Updating content detection devices and systems

• US 9,774,621 B2
• Filed: 05/07/2016
• Issued: 09/26/2017
• Est. Priority Date: 03/12/2004
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Fang, Michael Yu, Xie, Michael
• Primary Examiner(s): SCHMIDT, KARI L
• Application Number:
  US15/149,083
• Publication Number:
  US 20160381044A1
• Time in Patent Office: 507 Days
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of updating a content detection module includes obtaining content detection data, and transmitting the content detection data to a content detection module, wherein the transmitting is performed not in response to a request from the content detection module. A method of sending content detection data includes obtaining content detection data, selecting an update station from a plurality of update stations, and sending the, content detection data to the selected update station. A method of building a content detection system includes establishing a first communication link between a central station and an update station, the central station configured to transmit content detection data to the update station, and establishing a second communication link between the update station and a content detection module.

Claims

1. A content detection system, comprising:

a processor;

a communication interface device;

a content detection module; and

a data storage device storing;

content detection data received by the content detection module of a first update station to detect content and for forwarding by the first update station to at least a second update station;

instructions to process content received via the communication interface device to;

determine whether received content contains suspicious content data or the suspicious content data is a threat to detect;

generate content detection data as a function of the received data when the suspicious content data contains or is a threat;

based on a list of prescribed geographic locations of the plurality of update stations to receive content detection data updates, identify, through execution of instructions on the processor, the first update station to receive the content detection data update;

identify, through execution of instructions on the processor of the network device, the at least one second update station to receive the content detection data update based on the list of prescribed geographic locations of the plurality of update stations to receive content detection data updates;

send, from the first update station via the communication interface device, the content detection data update to the at least one second update stations including data identifying at least one content detection module of a plurality of content detection modules, coupled through the network to the plurality of update stations, to receive the content detection data update and at least one instruction to distribute the content detection data update to the identified at least one content detection module, wherein the distribution is performed not in response to a request from the at least one content detection module.

2. The system of claim 1, further comprising:

instructions to select the first update station from the update stations based on real time conditions of the first update station.

3. The system of claim 1, wherein the content detection system is a central station.

4. The system of claim 1, wherein the central station is configured to select an update station of a plurality of update stations to be the first update to which the central station transmits the content detection data.

5. The system of claim 1, wherein the content detection system is configured to transmit the content detection data in substantially real time when the content is detected.

6. The system of claim 1, wherein the content detection system is selected from the group consisting of a computer, a server, a device, and a software.

7. The system of claim 1, wherein the content detection data detects malicious content.

8. The system of claim 1, wherein the content comprises at least one of:

a web page, an email, an email attachment, a word processing file, and an application program.

9. A computer-implemented method in a content detection system, the method comprising:

receiving content, via a communication interface device of the content detection system;

determining, via a processor of the content detection system executing instructions, whether the received content contains suspicious content data or the suspicious content data is a threat to detect;

generating, via the processor, content detection data as a function of the received data when the suspicious content data contains or is a threat;

based on a list of prescribed geographic locations of the plurality of update stations to receive content detection data updates, identifying, through execution of instructions on the processor, the first update station to receive the content detection data update;

identifying, through execution of instructions on the processor of the network device, the at least one second update station to receive the content detection data update based on the list of prescribed geographic locations of the plurality of update stations to receive content detection data updates;

sending, from the first update station via the communication interface device, the content detection data update to the at least one second update stations including data identifying at least one content detection module of a plurality of content detection modules, coupled through the network to the plurality of update stations, to receive the content detection data update and at least one instruction to distribute the content detection data update to the identified at least one content detection module, wherein the distribution is performed not in response to a request from the at least one content detection module.

10. A non-transitory computer readable medium storing instructions that, when executed by a processor, perform a method in a content detection system, the method comprising:

receiving content, via a communication interface device of the content detection system;

determining, via a processor of the content detection system executing instructions, whether the received content contains suspicious content data or the suspicious content data is a threat to detect;

generating, via the processor, content detection data as a function of the received data when the suspicious content data contains or is a threat;

based on a list of prescribed geographic locations of the plurality of update stations to receive content detection data updates, identifying, through execution of instructions on the processor, the first update station to receive the content detection data update;

identifying, through execution of instructions on the processor of the network device, the at least one second update station to receive the content detection data update based on the list of prescribed geographic locations of the plurality of update stations to receive content detection data updates;

sending, from the first update station via the communication interface device, the content detection data update to the at least one second update stations including data identifying at least one content detection module of a plurality of content detection modules, coupled through the network to the plurality of update stations, to receive the content detection data update and at least one instruction to distribute the content detection data update to the identified at least one content detection module, wherein the distribution is performed not in response to a request from the at least one content detection module.