METHOD AND APPLICATIONS FOR DETECTING COMPUTER VIRUSES

• US 20090077665A1
• Filed: 03/20/2006
• Published: 03/19/2009
• Est. Priority Date: 03/22/2005
• Status: Abandoned Application

• Current Assignee: Panasonic Corporation (Panasonic Holdings Corporation)
• Original Assignee: Matsushita Electric Industrial Company Limited (Panasonic Holdings Corporation)
• Inventors: Chang, Yi-Wen
• Application Number:
  US11/909,292
• Publication Number:
  US 20090077665A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method for detecting computer viruses includes the following steps: (a) enabling a server device to make statistics of computer virus infection record of a mobile terminal and infection record of all computer viruses in a network so as to obtain infection number rankings of viruses that infected the mobile terminal and all computer viruses in the network, respectively; (b) enabling the server device to generate virus pattern data according to infection number ranking results of the viruses that infected the mobile terminal and all computer viruses in the network; (c) enabling the server device to transmit the virus pattern data to the mobile terminal; (d) enabling the mobile terminal to receive data via the network; and (e) enabling the mobile terminal to detect whether the data is infected by a computer virus with reference to the virus pattern data, and to transmit computer virus infection information to the server device upon detection that the data is infected by a computer virus.

Claims

1. A method for detecting computer viruses, which is adapted for detecting whether data received by a mobile terminal via a network is infected by a computer virus, said method comprising the steps of:

(a) enabling a server device to make statistics of computer virus infection record of the mobile terminal and infection record of all computer viruses in the network, respectively, so as to obtain infection number rankings of viruses that infected the mobile terminal and all computer viruses in the network, respectively;

(b) enabling the server device to generate virus pattern data according to infection number ranking results of the viruses that infected the mobile terminal and all computer viruses in the network;

(c) enabling the server device to transmit the virus pattern data to the mobile terminal via the network;

(d) enabling the mobile terminal to receive the data via the network; and

(e) enabling the mobile terminal to detect whether the data is infected by a computer virus with reference to the virus pattern data, and to transmit computer virus infection information to the server device upon detection that the data is infected by a computer virus.

2. The method for detecting computer viruses as claimed in claim 1, wherein the virus pattern data includes virus information of at least one kind of computer virus that had infected the mobile terminal and at least one kind of computer virus that had infected the network.

3. The method for detecting computer viruses as claimed in claim 1, wherein, if the mobile terminal did not detect that the data is infected by a computer virus according to the virus pattern data in step (e), said method further comprising the following steps after step (e):

(f) enabling the mobile terminal to transmit the data to the server device;

(g) enabling the server device to further detect whether the data is infected by a computer virus with reference to a complete set of virus pattern data therein; and

(h) if the server device detected that the data is infected by a computer virus with reference to the complete set of virus pattern data therein, enabling the server device to transmit computer virus infection information of the mobile terminal to the mobile terminal.

4. The method for detecting computer viruses as claimed in claim 3, further comprising:

prior to step (f), enabling the mobile terminal to determine based on criteria as to whether the data should be sent to the server device for further detection if the data is infected by a computer virus; and

after step (f), enabling the mobile terminal to update the criteria therein.

5. A mobile terminal adapted for detecting, with assistance from a server device, whether data received via a network is infected by a computer virus, said mobile terminal comprising:

a virus infection information database for storing computer virus infection information;

a virus pattern database for recording virus pattern data;

a transceiver unit for sending the computer virus infection information to the server device and for receiving the data via the network;

a virus pattern updating unit for updating the virus pattern data stored in said virus pattern database;

a virus detecting unit for detecting whether the data received by said transceiver unit is infected by a computer virus with reference to the virus pattern data stored in said virus pattern database; and

an infection information notifying and storing unit for notifying the server device that the data received by said transceiver unit is infected by a computer virus according to a virus detection result received from said virus detecting unit, and for recording the computer virus infection information in said virus infection information database.

6. The mobile terminal as claimed in claim 5, wherein the virus pattern data includes virus information of at least one kind of computer virus that had infected the mobile terminal and at least one kind of computer virus that had infected the network.

7. The mobile terminal as claimed in claim 5, wherein said transceiver unit is further used for receiving the computer virus infection information from the server device and for transmitting the data to the server device, said infection information notifying and storing unit being further used for storing the computer virus infection information received from the server device in said virus infection information database, said mobile terminal further comprising:

a criteria database for recording criteria; and

a criteria inspecting and updating unit for determining based on the criteria whether the data should be sent to the server device for further detection if the data is infected by a computer virus when said virus detecting unit did not detect that the data is infected by a computer virus according to the virus pattern data, and for updating the criteria in said criteria database according to the computer virus infection information received from one of said virus detecting unit and the server device.

8. A server device adapted for assisting a mobile terminal via a network to detect whether data received via the network is infected by a computer virus, said server device comprising:

a virus infection information database for storing computer virus infection information of the mobile terminal and infection information of all computer viruses in the network;

a virus pattern database for recording virus pattern data of all computer viruses in the network;

a statistics unit for making statistics of computer virus infection record of the mobile terminal and infection record of all computer viruses in the network as found in said virus infection information database so as to obtain infection number rankings of viruses that infected the mobile terminal and all computer viruses in the network;

a ratio determining unit for determining a ratio of a number of kinds of computer viruses that had infected the mobile terminal to a number of kinds of computer viruses that had infected the network for subsequent generation of virus pattern data according to the infection number rankings of the viruses that infected the mobile terminal and all computer viruses in the network as determined by said statistics unit;

a virus pattern generating unit for generating the virus pattern data according to the ratio determined by said ratio determining unit, wherein the virus pattern data is to be transmitted to the mobile terminal for subsequent use by the mobile terminal in detecting whether the data received via the network is infected by a computer virus;

a transceiver unit for sending and receiving the computer virus infection information and the data, and for sending the virus pattern data to the mobile terminal; and

a virus detecting unit for detecting whether data transmitted from the mobile terminal is infected by a computer virus with reference to the virus pattern data of all computer viruses as recorded in said virus pattern database, and for storing the computer virus infection information in said virus infection information database.

9. The server device as claimed in claim 8, wherein the virus pattern data includes virus information of at least one kind of computer virus that had infected the mobile terminal and at least one kind of computer virus that had infected the network.