Systems and methods for updating content detection devices and systems

• US 8,935,790 B2
• Filed: 03/12/2013
• Issued: 01/13/2015
• Est. Priority Date: 03/12/2004
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Fang, Yu, Xie, Michael
• Primary Examiner(s): Dinh, Minh
• Assistant Examiner(s): ALMEIDA, DEVIN E
• Application Number:
  US13/795,407
• Publication Number:
  US 20130263246A1
• Time in Patent Office: 672 Days
• Field of Search: None
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of updating a content detection module includes obtaining content detection data, and transmitting the content detection data to a content detection module, wherein the transmitting is performed not in response to a request from the content detection module. A method of sending content detection data includes obtaining content detection data, selecting an update station from a plurality of update stations, and sending the, content detection data to the selected update station. A method of building a content detection system includes establishing a first communication link between a central station and an update station, the central station configured to transmit content detection data to the update station, and establishing a second communication link between the update station and a content detection module.

Claims

1. A method of updating a content detection module by a central station, the method comprising:

receiving, by the central station, suspicious content data from a content detection module of a group of one or more content detection modules;

analyzing, on the central station, the suspicious content data to determine whether the suspicious content data contains or is a threat to detect;

if the suspicious content data contains or is a threat, generating, on the central station, content detection data as a function of the suspicious content data; and

transmitting the content detection data to the group of content detection modules via at least one update station, the transmitting of the content detection data including transmitting, to at least one update station, data identifying content detection modules of the group of content detection modules to receive the content detection data and an instruction to the at least one update station to transmit the content detection to each of the at least one identified content detection modules of the group of content detection modules.

2. The method of claim 1, wherein the content detection data comprises a threat signature.

3. The method of claim 2, wherein the threat signature is a virus signature.

4. The method of claim 1, wherein the content detection data comprises a time data indicating a time at which the content detection data is created.

5. The method of claim 1, wherein the content detection modules are configured to detect network content based on the content detection data.

6. The method of claim 1, wherein the transmitting is performed not in response to a request from the content detection module.

7. The method of claim 1, wherein the content detection data comprises a spammer identification.

8. A non-transitory device-readable storage medium including a set of instructions stored thereon which when executed by a processor of a device cause the device to:

receive suspicious content data from a content detection module of a group of one or more content detection modules;

analyze the suspicious content data to determine whether the suspicious content data contains or is a threat to detect;

when the suspicious content data contains or is a threat, generate content detection data as a function of the suspicious content data; and

transmit the content detection data to the group of content detection modules via at least one update station, the transmitting of the content detection data including transmitting, to at least one update station, data identifying content detection modules of the group of content detection modules to receive the content detection data and an instruction to the at least one update station to transmit the content detection to each of the at least one identified content detection modules of the group of content detection modules.

9. The non-transitory device-readable storage medium of claim 8, wherein the content detection data comprises a threat signature.

10. The non-transitory device-readable storage medium of claim 9, wherein the threat signature is a virus signature.

11. The non-transitory device-readable storage medium of claim 8, wherein the content detection data comprises a time data indicating a time at which the content detection data is created.

12. The non-transitory device-readable storage medium of claim 8, wherein the content detection modules are configured to detect network content based on the content detection data.

13. The non-transitory device-readable storage medium of claim 8, wherein the transmitting is performed not in response to a request from the content detection module.

14. The non-transitory device-readable storage medium of claim 8, wherein the content detection data comprises a spammer identification.