System, method and computer program product for updating a security system definition database based on prioritized instances of known unwanted data

• US 8,613,092 B2
• Filed: 05/21/2007
• Issued: 12/17/2013
• Est. Priority Date: 05/21/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Gupta, Manish
• Primary Examiner(s): Tabor, Amare F
• Application Number:
  US11/751,565
• Publication Number:
  US 20130247130A1
• Time in Patent Office: 2,402 Days
• Field of Search: 726 22- 24, 713/188
• US Class Current: 726/24
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

A prioritized update system, method, and computer program product are provided. In use, a priority is assigned to a plurality of instances of known unwanted data. In addition, information associated with at least one of the instances of known unwanted data is communicated over a network for updating a system, based on the priority. In one embodiment, the prioritized update system may be provided for updating a security system definition database, based on prioritized instances of known unwanted data.

Claims

1. A method to be performed in an electronic processing environment, comprising:

assigning a priority to a plurality of instances of known unwanted data, wherein the priority includes a distribution level characteristic associated with proliferation of each of the plurality of instances;

generating signatures for the plurality of instances of known unwanted data based on the assigned priority;

downloading a plurality of new signatures in response to identifying new signatures'"'"' associated priorities; and

communicating information associated with at least one of the plurality of instances of known unwanted data over a network as part of an update for a system, wherein the information includes a detection technique for detecting an occurrence of the at least one instance of known unwanted data, the information being associated with a highest priority instance of the known unwanted data, and being communicated ahead of other instances of the plurality of instances having a lesser priority.

2. The method of claim 1, wherein at least one of the plurality of instances of the known unwanted data includes at least one of malware, spyware, and key loggers.

3. The method of claim 1, wherein at least one of the plurality of instances of the known unwanted data includes unwanted mail messages.

4. The method of claim 1, wherein the priority is stored in a database in association with the information associated with the plurality of instances of the known unwanted data.

5. The method of claim 1, wherein assigning the priority includes assigning a different priority to each of the plurality of instances of the known unwanted data.

6. The method of claim 1, wherein assigning the priority includes assigning a same priority to at least a portion of the plurality of instances of the known unwanted data.

7. The method of claim 1, wherein the information associated with the at least one of the plurality of instances of the known unwanted data includes a signature of the at least one of the plurality of instances of the known unwanted data.

8. The method of claim 1, wherein the information associated with the at least one of the plurality of instances of the known unwanted data includes cleaning code utilized for cleaning the at least one of the plurality of instances of the known unwanted data.

9. The method of claim 1, wherein the information associated with the at least one of the plurality of instances of the known unwanted data includes formation information indicating a formation of the at least one of the plurality of instances of the known unwanted data.

10. The method of claim 1, wherein the update only includes information associated with instances of the known unwanted data not previously communicated over the network for updating the system.

11. The method of claim 1, wherein information associated with a first instance of the known unwanted data assigned a first priority is communicated over the network for updating the system prior to information associated with a second instance of the known unwanted data assigned a second priority.

12. The method of claim 1, wherein information associated with a first set of instances of the known unwanted data assigned a first priority are communicated over the network for updating the system prior to information associated with a second set of instances of the known unwanted data assigned a second priority.

13. The method of claim 1, wherein the priority assigned to the plurality of instances of the known unwanted data is based on a classification of each of the instances of the known unwanted data.

14. The method of claim 13, wherein the classification is based on at least one of a type of each of the plurality of instances of the known unwanted data, and a global threat condition associated with each of the plurality of instances of the known unwanted data.

15. The method of claim 1, further comprising generating the information associated with the at least one of the plurality of instances of the known unwanted data based on the priority.

16. The method of claim 1, wherein the system includes a security system.

20. The method of claim 1, wherein the priority reflects a severity of the known unwanted data.

21. The method of claim 1, wherein the priority reflects a threat level of the known unwanted data.

22. The method of claim 1, wherein the updating utilizes an update agent for receiving the information associated with the at least one of the plurality of instances of known unwanted data.

23. The method of claim 22, wherein the update agent receives the information based on priorities associated with each of the instances of known unwanted data.

17. A computer program product embodied on a non-transitory computer readable medium for performing operations, comprising:

assigning a priority to a plurality of instances of known unwanted data, wherein the priority includes a distribution level characteristic associated with proliferation of each of the plurality of instances;

generating signatures for the plurality instances of known unwanted data based on the assigned priority;

downloading a plurality of new signatures in resonance to identifying new signatures'"'"' associated priorities; and

communicating information associated with at least one of the plurality of instances of known unwanted data over a network as part of an update for a system, wherein the information includes a detection technique for detecting an occurrence of the at least one instance of known unwanted data, the information being associated with a highest priority instance of the known unwanted data, and being communicated ahead of other instances of the plurality of instances having a lesser priority.

18. A system, comprising:

a processor, wherein the system is configured for;

assigning a priority to a plurality of instances of known unwanted data, wherein the priority includes a distribution level characteristic associated with proliferation of each of the plurality of instances;

generating signatures for the plurality of instances of known unwanted data based on the assigned priority;

downloading a plurality of new signatures in response to identifying new signatures'"'"' associated priorities; and

communicating information associated with at least one of the plurality of instances of known unwanted data over a network as part of an update for a system, wherein the information includes a detection technique for detecting an occurrence of the at least one instance of known unwanted data, the information being associated with a highest priority instance of the known unwanted data, and being communicated ahead of other instances of the plurality of instances having a lesser priority.

19. The system of claim 18, further comprising memory coupled to the processor via a bus.