Computer virus screening methods and systems

• US 9,197,661 B2
• Filed: 09/14/2012
• Issued: 11/24/2015
• Est. Priority Date: 02/12/1998
• Status: Expired due to Fees

• Current Assignee: Intellectual Ventures I LLC (Intellectual Ventures LLC), SBC Intellectual Property
• Original Assignee: Auctnyc 8 LLC (Intellectual Ventures LLC)
• Inventors: Franczek, Edward J., Bretscher, John Thomas, Bennett, Raymond Walden III
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): ALMEIDA, DEVIN E
• Application Number:
  US13/620,024
• Publication Number:
  US 20130067580A1
• Time in Patent Office: 1,166 Days
• Field of Search: 726/24
• US Class Current: 1/1
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method includes receiving a status update from a client device, the status update reflects at least one change associated with the client device, updating a model of the client device based on the status update, receiving data to be screened for a virus, the data is received after an updating of the model of the client device, and screening the model of the client device for the virus. Systems and articles of manufacture are also disclosed.

Claims

1. A method comprising:

receiving a status update from a client device, wherein the status update corresponds to at least one change in a parameter of the client device;

updating a model of the client device based on the status update;

receiving data to be screened for a virus; and

screening the model of the client device for the virus.

2. The method of claim 1, further comprising:

executing a program included in the data;

intercepting a read request generated by the program; and

generating a response to the read request using parameters of the model of the client device.

3. The method of claim 1, further comprising:

executing a program included in the data;

intercepting a write request generated by the program; and

updating the model of the client device in response to the write request.

4. The method of claim 3, further comprising:

communicating to the client device, in response to an acceptance of the data by the client device, modifications made to the model of the client device during execution of the program.

5. The method of claim 4, wherein:

the communicating further comprises communicating via the Internet, and

the modifications allow the client device to execute the program without performing a full installation of the program.

6. The method of claim 1, further comprising:

communicating a result of the screening to the client device.

7. The method of claim 1, wherein the screening further comprises screening the model of the client device for at least one of a trojan and a worm.

8. The method of claim 1, wherein the model of the client device is implemented as a virtual channel in an interactive session.

9. A system comprising:

a processor; and

a memory storing instructions, execution of the instructions by a computing device causing the computing device to perform operations comprising;

receiving a status update from a client device, wherein the status update corresponds to at least one change in a parameter of the client device,

updating a model of the client device based on the status update,

receiving data to be screened for a virus, and

screening the model of the client device for the virus.

10. The system of claim 9, wherein the operations further comprise:

executing a program included in the data;

intercepting a write request generated by the program; and

updating the model of the client device in response to the write request.

11. The system of claim 10, wherein the operations further comprise:

communicating, in response to an acceptance of the data by the client device, modifications made to the model of the client device during execution of the program.

12. The system of claim 11, wherein:

the communicating further comprises communicating via the Internet, and

the modifications allow the client device to execute the program without performing a full installation of the program.

13. The system of claim 9, wherein the screening further comprises screening the model of the client device for at least one of a trojan and a worm.

14. The system of claim 9, wherein the model of the client device is implemented as a virtual channel in an interactive session.

15. The system of claim 9, wherein the operations further comprise:

executing a program included in the data;

intercepting a read request generated by the program; and

generating a response to the read request using parameters of the model of the client device.

16. The system of claim 9, wherein the operations further comprise:

communicating a result of the screening to the client device.

17. A non-transitory computer-readable storage medium having instructions stored thereon, execution of which by a computing device causes the computing device to perform operations comprising:

receiving a status update from a client device, wherein the status update corresponds to at least one change in a parameter of the client device;

updating a model of the client device based on the status update;

receiving data to be screened for a virus; and

screening the model of the client device for the virus.

18. The non-transitory computer-readable storage medium of claim 17, wherein the operations further comprise:

executing a program included in the data;

intercepting a read request generated by the program; and

generating a response to the read request using parameters of the model of the client device.

19. The non-transitory computer-readable storage medium of claim 17, wherein the operations further comprise:

executing a program included in the data;

intercepting a write request generated by the program; and

updating the model of the client device in response to the write request.

20. The non-transitory computer-readable storage medium of claim 19, wherein the operations further comprise:

communicating to the client device, in response to an acceptance of the data by the client device, modifications made to the model of the client device during execution of the program.