Server-based system, method, and computer program product for scanning data on a client using only a subset of the data

• US 9,544,360 B2
• Filed: 07/22/2014
• Issued: 01/10/2017
• Est. Priority Date: 10/14/2008
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Pham, Khai N.
• Primary Examiner(s): Chang, Jungwon
• Application Number:
  US14/337,421
• Publication Number:
  US 20150019632A1
• Time in Patent Office: 903 Days
• Field of Search: 709/203, 709/224, 726/24, 713/188
• US Class Current: 1/1
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A server-based system, method, and computer program product are provided for scanning data on a client using only a subset of the data. In operation, a request is received for a subset of data stored on a client that is required for determining whether the data is unwanted. Additionally, a representation of only the subset of data is sent from the client to a server over a network. Furthermore, a response is received from the server over the network. Still yet, there is a reaction based on the response.

Claims

1. A computer program product embodied on a non-transitory computer readable storage medium, comprising:

computer code to receive a request for a subset of data stored on a client, the request defining a plurality of classes, each of the plurality of classes including identification information and retrieval instructions that identify a signature;

computer code to generate a representation of the subset of data in response to the request, wherein the representation of the subset of data includes the identification information of one of the plurality of classes and a hash of the subset of data;

computer code to send the representation of the subset of data from the client to a server over a network;

computer code to receive a response to the representation from the server over the network; and

computer code to perform a reaction based on the response, the reaction including at least one of deleting the data, deleting an application associated with the data, restarting the application, or shutting down the client.

2. The computer program product of claim 1, wherein the computer code to send the representation of the subset of data sends the subset of data.

3. The computer program product of claim 1, further comprising

computer code to send an update of the representation of the subset of data from the client to the server, in response to the subset of data being modified.

4. The computer program product of claim 1, wherein the representation of the subset of data is generated utilizing an agent application on the client.

5. The computer program product of claim 1, wherein the representation of the subset of data is generated utilizing a virtual machine on the client.

6. The computer program product of claim 1, wherein the client includes a mobile wireless device.

7. A method, comprising:

receiving a request for a subset of data stored on a client, the request defining a plurality of classes, each of the plurality of classes including identification information and retrieval instructions that identify a signature;

generating a representation of the subset of data in response to the request, wherein the representation of the subset of data includes the identification information of one of the plurality of classes and a hash of the subset of data;

sending the representation of the subset of data from the client to a server over a network;

receiving a response to the representation from the server over the network; and

performing a reaction based on the response, the reaction including at least one of deleting the data, deleting an application associated with the data, restarting the application, or shutting down the client.

8. The method of claim 7, further comprising:

disabling an I/O port, resetting the client, or installing an uninfected file or application associated with the data, based on the response.

9. The method of claim 7, further comprising:

sending an update of the representation of the subset of data from the client to the server, in response to the subset of data being modified.

10. The method of claim 7, wherein the representation of the subset of data is generated utilizing an agent application on the client.

11. The method of claim 7, wherein the representation of the subset of data is generated utilizing a virtual machine on the client.

12. The method of claim 7, wherein the client includes a mobile wireless device.

13. A client, comprising:

a communication adapter configured to receive a request for a subset of data stored on the client, the request defining a plurality of classes, each of the plurality of classes including identification information and retrieval instructions that identify a signature; and

a processing unit configured to generate a representation of the subset of data in response to the request, wherein the representation of the subset of data includes the identification information of one of the plurality of classes and a hash of the subset of data,

the communication adapter is configured to send the representation of the subset of data from the client to a server over a network and to receive a response to the representation from the server over the network, and

the processing unit is configured to perform a reaction based on the response, the reaction including at least one of deleting the data, deleting an application associated with the data, restarting the application, or shutting down the client.

14. The client of claim 13, wherein the communication adapter is configured to send an update of the representation of the subset of data from the client to the server, in response to the subset of data being modified.

15. The client of claim 13, wherein the representation of the subset of data is generated utilizing an agent application on the client.

16. The client of claim 13, wherein the representation of the subset of data is generated utilizing a virtual machine on the client.

17. The client of claim 16, wherein the virtual machine is a Java virtual machine configured to send the representation of the subset of data to the server.

18. The client of claim 13, wherein the client includes a mobile wireless device.