System and method for antivirus protection

• US 9,491,193 B2
• Filed: 06/27/2013
• Issued: 11/08/2016
• Est. Priority Date: 06/27/2013
• Status: Active Grant

• Current Assignee: SecureAge Technology, Inc.
• Original Assignee: SecureAge Technology, Inc.
• Inventors: Ngair, Teow Hin
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): Baum, Ronald
• Application Number:
  US13/929,681
• Publication Number:
  US 20150007324A1
• Time in Patent Office: 1,230 Days
• Field of Search: 726/24
• US Class Current: 1/1
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

The present invention relates to antivirus protection and more particularly to antivirus protection in a cloud server. The present invention protects a user machine from a virus while allowing the user to get the benefit of using multiple antivirus options without the need to run the antivirus options on the user machine.

Claims

1. A method for antivirus protection, the method performed on a server, comprising:

storing, by the server, copies of all applications resided on a user machine associated with the server;

receiving, by the server, a hash from the user machine, the hash indicating an application that is stored on the user machine, the server initialization is triggered by associating a new user machine with the server and is triggered by installing a new application on the user machine;

storing a copy of the application that resides on the user machine, the copy of the application is stored on the server as binaries and the copy of the application is used to detect a virus on the user machine without using computing resources on the user machine;

automatically and periodically scanning the binaries stored on the server using an antivirus option with a continuously updated engine and virus definition, wherein the scanning binaries occurs entirely remotely from the user machine and wherein the periodic scanning is triggered by the continuously updated engine and virus definition such that when the engine and virus definition is updated the repeated scan occurs without requiring communication with the user machine to repeatedly send information related to the application to the server since the copy of information and the application is stored on the server and without requiring communication with the user machine while the server is performing virus detection; and

identifying a virus based on the scanning of the binaries on the server;

identifying the user machine that has been infected by the virus, the identification of the user machine using a process executing on the server;

recommending a remedy to the user to eradicate the virus, wherein the remedy is selected from the list of quarantine and remove the virus; and

updating the server with the user machine status.

2. The method of claim 1, wherein the identifying a user machine that has been infected by the virus further comprises:

using a database of hashes, applications, and a unique user machine identifier; and

regularly updating database of hashes of applications on user machine.

3. The method of claim 1, wherein the scanning identifies all virus-free programs on the user machine with information from the server and a local antivirus application stored on the user machine scans only newly installed program.

4. The method of claim 1, wherein the scanning the binaries is accomplished using a plurality of antivirus options.

5. The method of claim 1, wherein the user machine is a smart phone.

6. The method of claim 1, wherein the user machine is a tablet.

7. The method of claim 1, wherein the user machine is a network security device.

8. The method of claim 1, wherein the method for antivirus protection is used in a corporate network setting.

9. The method of claim 1 wherein the user machine is powered off.

10. A system for remote antivirus protection using a server remote from a user machine, comprising:

a non-transitory memory storing a copy of an application that resides on the user machine and a hash database of at least one hash and program corresponding to the at least one program on the user machine and the hash database is updated in response to information received regarding detection of a newly installed application on the user machine, the copy of the application is stored on the server as binaries and the copy of the application is used to detect a virus on the user machine without using computing resources on the user machine;

an antivirus engine, coupled to the hash database, executing on the server to enable the server to automatically and periodically scan the binaries on the server for a virus using continuously updated engines and virus definitions machine and wherein the periodic scanning is triggered by the continuously updated engine and virus definition such that when the engine and virus definition is updated the repeated scan occurs without requiring communication with the user machine to repeatedly send information related to the application to the server since the copy of information and the application is stored on the server and without requiring communication with the user machine while the server is performing virus detection; and

an interface module component of the server, coupled to the hash database, executing on the server to enable the server to receive information from a remotely located user machine regarding a hash and machine status upon detection of a newly installed or newly deleted application on the user machine and to update the hash database accordingly and to send information regarding a virus to the user machine.

11. The system of claim 10, wherein the antivirus engine is a commercially available antivirus option.

12. The system of claim 10, wherein the antivirus engine is an open source antivirus option.

13. The system of claim 10, further comprising a user machine having a local antivirus application stored on the user machine for detecting a newly installed program and sending it for on-demand scanning remotely.

14. The system of claim 10, wherein the antivirus engine identifies all virus-free programs on a user machine and a local antivirus application stored on the user machine scans a newly installed program.

15. The system of claim 10, wherein the antivirus engine uses a plurality of antivirus options.

16. The system of claim 10, wherein the system is used in a corporate network setting.

17. The system of claim 10, wherein the user machine is powered off.