NETWORK BROWSER BASED VIRUS DETECTION

• US 20090282485A1
• Filed: 02/17/2009
• Published: 11/12/2009
• Est. Priority Date: 05/12/2008
• Status: Active Grant

• Current Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Original Assignee: Enpulz LLC
• Inventors: Bennett, James D.
• Granted Patent: US 8,839,431 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A network browser has a Malware detection manager for direct or indirect scanning of files during an upload or download processes for viruses, adware, spyware, etc. The malware detection manager defines and employs a quarantine bin, which is an isolated and secure memory space or directory for temporary placement of file packets during the file transmission while malware detection can commence. The malware detection manager scans for any malware code associated with the packet sequence encountered during a file transmission to and from the Internet, during which it quarantines all the scanned packets in the quarantine bin. Quarantined files can be released if there is a human challenge authorizing the release of the file. The invention also comprises exchanging a Malware free signature between server and client via a trusted download center. If a certified and valid malware free signature is provided, the client device need not scan the files for malware bytes as the content is certified and guaranteed as malware-free.

Claims

1. A computing device that is adapted to be coupled to a network, the computing device comprising:

network interface circuitry;

computer memory; and

processing circuitry coupled to the network interface circuitry and computer memory wherein the network interface circuitry, the computer memory, and the processing circuitry are operable to;

search for information on the network;

receive search results from the network in response to user searches;

request data from the network in response to user interaction with the search results;

receive the data from the network;

quarantine the data in a safe portion of the computer memory;

scan the data while within the safe portion of the computer memory for any presence of malware before providing the data to the user for access and use;

release the data from the safe portion of the computer memory when malware is not found; and

perform corrective measures on the data if malware is found.

2. The computing device of claim 1 wherein the safe portion of the computer memory is isolated from certain operating system functionality and certain access to hardware within the computing device, whereby the data can be placed into the safe portion and processed to detect malware without adversely affecting the computing device.

3. The computing device of claim 2 wherein the safe portion contains a virtual machine that simulates access to an operating system and to certain hardware within the computing device wherein the data downloaded can be enabled within virtual machine to monitor its operation for the presence of malware without affecting the actual operating system and certain hardware of the computing device.

4. The computing device of claim 1 wherein the corrective measure involves continuing the quarantining of the data that contains malware for an extended period of time due to the presence of the malware.

5. The computing device of claim 4 wherein the corrective measure involves continuing the quarantining of the data that contains malware for an extended period of time due to the presence of the malware but allowing the data to be released from the safe portion of the computer memory if a human user challenges the quarantine and authorizes the release of the data from quarantine.

6. The computing device of claim 5 wherein the computing device begins to use the data that was released from the safe portion of the computer memory, but wherein this data is subject to special security processing while being used within the computing device due to the presence of the malware, even though the human user released the data from quarantine.

7. The computing device of claim 1 wherein the corrective measure involves deleting the data from the computing device.

8. The computing device of claim 1 wherein the corrective measure involves removing the malware from the data to create malware-free data and releasing the malware free data from the safe potion of the computer memory for use by the user.

9. The computing device of claim 1 wherein the corrective measure involves removing malware-infected portions of the data from the rest of the data and providing the rest of the data to the user while either deleting or quarantining the malware-infected portions of the data.

10. The computing device of claim 1 wherein various characteristics of the safe portion of the computer memory are configured by the user of the computing device through at least one user interface of the computer device.

11. The computing device of claim 9 wherein the various characteristics of the safe portion of the computer memory include both the level of isolation of the safe portion from an operating system and various hardware of the computing device and the size of the safe portion of computer memory.

12. The computing device of claim 1 wherein the level of isolation and the size of the safe portion of the computer memory can dynamically change over time under control of the computing device as the data within the safe portion changes over time.

13. The computing device of claim 1 wherein the data is downloaded from a trusted site that contains a signature associated with the data, wherein the computing device can process the signature and determine that the data is clean of malware without having to perform local malware scanning within the safe portion of the computer memory.

14. The computing device of claim 1 wherein the malware is one or more of a Trojan horse, a virus, spyware, or adware, and wherein the malware is found by either scanning the data to detect certain patterns of data within the data or by allowing the data to function within the safe portion and monitoring the data while the data functions to detect any malware characteristics.

15. The computing device of claim 1 wherein the scan of the data for malware detection is performed as part of a browser within the computing device whereby the scan for malware is performed for each search result that the user elects to see while browsing, and the malware scanning and corrective measures if malware is found are performed on search results that the user decides to process via the browser.

16. The computing device of claim 1 wherein the scan of the data for malware detection is performed as part of browser operations performed on the computing device and is also performed on data exchanged between peripheral devices associated with the computing device.

17. The computing device of claim 1 wherein the computing device contains multiple CPU cores and several of the multiple CPU cores scan, in a parallel-processed manner, the data within the safe portion of the computer memory for malware.

18. The computing device of claim 1 wherein the data is associated with a signature after completion of the scan for malware, where the signature can be used by the computing device to provide the data to other computers in a manner that ensures to the other computers that the data is unchanged from its malware free state and certified as malware scanned whereby other computers may elect for forgo their own malware scan operations on the data.

19. A computing device that is adapted to be connected to an Internet backbone and adapted to supports a web browser for searching of information over the Internet backbone, the computing device comprising:

one or more central processing units;

a network interface circuit coupled to the one or more central processing units; and

storage memory accessible to the at least one or more central processing units wherein the storage memory comprises;

a malware detection manager that is coupled with a web browser accessible by the computing device, the malware detection manager supporting malware scans of data that is transacted in response to data requests made via the web browser;

a secure quarantine memory space within the storage memory where data that is coining into the computing device at the request of the web browser is stored for malware processing; and

malware detection logic and at least one comparison agent that is communicatively coupled to the storage memory and used to scan, within the secure quarantine memory space, the data coming into the computing device in response to that data being requested by the web browser, wherein the malware detection logic and at least one comparison agent processes the data for malware code by processing incoming data packets to the computing device under control of the malware detection manager and wherein the malware detection involves quarantining or repairing code in response to detection of malware before the malware is presented to the full function of the computing device and processing and attaching a malware-free signature to data that is detected as malware free whereby the malware-free signature may be transmitted by the computing device as indicia of the malware free state of the data and used by other computers to maintain a malware free state over the Internet backbone.

20. The computing device of claim 19, wherein data is also scanned for malware presence before sending data from the computing device to another device at the request of the web browser.

21. The computing device of claim 19, wherein the malware detection logic and a comparison agent executes a malware detection module to quarantine incoming packets and stop or delete data downloading if any data is infected by at least one type of malware code.

22. A method for scanning data to detect and handle the presence of malware, the method comprising:

initiating a data transfer from a computer device through a network interface circuitry during an upload or download operation requested by a web browser resident in memory;

placing the data into a quarantine memory space within the computer device to process or simulate the data to enable detection of any malware code in the data, the quarantine memory space not allowing the data to have full access within the computer device;

attempting to correct or remove the presence of malware within the data if malware is detected within the data;

releasing the data from the quarantine memory space for greater access within the computing device if any detected malware was properly corrected or removed;

providing a notice through the web browser to a user that malware was found and presenting a status and level of harm indication for the malware detected;

receiving input from the user regarding next steps to be taken in response to the detection of malware; and

either quarantining, deleting, or providing to the user, the data from the quarantine space after malware scanning is complete, wherein one of either quarantining, deleting, or providing the data to the user is decided by the computing device in response to the input from the user.

23. The method of claim 22 wherein the step of providing a notice to a user involves embedding indicators in the browser content displayed to the user wherein the indicators identify for the user what content within the browser content is associated with malware.

24. A method for browsing data using a browser on a computer wherein malware is scanned for and prevented from infecting the computer while browsing the data, the method comprising:

(a) initiating a search request over a network through a communication interface circuit;

(b) receiving search result information in response to the search request;

(c) storing the search result information in quarantine memory space before presentation to the user;

(d) scanning the search result information for the presence of malware;

(e) taking action to notify the user of the presence of malware and taking action to ensure that certain malware that is present is reasonably prevented from infecting the computer;

(f) presenting the search result information to the user on the computer;

(g) allowing a user to interface with the search result information to request more search result information;

(h) repeating steps (a) through (h) as the user interfaces with more search result information.

25. The method of claim 24 wherein the step of scanning involves performing the scanning in the quarantine memory space which is a portion of computer memory that is at least partially isolated from certain operating system functionality and certain access to hardware and software within the computer, whereby the search result information can be placed into the quarantined memory space and processed to detect malware while reducing the chance of malware infection of the computer.

26. The method of claim 25 wherein the quarantine memory contains a virtual machine that simulates access to an operating system and to certain hardware within the computer wherein certain content within the search result information can be executed within the virtual machine to monitor its operation for the presence of malware without adversely affecting the operating system and certain hardware of the computer.