Innoculation of computing devices against a selected computer virus

• US 7,287,278 B2
• Filed: 10/09/2003
• Issued: 10/23/2007
• Est. Priority Date: 08/29/2003
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Liang, Yung Chang
• Primary Examiner(s): Song; Hosuk
• Application Number:
  US10/683,554
• Publication Number:
  US 20050050378A1
• Time in Patent Office: 1,475 Days
• Field of Search: 726 22- 25, 713/188
• US Class Current: 726/22
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

In a distributed network having a number of server computers and associated client devices, method of creating an anti-computer virus agent is described. As a method, the inoculation is carried out by parsing a selected computer virus into a detection module that identifies a selected one of the client devices as a target client device, an infection module that causes the virus to infect those target client devices not infected by the selected virus, and a viral code payload module that infects the targeted client device modifying the infection module to infect those computers already infected by the selected virus; and incorporating inoculation viral code in the payload module that acts to prevent further infection by the selected virus.

Claims

1. In a distributed network having a number of server computers and associated client devices, method of creating and implementing an anti-computer virus agent, comprising:

correlating virus reports to determine whether there is a virus outbreak;

identifying a virus;

locating an associated anti-virus;

parsing the virus into a detection module that identifies a selected one of the client devices as a target client device, an infection module that causes the virus to infect the target client device not infected by the selected virus, and a viral code payload module that infects the targeted client device;

analyzing the infection module to determine the method of infection and the anti-viral payload module to determine the deleterious effects;

modifying the infection module to infect client devices already infected by the virus;

incorporating the anti-virus into the payload module that acts to prevent further infection by the virus;

forming an anti-computer virus agent by combining the detection module, the modified infection module and the modified viral payload module;

locating client devices infected by the virus;

determining whether a cleaning tool for utilizing the anti-virus is present on the infected client device and if not, route all traffic to and from the infected client device to a cleaning tool server;

using the anti-virus in the viral code payload module of the anti-computer virus agent to overwrite the virus in client devices infected by the virus; and

inoculating uninfected client devices using the anti-computer virus agent.

2. A method as recited in claim 1, further comprising:

incorporating repair code into the viral payload module that acts to repair any damage in the infected client device caused by the virus.

3. A method us recited in claim 1 wherein the anti-virus includes an inoculation viral code component.

4. In a distributed network having a number of server computers and associated client devices, computer program product for creating an anti-computer virus agent, comprising:

computer code for parsing a selected computer virus into a detection module that identifies a selected one of the client devices as a target client device, an infection module that causes the virus to infect those target client devices not infected by the selected virus, and a viral code payload module that infects the targeted client device

computer code for modifying the infection module to infect those computers already infected by the selected virus;

computer code for incorporating inoculation viral code in the payload module that acts to prevent further infection by the selected virus; and

computer readable medium for storing the code.

5. Computer program product as recited in claim 4, further comprising:

computer code for incorporating repair viral code in the payload module that acts to repair any damage in the infected client device caused by the selected virus.

6. A computer program product as recited in claim 4 wherein the anti-virus includes an inoculation viral code component.