Computer security system

• US 7,774,845 B2
• Filed: 11/06/2002
• Issued: 08/10/2010
• Est. Priority Date: 11/21/2001
• Status: Active Grant

• Current Assignee: British Telecommunications PLC (BT Group PLC)
• Original Assignee: British Telecommunications PLC (BT Group PLC)
• Inventors: Shipman, Robert A
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Bayou, Yonas
• Application Number:
  US10/495,165
• Publication Number:
  US 20050022014A1
• Time in Patent Office: 2,834 Days
• Field of Search: 713/201, 380/225, 380/2, 726/23
• US Class Current: 726/23
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A computer security system for use in a network environment comprising at least a plurality of user computers arranged to communicate over a network, the system comprising a warning message exchange system operable to allow the communication from the user computers of warning messages relating to suspect data identified as a possible security threat; a message counting system operable to maintain a count for every particular piece or set of suspect data based on the number of warning messages communicated relating thereto; and network security means operable to act against any particular piece or set of suspect data for which the count maintained therefor exceeds at least one threshold value.

Claims

1. A computer security system for use in a network environment comprising at least a group of user computers arranged to communicate over a network, the system comprising:

a warning message exchange system operable to allow communications from the group of user computers of warning messages relating to a piece or set of suspect data identified by one or more of the group of user computers as a possible security threat;

an identity generator operable to generate an identifier of the piece or set of suspect data;

a message counting system operable to maintain a count for every particular piece or set of suspect data based on a number of warning messages communicated over the network relating to each of the piece or set of suspect data; and

a network security system operable to act in respect of any particular piece or set of suspect data when the count maintained therefor is substantially equal to or greater than at least one threshold value, wherein the threshold value is greater than one.

2. The computer security system according to claim 1, wherein a judgment as to whether any piece or set of data present at any one or more of the user computers is a possible security threat is performed by a human user or users of the any one or more user computers.

3. The computer security system according to claim 1, wherein the network security system is further operable to compare the maintained count for the particular piece or set of suspect data against a plurality of different thresholds, and to take different action based on each of the plurality of thresholds that is met.

4. The computer security system according to claim 1, wherein the action taken by the network security system, when the maintained count is substantially equal to or greater than the at least one threshold value, comprises sending a warning to each of the group of user computers as to the suspect nature of the particular piece or set of suspect data.

5. The computer security system according to claim 1, wherein the action taken by the network security system, when the maintained count is substantially equal to or greater than the at least one threshold value, comprises preventing a transmission of the particular piece or set of suspect data across the network.

6. The computer security system according to claim 1, wherein each warning message comprises at least the identifier of the piece or set of suspect data to which it relates.

7. The computer security system according to claim 6, wherein the identifier is the piece or set of suspect data itself.

8. The computer security system according to claim 6, wherein the identifier is a repeatably generatable signature substantially unique to the piece or set of suspect data.

9. The computer security system according to claim 1, and further comprising

a network server arranged to receive each warning message communicated from the group of user computers, and further arranged to host the message counting system and at least a part of the network security system,

wherein that part of the network security system hosted by the server is operable to determine the action which should be taken against the particular piece or set of suspect data, and to communicate an action condition indicator indicative of the determined action to each of the group of user computers.

10. The computer security system according to claim 1, wherein

a warning message generated by a user computer of the group is broadcast to every other user computer of the group, and

each user computer of the group is further arranged to host its own message counting system and network security system operable in accordance with claim 1.

11. The computer security system according to claim 1, wherein the group of user computers is a first group of computer users, the computer security system further comprising:

an inter-group communications system operable to allow the communication of inter-group warning messages relating to the piece or set of suspect data identified as a possible security threat from the first group of user computers to one or more other groups of other user computers.

12. The computer security system according to claim 11, wherein the inter-group warning messages are transmitted by the inter-group communications system when the number of warning messages communicated by the user computers in the first group concerning the particular piece or set of data is equal to or greater than at least one inter-group threshold value.

13. The computer security system according to claim 12, wherein each of the at least one inter-group threshold value is the same as each corresponding value of the at least one threshold value at which the network security system takes action.

14. The computer security system according to claim 11, wherein the inter-group communications system is further arranged to receive inter-group warning messages from the one or more other groups of other user computers.

15. The computer security system according to claim 14, further comprising:

a second message counting system operable to maintain a count for every particular piece or set of suspect data based on the number of inter-group warning messages communicated relating thereto,

wherein the network security system is further operable to act against any particular piece or set of suspect data for which the count maintained therefor by the second message counting system is substantially equal to or greater than at least one inter-group threshold value.

16. The computer security system according to claim 15, wherein the network security system is further arranged to act against the particular piece or set of suspect data only if both the respective counts maintained by the message counting system and the second message counting system are substantially equal to or greater than at least the at least one threshold value and the at least one inter-group threshold value respectively.

18. A computer readable storage medium storing one or more computer programs which when run on a computer causes the computer to operate in the manner of a system according to claim 1.

17. A computer security system for use in a network environment comprising at least a group of user computers arranged to communicate over a network, the system comprising:

a warning message exchange system operable to allow communications from the group of user computers of warning messages relating to a piece or set of suspect data identified by one or more of the group of user computers as a possible security threat;

an identity generator operable to generate an identifier of the piece or set of suspect data;

a message counting system operable to maintain a count for every particular piece or set of suspect data based on a number of warning messages communicated relating to each of the piece or set of suspect data; and

a network security system operable to act in respect of any particular piece or set of suspect data when the count maintained therefor is substantially equal to or greater than at least one threshold value;

wherein the message counting system is further arranged to store one or more weighting coefficients relating to one or more particular user computers of the group, and to increment the count maintained for the particular piece or set of suspect data by an amount based upon the weighting coefficient when the warning message is received from the one or more particular user computers of the group relating to the particular piece or set of suspect data.

19. A method of providing computer security in a network environment comprising at least a group of user computers arranged to communicate over a network, the method comprising:

communicating, from one or more user computers of the group, warning messages relating to a piece or set of suspect data identified by one or more of the group of user computers as a possible security threat;

generating an identifier of the piece or set of suspect data;

maintaining a count for every piece or set of suspect data based on a number of warning messages communicated over the network relating thereto; and

acting in respect of any particular piece or set of suspect data when the count maintained therefor is substantially equal to or greater than at least one threshold value,

wherein each threshold value is greater than one.

34. The method according to claim 19, wherein a judgment as to whether any piece or set of data present at any one or more of the group of user computers is a possible security threat is performed by a human user or users of the any one or more the group of user computers.

35. The method according to claim 19, further comprising comparing the maintained count for the particular piece or set of suspect data against a plurality of different thresholds, and taking different action based on each of the plurality of thresholds that is met.

36. The method according to claim 19, wherein the acting when the maintained count is substantially equal to or greater than at least one threshold value comprises sending a warning to each of the group of user computers as to the suspect nature of the particular piece or set of suspect data.

37. The method according to claim 19, wherein the acting when the maintained count is substantially equal to or greater than at least one threshold value comprises preventing a transmission of the particular piece or set of suspect data across the network.

20. A method to be performed by a server connected a network, wherein the server is configured to serve a group of user computers also connected to the network, the method comprising:

receiving an individual warning message from a user computer of the group regarding a suspect data, wherein the suspect data is identified by the user computer as a possible security threat by the user computer;

verifying whether the suspect data is a security threat; and

broadcasting a group warning message to all user computers of the group regarding the suspect data when the suspect data is identified as being a security threat.

21. The method of claim 20,

wherein the group warning message includes an action indicator, and

wherein the action indicator indicates to the user computers of an action to take by the user computers when the suspect data is encountered.

22. The method of claim 21,

wherein the action indicator includes a block action indicator and a warning action indicator,

wherein the block action indicator indicates to the user computers that when the suspect data is encountered, the suspect data should be deleted from the user computer or should be prevented from being downloaded onto the user computer, and

wherein the warning action indicator indicates to the user computers that when the suspect data is encountered, a user of the user computer should be notified.

23. The method of claim 21, further comprising:

maintaining a count of individual warning messages received from the user computers of the group regarding the suspect data;

determining whether the count of the individual warning messages regarding the suspect data reaches above a preset threshold for the action indicator; and

broadcasting the group message with the action indicator only when the count of the individual warning messages regarding the suspect data reaches above the preset threshold for the action indicator,

wherein the preset threshold for the action indicator is greater than one.

24. The method of claim 23,

wherein the action indicator is one of at least a block action indicator and a warning action indicator,

wherein the block action indicator indicates to the user computers that when the suspect data is encountered, the suspect data should be deleted from the user computer or should be prevented from being downloaded onto the user computer,

wherein the warning action indicator indicates to the user computers that when the suspect data is encountered, a user of the user computer should be notified,

wherein the block action indicator is included in the group warning message when the count of the individual warning messages regarding the suspect data is at or above a block count threshold,

wherein the warning action indicator is included in the group warning message when the count of the individual warning messages regarding the suspect data is at or above a warning count threshold, and

wherein the block count threshold is greater than the warning count threshold.

25. A method to be performed by a server connected a network, wherein the server is configured to serve a group of user computers also connected to the network, the method comprising:

receiving an individual warning message from a user computer of the group regarding a suspect data, wherein the suspect data is identified by the user computer as a possible security threat by the user computer;

verifying whether the suspect data is a security threat; and

broadcasting a group warning message to all user computers of the group regarding the suspect data when the suspect data is identified as being a security threat;

wherein the group warning message includes an action indicator, and

wherein the action indicator indicates to the user computers of an action to take by the user computers when the suspect data is encountered;

wherein the method further comprises;

maintaining a count of individual warning messages received from the user computers of the group regarding the suspect data;

determining whether the count of the individual warning messages regarding the suspect data reaches above a preset threshold for the action indicator;

broadcasting the group message with the action indicator only when the count of the individual warning messages regarding the suspect data reaches above the preset threshold for the action indicator, wherein the preset threshold for the action indicator is greater than one;

maintaining a weight factor for a user using the group of user computers; and

adjusting the count of the individual warning messages regarding the suspect data based on the weight factor of the user using the user computer when the individual warning message is received from the user computer.

26. The method of claim 25, further comprising adjusting the weight factor for the user based on an accuracy of the user in identifying possible security threats.

27. A method to be performed by a user computer of a group of user computers connected a network, the method comprising:

identifying if a suspect data is encountered, wherein the suspect data is data identified by one or more of the group of user computers as being a possible security threat;

maintaining an encounter count of the suspect data encountered by the group of user computers; and

broadcasting a peer group warning message to all other user computers of the group regarding the suspect data, wherein the peer group warning message includes the encounter count.

28. The method of claim 27, further comprising:

determining whether the encounter count of the suspect data is at or above one or more preset thresholds; and

setting an action condition corresponding to each of the one or more preset thresholds when the encounter count of the suspect data is at or above the one or more preset thresholds,

wherein each of the one or more preset thresholds is greater than one.

29. The method of claim 28, wherein the action condition includes a block condition and a warning condition, the method further comprising:

when the block condition is set, deleting the suspect data from the user computer or preventing the suspect data from being downloaded onto the user computer when the suspect data is encountered again; and

when the warning condition is set, notifying a user of the user computer regarding the suspect data when the suspect data is encountered again.

30. The method of claim 29, wherein the preset threshold for the block condition is greater than the preset threshold for the warning condition.

31. The method of claim 27, wherein the suspect data is identified by a user using the user computer.

32. A method to be performed by a user computer of a group of user computers connected a network, the method comprising:

identifying if a suspect data is encountered, wherein the suspect data is data identified by one or more of the group of user computers as being a possible security threat;

maintaining an encounter count of the suspect data encountered by the group of user computers;

broadcasting a peer group warning message to all other user computers of the group regarding the suspect data, wherein the peer group warning message includes the encounter count, and the suspect data is identified by a user using the user computer;

maintaining a weight factor for the user using the user computer; and

adjusting the encounter count of the suspect data based on the weight factor of the user using the user computer.

33. The method of claim 32, further comprising adjusting the weight factor for the user based on an accuracy of the user in identifying possible security threats.