Systems and methods for updating content detection devices and systems

• US 8,056,135 B2
• Filed: 12/16/2009
• Issued: 11/08/2011
• Est. Priority Date: 03/12/2004
• Status: Expired due to Fees

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Fang, Yu, Xie, Michael
• Primary Examiner(s): Laforgia; Christian
• Application Number:
  US12/639,800
• Publication Number:
  US 20100154064A1
• Time in Patent Office: 692 Days
• Field of Search: 726 22- 24, 713/188, 717/168, 717/171, 717/172
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of updating a content detection module includes obtaining content detection data, and transmitting the content detection data to a content detection module, wherein the transmitting is performed not in response to a request from the content detection module. A method of sending content detection data includes obtaining content detection data, selecting an update station from a plurality of update stations, and sending the, content detection data to the selected update station. A method of building a content detection system includes establishing a first communication link between a central station and an update station, the central station configured to transmit content detection data to the update station, and establishing a second communication link between the update station and a content detection module.

Claims

1. A content detection system, comprising:

a processor;

a communication interface device;

a data storage device storing;

content detection data usable by a content detection module to detect content; and

instruction executable by the processor to transmit, over a network via the communication interface device, the content detection data to the content detection module not in response to a request by the content detection module;

wherein the content detection system is a central station;

a first update station configured to receive the content detection data from the content detection system and send the content detection data to the content detection module;

a second update station configured to receive the content detection data from the central station; and

wherein the first update station is configured to determine whether the second update station received the content detection data.

2. The system of claim 1, wherein the central station is configured to select an update station to which the central station transmits the content detection data.

3. The system of claim 1, wherein the content detection system is configured to transmit the content detection data in real time when the content is detected.

4. The system of claim 1, wherein the content detection system is selected from the group consisting of a computer, a server, a device, and a software.

5. The system of claim 1, wherein the content detection data comprises at least one of a virus signature, a spammer identification, and a URL.

6. A method of sending content detection data, comprising:

determining, through execution of instructions on a computer processor, whether a first update station received content detection data from a second update station in communication over a network with the first update station; and

sending, from the second update station via a network interface device of the second update station over the network to the first update station, the content detection data when the first update station did not receive the content detection data.

7. The method of claim 6, wherein the determining comprises sending a query over the network to the first update station, the query requesting confirmation of receipt of the content detection data by the first update station.

8. The method of claim 6, wherein the content detection data comprises at least one of a virus signature, a spammer identification, and a URL.

9. The method of claim 6, wherein the second update station receives the content detection data from a central station.

10. The method of claim 9, wherein the central station is a software process executable on a processor of a server to retrieve the content detection data from a data storage device and to transmit the content detection data over the network to at least the second update station.

11. The method of claim 6, wherein an item of content detection data includes time data indicating a time at which the item content detection data was created.

12. A non-transitory computer-program product having a storage medium, the storage medium having a set of instructions executable by a processor of a computer to perform a method of sending content detection data, the method comprising:

determining whether a first update station received content detection data from a second update station in communication over a network with the first update station; and

sending, from the second update station via a network interface device of the second update station over the network to the first update station, the content detection data when the first update station did not receive the content detection data.

13. The non-transitory computer-program product of claim 12, wherein the determining comprises sending a query over the network to the first update station, the query requesting confirmation of receipt of the content detection data by the first update station.

14. The non-transitory computer-program product of claim 12, wherein the content detection data comprises at least one of a virus signature, a spammer identification, and a URL.

15. The non-transitory computer-program product of claim 12, wherein the second update station receives the content detection data from a central station.