Virus immunization using prioritized routing

• US 8,424,089 B2
• Filed: 09/22/2006
• Issued: 04/16/2013
• Est. Priority Date: 04/27/2006
• Status: Active Grant

• Current Assignee: The Invention Science Fund I, L.L.C. (Intellectual Ventures LLC)
• Original Assignee: The Invention Science Fund I, L.L.C. (Intellectual Ventures LLC)
• Inventors: Lord, Robert W., Malamud, Mark A., Rinaldo, Jr., John D., Wood, JR., Lowell L., Jung, Edward K. Y., Levien, Royce A.
• Primary Examiner(s): HERZOG, MADHURI R
• Application Number:
  US11/526,062
• Publication Number:
  US 20070261119A1
• Time in Patent Office: 2,398 Days
• Field of Search: 726 22- 26, 726 11- 14, 713/151, 713187-188, 714/4, 709238-244, 709223-224
• US Class Current: 726/24
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: Y02D 30/50 in wire-line communication networks, e.g. low power modes or reduced link rate

Abstract

An apparatus, device, methods, computer program product, and system are described that determine a virus associated with communication data on a communications network, the communications network associated with at least one network policy device, associate an anti-viral agent with at least one identifier, prioritize transmission of the at least one identifier through the at least one network policy device, relative to the communication data, and provide the anti-viral agent on the communications network, in response to the prioritizing transmission of the at least one identifier through the at least one network policy device.

Claims

1. A computer program product comprising:

one or more non-transitory computer-readable media bearing;

(a) one or more instructions for determining a virus associated with communication data on a communications network;

(b) one or more instructions for associating an anti-viral agent with at least one identifier;

(c) one or more instructions for prioritizing transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network; and

(d) one or more instructions for providing the anti-viral agent on the communications network, in response to the prioritizing transmission of the at least one identifier.

2. A system, comprising:

a computing device; and

instructions that when executed on the computing device cause the computing device to;

(a) determine a virus associated with communication data on a communications network;

(b) associate an anti-viral agent with at least one identifier;

(c) prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network; and

(d) provide the anti-viral agent on the communications network, in response to the prioritizing transmission of the at least one identifier.

3. The system of claim 2, wherein, in causing the computing device to determine a virus associated with communication data on a communications network, the instructions cause the computing device to:

determine the virus associated with the communication data on the communications network, the communications network including an entity-sponsored intranet.

4. The system of claim 2, wherein, in causing the computing device to determine a virus associated with communication data on a communications network, the instructions cause the computing device to:

determine the virus associated with the communication data on the communications network, the communications network associated with at least one network policy device that is configured to route a packet based on a packet identifier included within a header of the packet.

5. The system of claim 2, wherein, in causing the computing device to determine a virus associated with communication data on a communications network, the instructions cause the computing device to:

determine the virus associated with the communication data on the communications network, the communications network associated with at least one network policy device that is associated with a plurality of network policy devices that are configured to provide at least two classes of network traffic management.

6. The system of claim 2, wherein, in causing the computing device to associate an anti-viral agent with at least one identifier, the instructions cause the computing device to:

determine the anti-viral agent based on the virus; and

associate the anti-viral agent with the at least one identifier.

7. The system of claim 2, wherein, in causing the computing device to associate an anti-viral agent with at least one identifier, the instructions cause the computing device to:

label a data packet with the at least one identifier, the data packet being associated with the anti-viral agent.

8. The system of claim 2, wherein, in causing the computing device to associate an anti-viral agent with at least one identifier, the instructions cause the computing device to:

label a header of a data packet with the at least one identifier, the data packet including at least a portion of the anti-viral agent as payload of the data packet.

9. The system of claim 2, wherein, in causing the computing device to associate an anti-viral agent with at least one identifier, the instructions cause the computing device to:

associate the anti-viral agent with the at least one identifier, wherein the at least one identifier includes a transmission priority.

10. The system of claim 2, wherein, in causing the computing device to associate an anti-viral agent with at least one identifier, the instructions cause the computing device to:

associate the anti-viral agent with the at least one identifier, the at least one identifier being associated with a transmission classification in accordance with a transmission classification scheme of the network policy device.

11. The system of claim 2, wherein, in causing the computing device to associate an anti-viral agent with at least one identifier, the instructions cause the computing device to:

associate the anti-viral agent with the at least one identifier, the at least one identifier being associated with a transmission channel of the network policy device.

12. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

determine a transmission priority associated with the at least one identifier.

13. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

determine a forwarding decision of a data packet containing the at least one identifier, based on content of the at least one identifier.

14. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

make a determination of a transmission priority of a data packet containing the at least one identifier, relative to a transmission priority of the communication data; and

prioritize the transmission of the data packet relative to the communication data, based on the determination.

15. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

replace the at least one identifier with a replacement identifier.

16. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

associate at least a second identifier with the at least one identifier.

17. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

provide an increased transmission speed of the at least one identifier, relative to the communication data.

18. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

provide an increased quality of service associated with at least one data packet containing the at least one identifier, relative to the communication data.

19. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

provide an increased transmission security of the at least one identifier, relative to the communication data.

20. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

provide an increased available bandwidth for transmission of the at least one identifier, relative to available bandwidth for transmission of the communication data.

21. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

provide an end-to-end circuit for at least one data packet associated with the at least one identifier, the end-to-end circuit being associated with a specified transmission characteristic.

22. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

provide prioritized transmission of a class of identifiers, the at least one identifier being associated with the class.

23. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

make a determination that the at least one identifier is associated with an entity; and

prioritize the transmission of the at least one identifier, based on the determination.

24. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

prioritize queuing of the at least one identifier within the at least one network policy device, relative to queuing of the communication data.

25. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

provide the transmission of the at least one identifier, the at least one identifier including at least one label associated with the Multiprotocol Label Switching protocol (MPLS).

26. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

receive an indication, from a first entity, of a specified quality of service (QoS) associated with the at least one identifier, at a second entity.

27. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

prioritize the transmission, based on a service level agreement between a first entity and a second entity.

28. The system of claim 2, wherein, in causing the computing device to provide the anti-viral agent on the communications network, in response to the prioritizing transmission of the at least one identifier, the instructions cause the computing device to:

provide the anti-viral agent to at least one network device of the communications network that is ahead of a propagation path of the virus on the communications network.

45. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

transmit the at least one identifier through at least one network policy device on a logical bypass network.

46. The system of claim 45, wherein, in causing the computing device to transmit the at least one identifier through the at least one network policy device on a logical bypass network, the instructions cause the computing device to:

transmit the at least one identifier through the at least one network policy device on a logical bypass network including an analog channel on a digital link.

47. The system of claim 45, wherein, in causing the computing device to transmit the at least one identifier through the at least one network policy device on a logical bypass network, the instructions cause the computing device to:

transmit the at least one identifier through the at least one network policy device on a logical bypass network including a lower network layer.

48. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

place one or more packets associated with the at least one identifier in a preferred location in a hardware queue of at least one network policy device.

49. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

increase processing power devoted to the prioritizing the transmission of the at least one identifier of at least one network policy device.

51. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

prioritize transmission of the at least one identifier relative to the communication data, including at least routing the at least one identifier at a data link layer of a protocol stack.

52. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

prioritize transmission of the at least one identifier relative to the communication data, including at least routing the at least one identifier at a network layer of a protocol stack.

53. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

prioritize transmission of the at least one identifier relative to the communication data, including at least routing the at least one identifier using routing that operates between layers 2 and 3.

54. The system of claim 2, wherein, in causing the computing device to prioritize transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network, the instructions cause the computing device to:

associate the at least one identifier with a first hardware queue of a first network policy device;

associate the communication data with a second hardware queue of the first network policy device; and

utilize a queue scheduling priority of the first network policy device to prioritize service of the first hardware queue relative to the second hardware queue.

29. A method, comprising:

determining a virus associated with communication data on a communications network;

associating an anti-viral agent with at least one identifier;

prioritizing transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network; and

providing the anti-viral agent on the communications network, in response to the prioritizing transmission of the at least one identifier,

wherein at least one of the determining, associating, prioritizing or providing is at least partially implemented using hardware.

30. The method of claim 29, wherein associating an anti-viral agent with at least one identifier comprises:

associating the anti-viral agent with the at least one identifier, wherein the at least one identifier includes a transmission priority.

31. The method of claim 29, wherein associating an anti-viral agent with at least one identifier comprises:

associating the anti-viral agent with the at least one identifier, the at least one identifier being associated with a transmission classification in accordance with a transmission classification scheme of a network policy device.

32. The method of claim 29, wherein associating an anti-viral agent with at least one identifier comprises:

associating the anti-viral agent with the at least one identifier, the at least one identifier being associated with a transmission channel of a network policy device.

33. The method of claim 29, wherein prioritizing transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network comprises:

determining a transmission priority associated with the at least one identifier.

34. The method of claim 29, wherein prioritizing transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network comprises:

making a determination of a transmission priority of a data packet containing the at least one identifier, relative to a transmission priority of the communication data; and

prioritizing the transmission of the data packet relative to the communication data, based on the determination.

35. The method of claim 29, wherein prioritizing transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network comprises:

providing an increased transmission speed of the at least one identifier, relative to the communication data.

36. The method of claim 29, wherein prioritizing transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network comprises:

providing an increased quality of service associated with at least one data packet containing the at least one identifier, relative to the communication data.

37. The method of claim 29, wherein prioritizing transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network comprises:

providing an increased transmission security of the at least one identifier, relative to the communication data.

38. The method of claim 29, wherein prioritizing transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network comprises:

providing an increased available bandwidth for transmission of the at least one identifier, relative to available bandwidth for transmission of the communication data.

39. The method of claim 29, wherein prioritizing transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network comprises:

making a determination that the at least one identifier is associated with an entity; and

prioritizing the transmission of the at least one identifier, based on the determination.

40. The method of claim 29, wherein prioritizing transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network comprises:

prioritizing queuing of the at least one identifier within the at least one network policy device, relative to queuing of the communication data.

41. The method of claim 29, wherein prioritizing transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network comprises:

receiving an indication, from a first entity, of a specified quality of service (QoS) associated with the at least one identifier, at a second entity.

42. The method of claim 29, wherein prioritizing transmission of the at least one identifier relative to the communication data based on a determination of a potential path of the communication data, the determination based on at least one of a topological or a statistical analysis of the communications network comprises:

prioritizing the transmission, based on a service level agreement between a first entity and a second entity.

43. The method of claim 29, wherein providing the anti-viral agent on the communications network, in response to the prioritizing transmission of the at least one identifier comprises:

providing the anti-viral agent to at least one network device of the communications network.

44. The method of claim 29, wherein determining a virus associated with communication data on a communications network comprises:

determining a virus associated with communication data on a communications network by at least one of an anti-virus business entity, an anti-malware business entity, or a security entity.

50. The method of claim 29, wherein associating an anti-viral agent with at least one identifier comprises:

associating an anti-viral agent with at least one identifier located in a data packet, the identifier associated with prioritized routing of the data packet to create a logical bypass network.