Update acquisition

• US 8,149,844 B1
• Filed: 10/25/2009
• Issued: 04/03/2012
• Est. Priority Date: 09/27/2004
• Status: Active Grant

• Current Assignee: K.Mizra LLC
• Original Assignee: Aaron T. Emigh, James A. Roskind
• Inventors: Roskind, James A., Emigh, Aaron T.
• Primary Examiner(s): Kizou, Hassan
• Assistant Examiner(s): Maglo, Emmanuel
• Application Number:
  US12/605,338
• Time in Patent Office: 891 Days
• Field of Search: 370/241, 370/256, 370/395.21, 709/203, 726/4, 726/22, 717/174
• US Class Current: 370/395.21
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 51/222 using geographical location information, e.g. messages transmitted or received in proximity of a certain spot or area
• CPC Class Codes: H04L 51/42 Mailbox-related aspects, e.g. synchronisation of mailboxes
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Determining a next time to communicate via a network with a source of updates is disclosed. In some embodiments, determining a next time to communicate via a network with a source of updates comprises receiving from a request source an update request, and scheduling a next time for the request source to check for updates. In some embodiments, determining a next time to communicate via a network with a source of updates comprises monitoring network communication activity, and in the event anomalous network communication activity is observed, reducing a time remaining until a next check for updates is performed.

Claims

1. A method for determining a next time to communicate via a network with a source of updates, comprising:

monitoring network communication activity; and

in the event anomalous network communication activity is observed, wherein the anomalous network activity includes activity that is beyond a multiple of network activity within a historic period, reducing a time remaining until a next check for an update is performed.

2. The method of claim 1, wherein the anomalous network activity includes latency for email delivery above a threshold.

3. The method of claim 1, wherein the anomalous network activity includes an anomalous rate of unacceptable TCP/IP traffic.

4. The method of claim 1, wherein the anomalous network activity includes an attempt to connect to a blocked network port.

5. The method of claim 1, wherein the update relates to a patch.

6. The method of claim 1, wherein the update relates to a threat definition for security software.

7. The method of claim 1, wherein the anomalous network activity includes malicious content being detected.

8. The method of claim 1, wherein the anomalous network activity includes an extraordinarily long string being detected.

9. The method of claim 1, wherein the time remaining until the next check for updates is performed is reduced by a constant proportional factor.

10. A system for determining a next time to communicate via a network with a source of updates, comprising:

a processor configured to;

monitor network communication activity; and

in the event anomalous network communication activity is observed, wherein the anomalous network activity includes activity that is beyond a multiple of network activity within a historic period, reduce a time remaining until a next check for updates is performed; and

a memory coupled with the processor, wherein the memory provides instructions to the processor.

11. The system of claim 10, wherein the update relates to a patch.

12. The system of claim 10, wherein the update relates to a threat definition for security software.

13. The system of claim 10, wherein the time remaining until the next check for updates is performed is reduced by a constant proportional factor.

14. The system of claim 10, wherein the anomalous network activity includes latency for email delivery above a threshold.

15. The system of claim 10, wherein the anomalous network activity includes an anomalous rate of unacceptable TCP/IP traffic.

16. The system of claim 10, wherein the anomalous network activity includes an attempt to connect to a blocked network port.

17. The system of claim 10, wherein the anomalous network activity includes malicious content being detected.

18. The system of claim 10, wherein the anomalous network activity includes an extraordinarily long string being detected.

19. A computer program product for determining a next time to communicate via a network with a source of updates, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

monitoring network communication activity; and

in the event anomalous network communication activity is observed, wherein the anomalous network activity includes activity that is beyond a multiple of network activity within a historic period, reducing a time remaining until a next check for an update is performed.

20. The computer program product of claim 19, wherein the update relates to a patch.

21. The computer program product of claim 19, wherein the update relates to a threat definition for security software.

22. The computer program product of claim 19, wherein the time remaining until the next check for updates is performed is reduced by a constant proportional factor.

23. The computer program product of claim 19, wherein the anomalous network activity includes latency for email delivery above a threshold.

24. The computer program product of claim 19, wherein the anomalous network activity includes an anomalous rate of unacceptable TCP/IP traffic.

25. The computer program product of claim 19, wherein the anomalous network

activity includes an attempt to connect to a blocked network port.

26. The computer program product of claim 19, wherein the anomalous network

activity includes malicious content being detected.

27. The computer program product of claim 19, wherein the anomalous network activity includes an extraordinarily long string being detected.