the central station, an update station for receiving the content detection data;

sending, from the central station, the content detection data to the update station including data identifying at least one content detection module to receive the content detection data; and

sending the content detection data from the update station to the content detection module;

wherein;

the transmitting is performed not in response to a request from the content detection module.

2. The method of claim 1, wherein the content detection data comprises a virus signature, a spammer identification, or a URL.

3. The method of claim 1, wherein the content detection modules are configured to detect network content based on the content detection data.

4. A computer-program product having a volatile or non-volatile medium, the medium having a set of instructions readable by a processor, an execution of the instructions by the processor causes a process to be performed, the process comprising:

receiving, on a central station, suspicious content data by the central station from a content detection module of a group of one or more content detection modules;

analyzing, on the central station, the suspicious content data to determine whether the suspicious content data contains or is a threat to detect;

if the suspicious content data contains or is a threat, generating, on the central station, content detection data as a function of the suspicious content data and including a time data indicating a time at which the content detection data is created;

transmitting, by the central station, the content detection data to be pushed to the group of content detection modules via an update station, the transmitting comprising;

determining, on the central station, an update station for receiving the content detection data;

sending, by the central station, the content detection data to the update station including data identifying at least one content detection module to receive the content detection data; and

sending the content detection data from the update station to the content detection module;

wherein;

the transmitting is performed not in response to a request from the content detection module.

5. The computer-program product of claim 4, wherein the content detection data comprises a virus signature, a spammer identification, or a URL.

6. The computer-program product of claim 4, wherein the content detection modules are configured to detect network content based on the content detection data.