Server-based system, method, and computer program product for scanning data on a client using only a subset of the data

• US 8,799,450 B2
• Filed: 10/14/2008
• Issued: 08/05/2014
• Est. Priority Date: 10/14/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Pham, Khai N.
• Primary Examiner(s): LIN, WEN TAI
• Application Number:
  US12/251,112
• Publication Number:
  US 20130246604A1
• Time in Patent Office: 2,121 Days
• Field of Search: None
• US Class Current: 709/224
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A server-based system, method, and computer program product are provided for scanning data on a client using only a subset of the data. In operation, a request is received for a subset of data stored on a client that is required for determining whether the data is unwanted. Additionally, a representation of only the subset of data is sent from the client to a server over a network. Furthermore, a response is received from the server over the network. Still yet, there is a reaction based on the response.

Claims

1. A method, comprising:

sending a request from a server for a subset of data, the request defining identification information that identifies a hash of the subset of data, wherein the subset of data is stored on a client device;

receiving, at the server, a representation of the subset of data from the client device, the representation including the hash, the receiving performed after the sending the request, the client device being a wireless device, wherein the representation of the subset of data is received from a Java virtual machine of a Java-based browser of the client device;

scanning the representation of the subset of data utilizing a plurality of signatures; and

sending a response to the client device upon a match of the representation of the subset of data against one of the plurality of signatures, wherein the response includes an uninfected file associated with the data, and an instruction to restart an application that involves the subset of data, wherein the uninfected file is automatically installed on the client device, and the instruction instructs the client device to restart the application.

2. The method of claim 1, further comprising:

storing the representation of the subset of data for a predetermined amount of time.

3. The method of claim 2, further comprising:

scanning the stored representation at a first point in time utilizing a first set of signatures, and scanning the stored representation at a second point in time utilizing a second set of signatures.

4. The method of claim 3, wherein the second set of signatures is an updated version of the first set of signatures.

5. The method of claim 3, wherein the stored representation is scanned at the second point in time utilizing the second set of signatures in response to the second set of signatures being available.

6. The method of claim 1, wherein the plurality of signatures is selected based on identification information included with the representation.

7. The method of claim 1, wherein the plurality of signatures are classified into a plurality of classes with each class of signatures adapted for being compared against a different subset of data.

8. The method of claim 1, wherein the representation of the subset of data includes the subset of data.

9. A system, comprising:

a server configured to send a request for a subset of data, the request defining identification information that identifies a hash of the subset of data, to receive a representation of the subset of data from a client device, the representation including the hash, the representation received after the request is sent, to scan the representation of the subset of data utilizing a plurality of signatures, and to send a response to the client device upon a match of the representation of the subset of data against one of the plurality of signatures, wherein the response includes an uninfected file associated with the data, and an instruction to restart an application that involves the subset of data; and

the client device, the client device being a wireless device, wherein the client device includes

a memory that stores the subset of data; and

a Java-based browser including a Java virtual machine, wherein the client device automatically installs the uninfected file, and the client device restarts the application based on the instruction.

10. The system of claim 9, further comprising:

computer code embodied on a computer readable storage medium to receive the request and to send the representation from the client device to the server over a network.

11. The system of claim 9, wherein the client device is a mobile device.

12. The system of claim 9, wherein the client device performs an action in response to receiving the response, the action including at least one of deleting the data, deleting an application associated with the data, disabling an input/output port, resetting the client device, shutting down the client device, and preventing a further operation of the client device.

13. The system of claim 9, wherein the client device sends the representation in response to the request.

14. The system of claim 9, wherein the server replies with a signal to the client device, if no malware is found to be present in the data, the signal enabling a functionality of the client device.

15. A computer program product embodied on a non-transitory, computer readable storage medium, that, when executed by a processing unit, causes the processing unit to perform a method comprising:

sending a request from a server for a subset of data, the request defining identification information that identifies a hash of the subset of data;

receiving, at the server, a representation of the subset of data from a client device, the representation including the hash, the receiving performed after the sending the request, wherein the client device is a mobile device;

scanning the representation of the subset of data utilizing a plurality of signatures; and

sending a response including an uninfected file and an instruction to restart an application that involves the subset of data.

16. The computer program product of claim 15, wherein the uninfected file is an application.

17. The computer program product of claim 15, the method further comprising:

scanning the representation with an updated version of the plurality of signatures, in response to a determination that the plurality of signatures has been updated.

18. The computer program product of claim 15, the method further comprising:

periodically scanning the representation of the subset of data.