SYSTEM AND METHOD FOR TRIGGERING AND PERFORMING SCANS TO PROTECT VIRTUAL ENVIRONMENTS

• US 20160119368A1
• Filed: 01/04/2016
• Published: 04/28/2016
• Est. Priority Date: 08/26/2008
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Hamilton, Rick A. II, O'Connell, Brian M., Pickover, Clifford A., Walker, Keith R.
• Granted Patent: US 10,069,850 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: A63F 13/75 Enforcing rules, e.g. detecting foul play or generating lists of cheating players
• CPC Class Codes: A63F 13/79 involving player-related data, e.g. identities, accounts, preferences or play histories
• CPC Class Codes: A63F 2300/535 for monitoring, e.g. of user parameters, terminal parameters, application parameters, network parameters
• CPC Class Codes: A63F 2300/5553 user representation in the game field, e.g. avatar
• CPC Class Codes: A63F 2300/5586 for enforcing rights or rules, e.g. to prevent foul play
• CPC Class Codes: G06F 16/90344 by using string matching techniques
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06Q 10/087 Inventory or stock management, e.g. order filling, procurement or balancing against orders
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 30/0643 Graphical representation of items or shoppers
• CPC Class Codes: G07F 17/3241 Security aspects of a gaming system, e.g. detecting cheating, device integrity, surveillance computer security G06F21/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A system and method in a virtual universe system for triggering scans of virtual items and inventories of virtual items and for scanning the virtual items and inventories wherein the scans may be triggered by an avatar moving or teleporting from one region to another, or by an avatar picking up, dropping off, or accepting or purchasing an item. The degree of scanning may depend upon factors such as location where these scan triggers occur. The signature of the item may be identified by the scan process. The item signature may be compared against signatures of known malicious items stored in an inventory item signatures database and a summary of the signature comparison may be sent to a resident and stored in the resident'"'"'s inventory.

Claims

1. A method for triggering scans of items in a virtual universe, the virtual universe having at least one avatar owned by a resident, at least one avatar having an item and an item inventory, the method comprising:

scanning at least a portion of the item inventory belonging to the avatar;

determining if the item inventory is acting differently than a normal virtual item, and if so;

triggering an item alert and blocking the virtual item,

checking attributes against attributes of known malicious virtual items, and

updating an inventory item safety summary accordingly.

2. The method as defined in claim 1, further comprising determining if background monitoring is enabled.

3. The method as defined in claim 1 further comprising determining if the item is being placed in or removed from the item inventory.

4. The method as defined in claim 1 further comprising determining if the item is being picked up from or deposited in a region.

5. The method as defined in claim 1 further comprising:

determining if the item is acting differently from a normal item; and

if it is determined that the item is acting different from the normal item, triggering an item alert and blocking the item.

6. The method as defined in claim 5, further comprising:

if it is determined that the item is acting different from the normal item,

checking attributes against attributes of known malicious items, and

updating an inventory item safety summary accordingly.

7. The method as defined in claim 1 further comprising determining if the item is being purchased.

8. A system for dynamically expanding computing resources in a networked computing environment, comprising:

a memory medium comprising instructions;

a bus coupled to the memory medium; and

a processor coupled to the bus that when executing the instructions causes the system to;

provide a virtual universe having at least one avatar owned by a resident, the at least one avatar having an item and an item inventory;

scan at least a portion of the item inventory;

determine if the item inventory is acting differently than a normal virtual item, and if so;

trigger an item alert and blocking the virtual item,

check attributes against attributes of known malicious virtual items, and

update an inventory item safety summary accordingly.

9. The system of claim 8, the memory medium further comprising instructions for causing the system to determine if background monitoring is enabled.

10. The system of claim 8, the memory medium further comprising instructions for causing the system to determine if the item is being placed in or removed from the item inventory.

11. The system of claim 8, the memory medium further comprising instructions for causing the system to determine if the item is being picked up from or deposited in a region.

12. The system of claim 8, the memory medium further comprising instructions for causing the system to determine if the item is being picked up from or deposited in a region.

13. The system of claim 8, the memory medium further comprising instructions for causing the system to:

determine if the item is acting differently than a normal item;

if so;

trigger an item alert and blocking the item;

compare attributes of the item with attributes of known malicious items;

identify similarities and differences between the attributes of the item with attributes of known malicious items; and

determine maliciousness of the item based upon the identified similarities and the differences; and

update an inventory item safety summary with the determined maliciousness of the item.

14. The system of claim 8, wherein the item has a signature and a location and the virtual universe has an inventory item signature database having signatures of known malicious items, and wherein the memory medium further comprising instructions for causing the system to:

determine a location of the item;

scan a signature of the item based upon the location;

compare the item signature with signatures of known malicious items in an inventory item signature database;

determine maliciousness of the item based upon an extent of similarity of the match between the item signature and signatures of the known malicious items in the inventory item signature database; and

notify the resident of the maliciousness determination result.

15. A computer program product embodied in a computer readable medium for operating in a system comprising at least one computer system having a network adapter for accessing a network, a processing unit, and a memory, for implementing a method for triggering scans of items in a virtual universe, the virtual universe having at least one avatar owned by a resident, at least one avatar having an item and an item inventory, the method comprising:

scan at least a portion of the item inventory belonging to the avatar;

determine if the item inventory is acting differently from a normal virtual item, and if so;

trigger an item alert and blocking the virtual item,

check attributes against attributes of known malicious virtual items, and

update an inventory item safety summary accordingly.

16. The computer program product as defined in claim 15 wherein the method further comprises:

determine if background monitoring is enabled.

17. The computer program product as defined in claim 15 wherein the method further comprises:

determine if the item is being placed in or removed from the item inventory.

18. The computer program product as defined in claim 15 wherein the method further comprises:

determine if the item is being picked up from or deposited in a region.

19. The computer program product as defined in claim 15 wherein the method further comprises:

determine whether background monitoring is enabled.

20. The computer program product as defined in claim 15 wherein the item has a signature and a location and the virtual universe has an inventory item signature database having signatures of known malicious items and wherein the method further comprises:

determining a location of the item;

scanning a signature of the item based upon the location;

comparing the item signature with signatures of known malicious items in the inventory item signature database;

determining the maliciousness of the item based upon the extent of the similarity between the item signature and the signatures of the known malicious items in the inventory item signature database; and

notifying a resident of the virtual universe of the maliciousness determination result.