Protecting computers from viruses in peer-to-peer data transfers

• US 8,056,133 B1
• Filed: 07/26/2006
• Issued: 11/08/2011
• Est. Priority Date: 07/26/2006
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Yao, Pei-Chun, Chang, Chia-Chi
• Primary Examiner(s): CERVETTI, DAVID GARCIA
• Application Number:
  US11/494,402
• Time in Patent Office: 1,931 Days
• Field of Search: 726/24
• US Class Current: 726/24
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

In one embodiment, a peer-to-peer (P2P) protect server may include a crawler to obtain files available for P2P data transfer. The P2P protect server may employ a scan engine to scan the files for computer viruses, and store the results of the scanning in a database. A P2P protect application running in a P2P client may request the P2P protect server for information on whether or not a particular file available for P2P data transfer is infected with a computer virus. This allows the user of the P2P client to make an informed decision before downloading the file from another P2P client.

Claims

1. A method of protecting computers from viruses in a peer-to-peer (P2P) data transfer, the method comprising:

sending a file search request from a P2P protect server computer to a P2P server to determine locations of a plurality of files from a plurality of P2P client computers available for P2P data transfer in a P2P network, the P2P protect server computer being separate from the P2P server;

scanning for computer viruses the plurality of files from the plurality of P2P client computers identified in a response to the file search request, wherein the P2P protect server computer scans the plurality of files available from the plurality of P2P client computers for computer viruses;

storing results of scanning the plurality of files from the plurality of P2P client computers in the P2P protect server computer;

receiving in a first P2P client computer a listing of files available for P2P data transfer in the P2P network, the listing of files indicating a first file that may be downloaded directly from a second P2P client computer to the first P2P client computer in a P2P data transfer, wherein the first P2P client computer receives the listing of files available for P2P data transfer from the P2P server;

sending a query from the first P2P client computer to the P2P protect server computer to inquire whether the first file is infected with a computer virus;

receiving a response in the first P2P client computer, the response coming from the P2P protect server computer and including a result of scanning the first file for computer viruses; and

prior to downloading the first file directly from the second P2P client computer to the first P2P client computer, displaying in the first P2P client computer the result of scanning the first file for computer viruses.

2. The method of claim 1 wherein the result of scanning the first file for computer viruses is displayed in the first P2P client computer along with a warning when the result indicates that the first file is virus-infected.

3. The method of claim 1 wherein the P2P protect server and the first P2P client computer communicate over the Internet.

4. The method of claim 1 wherein the results of scanning the plurality of files are stored in a database in the P2P protect server computer.

5. The method of claim 1 wherein the result of scanning the first file for computer viruses is displayed when a user on the first P2P client computer uses a mouse to right click on a filename of the first file as displayed in the listing of files available for P2P data transfer in the P2P network.

6. A server computer comprising:

a crawler configured to obtain files available for P2P data transfer from a plurality of P2P clients in a P2P network;

a scan engine configured to scan files obtained by the crawler for computer viruses;

a database configured to store results of scanning the files obtained by the crawler for computer viruses;

wherein the server computer is configured to consult the database to inform a first P2P client in the plurality of P2P clients whether or not a particular file available for P2P data transfer from a second P2P client in the plurality of P2P clients is infected with a computer virus prior to the first P2P client downloading the particular file directly from the second P2P client.

7. The server computer of claim 6 wherein the plurality of P2P clients communicate over the Internet.

8. The server computer of claim 6 wherein the crawler is configured to send a file search request to a P2P server to determine locations of the files available for P2P data transfer.

9. The server computer of claim 6 wherein the server computer informs the first P2P client whether or not the particular file has a computer virus in response to a query from a P2P protect application running in the first P2P client.

10. A method of protecting computers from viruses in a P2P data transfer, the method to be performed in a first computer and comprising:

parsing a file search result that lists files available for P2P data transfer;

querying a third computer whether or not a particular file is infected with a computer virus, the particular file being indicated in the file search result and available from a second computer, wherein the third computer stores results of scanning files identified in the file search result for computer viruses;

receiving from the third computer a response to the query; and

displaying in the first computer information on whether or not the particular file is infected with a computer virus prior to the particular file being directly downloaded from the second computer to the first computer in a P2P data transfer, wherein the first computer receives the file search result from a fourth computer configured to keep a directory of locations of files available for P2P data transfer in a P2P network that includes the first and second computers, the fourth computer being separate from the third computer.

11. The method of claim 10 wherein the third computer scans the particular file for computer viruses.

12. The method of claim 10 wherein the first, second, and third computers communicate over the Internet.