Malware scanning wireless service agent system and method

• US 7,861,303 B2
• Filed: 04/12/2002
• Issued: 12/28/2010
• Est. Priority Date: 08/01/2001
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Palmer, David W., Libenzi, Davide, Fallenstedt, Martin, Kouznetsov, Victor, Pak, Michael C.
• Primary Examiner(s): Vu; Kimyen
• Assistant Examiner(s): GYORFI, THOMAS A
• Application Number:
  US10/122,087
• Publication Number:
  US 20030233566A1
• Time in Patent Office: 3,182 Days
• Field of Search: 380/270, 726 22- 25, 719/320, 719328-329, 717168-178
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 8/245 from a network towards a terminal

Abstract

A system, method and computer program product are provided for scanning a mobile wireless device for malware. Initially, a service agent is initiated utilizing a mobile wireless device. Next, information describing the mobile wireless device is transmitted to a back-end server over a wireless network utilizing the service agent of the mobile wireless device. An update is then received from the back-end server over the wireless network utilizing the service agent of the mobile wireless device. Subsequently, an anti-malware scanner installed on the mobile wireless device is updated so that the mobile wireless device may be scanned utilizing the updated anti-malware scanner.

Claims

1. A method for scanning a mobile wireless device for malware, comprising:

initiating a service agent utilizing a mobile wireless device;

transmitting information describing the mobile wireless device to a back-end server over a wireless network utilizing the service agent of the mobile wireless device;

receiving an update from the back-end server over the wireless network utilizing the service agent of the mobile wireless device;

updating an anti-malware scanner installed on the mobile wireless device with the update; and

scanning the mobile wireless device utilizing the updated anti-malware scanner;

wherein the service agent is initiated by a user interface of the mobile wireless device;

wherein the update includes a header and a plurality of parts;

wherein the parts include a part-header section and a part-data section;

wherein the update is tailored for the mobile wireless device based on data specific to the mobile wireless device;

wherein the information describing the mobile wireless device includes log data;

wherein the log data records at least one of malware activity and program activity;

wherein the log data records when services are started and stopped;

wherein the data is accessed utilizing an abstract file system interface;

wherein the mobile wireless device is updated on a schedule that is coordinated with a plurality of other mobile wireless devices for maintaining a performance of the wireless network;

wherein the anti-malware scanner utilizes a platform abstraction layer that provides components with platform independent system interfaces that interface with the mobile wireless device and an operating system thereof utilizing interfaces provided by the abstract file system interface;

wherein the platform abstraction layer includes a storage I/O component utilized to access and modify objects stored on a storage device and managed by a file system, a network socket I/O component utilized to create a socket, initialize a socket, accept a socket, read from a socket, write to a socket, and close a socket, a process control component utilized to list processes, free a process, terminate a process, open a process, and close a process, a memory component utilized to allocate memory and free memory, an event handler component utilized to set an event hander and get an event handler, a system information component utilized to get an identification code associated with the mobile wireless device, an error status component utilized to set an error and get a last error, and a miscellaneous component utilized to suspend execution for a time, set memory, copy memory, execute a buffer, and execute a file.

2. The method as recited in claim 1, wherein the log data is specific to the mobile wireless device.

3. The method as recited in claim 1, wherein the service agent is initiated by the anti-malware scanner of the mobile wireless device.

4. The method as recited in claim 1, wherein the service agent is initiated by a daemon of the mobile wireless device.

5. The method as recited in claim 1, wherein the service agent is initiated by a scheduler of the mobile wireless device.

6. The method as recited in claim 1, wherein the service agent is initiated by a trigger.

7. The method as recited in claim 1, wherein the mobile wireless device is updated based on a manual trigger.

8. The method as recited in claim 1, wherein the mobile wireless device is updated based on a self trigger.

9. The method as recited in claim 1, wherein the mobile wireless device is updated based on a scanner trigger.

10. The method as recited in claim 1, wherein the mobile wireless device is updated based on a scheduled trigger.

11. The method as recited in claim 1, wherein the mobile wireless device is updated based on an external trigger.

12. The method as recited in claim 1, wherein the update is wrapped.

13. The method as recited in claim 1, wherein scanning the mobile wireless device includes scanning the data stored in persistent memory of the mobile wireless device.

14. The method as recited in claim 13, wherein the abstract file system interface is implemented for each class of the data stored in the persistent memory.

15. The method as recited in claim 1, wherein the abstract file system interface includes an abstract directory interface.

16. The method as recited in claim 1, wherein the abstract file system interface includes data structures with call back functions.

17. The method as recited in claim 16, wherein the call back functions enumerate the data.

18. The method as recited in claim 16, wherein the call back functions manipulate the data.

19. The method as recited in claim 1, wherein the log data records events including at least one of error conditions and warnings, detection of malware, an infected file name and path, a malware name and variant, a response to the malware, a file name and path, an action taken, a starting and stopping of the services, an on-demand scan, and service agent upgrades.

20. The method as recited in claim 1, wherein the log data records an action associated with detected malware.

21. The method as recited in claim 20, wherein the action is recorded in response to completion of the action.

22. The method as recited in claim 1, wherein the log data records an action to ignore malware.

23. The method as recited in claim 1, wherein the log data records a detection of malware.

24. The method as recited in claim 1, wherein the log data includes a response to detected malware.

25. The method as recited in claim 1, wherein the log data is processed and stored in a back-end database for reporting.

26. The method as recited in claim 1, wherein the log data is logged to a single log file;

and wherein the single log file is renamed and a new single log file is started when a size of the single log file reaches a predetermined log file rotation size.

27. The method as recited in claim 1, wherein the log data included in the transmitted information is deleted from the mobile wireless device after the transmitting.

28. The method as recited in claim 1, wherein the abstract file system interface includes an abstract directory entry interface.

29. The method as recited in claim 1, wherein the abstract file system interface includes an abstract file interface.

30. The method as recited in claim 1, wherein the log data includes an identification number, a timestamp, a malware name, a malware type, an infected object, an anti-malware scanner action, a severity, and an event description.

31. The method as recited in claim 1, wherein the log data is based on XML and includes at least one message object, a malware detect object, and a service event, where each message object includes an event timestamp, a message type, and a message body, each malware detect object includes a detection timestamp, a file path, a malware name, and a malware variant, and each service event includes a service timestamp, a service name, and a service action.

32. A computer program product embodied on a non-transitory computer readable medium, comprising:

computer code for initiating a service agent utilizing a mobile wireless device;

computer code for transmitting information describing the mobile wireless device to a back-end server over a wireless network utilizing the service agent of the mobile wireless device;

computer code for receiving an update from the back-end server over the wireless network utilizing the service agent of the mobile wireless device;

computer code for updating an anti-malware scanner installed on the mobile wireless device with the update; and

computer code for scanning the mobile wireless device utilizing the updated anti-malware scanner;

wherein the service agent is initiated by a user interface of the mobile wireless device;

wherein the update includes a header and a plurality of parts;

wherein the parts include a part-header section and a part-data section;

wherein the computer program product is operable such that the update is tailored for the mobile wireless device based on data specific to the mobile wireless device;

wherein the information describing the mobile wireless device includes log data;

wherein the computer program product is operable such that the log data records at least one of malware activity and program activity;

wherein the computer program product is operable such that the log data records when services are started and stopped;

wherein the data is accessed utilizing an abstract file system interface;

wherein the computer program product is operable such that the mobile wireless device is updated on a schedule that is coordinated with a plurality of other mobile wireless devices for maintaining a performance of the wireless network;

wherein the anti-malware scanner utilizes a platform abstraction layer that provides components with platform independent system interfaces that interface with the mobile wireless device and an operating system thereof utilizing interfaces provided by the abstract file system interface;

wherein the platform abstraction layer includes a storage I/O component utilized to access and modify objects stored on a storage device and managed by a file system, a network socket I/O component utilized to create a socket, initialize a socket, accept a socket, read from a socket, write to a socket, and close a socket, a process control component utilized to list processes, free a process, terminate a process, open a process, and close a process, a memory component utilized to allocate memory and free memory, an event handler component utilized to set an event hander and get an event handler, a system information component utilized to get an identification code associated with the mobile wireless device, an error status component utilized to set an error and get a last error, and a miscellaneous component utilized to suspend execution for a time, set memory, copy memory, execute a buffer, and execute a file.

33. The computer program product as recited in claim 32, wherein the log data is specific to the mobile wireless device.

34. The computer program product as recited in claim 32, wherein the service agent is initiated by the anti-malware scanner of the mobile wireless device.

35. The computer program product as recited in claim 32, wherein the service agent is initiated by a daemon of the mobile wireless device.

36. The computer program product as recited in claim 32, wherein the service agent is initiated by a scheduler of the mobile wireless device.

37. The computer program product as recited in claim 32, wherein the service agent is initiated by a trigger.

38. The computer program product as recited in claim 32, wherein the mobile wireless device is updated based on a manual trigger.

39. The computer program product as recited in claim 32, wherein the mobile wireless device is updated based on a self trigger.

40. The computer program product as recited in claim 32, wherein the mobile wireless device is updated based on a scanner trigger.

41. The computer program product as recited in claim 32, wherein the mobile wireless device is updated based on a scheduled trigger.

42. The computer program product as recited in claim 32, wherein the mobile wireless device is updated based on an external trigger.

43. The computer program product as recited in claim 32, wherein the update is wrapped.

44. A system, comprising:

means for initiating a service agent utilizing a mobile wireless device;

means for transmitting information describing the mobile wireless device to a back-end server over a wireless network utilizing the service agent of the mobile wireless device;

means for receiving an update from the back-end server over the wireless network utilizing the service agent of the mobile wireless device;

means for updating an anti-malware scanner installed on the mobile wireless device with the update; and

means for scanning the mobile wireless device utilizing the updated anti-malware scanner;

wherein the service agent is initiated by a user interface of the mobile wireless device;

wherein the update includes a header and a plurality of parts;

wherein the parts include a part-header section and a part-data section;

wherein the system is operable such that the update is tailored for the mobile wireless device based on data specific to the mobile wireless device;

wherein the information describing the mobile wireless device includes log data;

wherein the system is operable such that the log data records at least one of malware activity and program activity;

wherein the system is operable such that the log data records when services are started and stopped;

wherein the data is accessed utilizing an abstract file system interface;

wherein the system is operable such that the mobile wireless device is updated on a schedule that is coordinated with a plurality of other mobile wireless devices for maintaining a performance of the wireless network;

wherein the anti-malware scanner utilizes a platform abstraction layer that provides components with platform independent system interfaces that interface with the mobile wireless device and an operating system thereof utilizing interfaces provided by the abstract file system interface;

wherein the platform abstraction layer includes a storage I/O component utilized to access and modify objects stored on a storage device and managed by a file system, a network socket I/O component utilized to create a socket, initialize a socket, accept a socket, read from a socket, write to a socket, and close a socket, a process control component utilized to list processes, free a process, terminate a process, open a process, and close a process, a memory component utilized to allocate memory and free memory, an event handler component utilized to set an event hander and get an event handler, a system information component utilized to get an identification code associated with the mobile wireless device, an error status component utilized to set an error, and get a last error, and a miscellaneous component utilized to suspend execution for a time, set memory, copy memory, execute a buffer, and execute a file.

45. A method for scanning a mobile wireless device for malware, comprising:

transmitting information describing a mobile wireless device to a back-end server over a wireless network utilizing a service agent of the mobile wireless device, wherein the information is specific to the mobile wireless device;

receiving an update from the back-end server over the wireless network utilizing the service agent of the mobile wireless device, wherein the update is tailored to the mobile wireless device based on the information describing the mobile wireless device; and

updating an anti-malware scanner installed on the mobile wireless device with the update;

wherein the service agent is initiated by a user interface of the mobile wireless device;

wherein the update includes a header and a plurality of parts;

wherein the parts include a part-header section and a part-data section;

wherein the update is tailored for the mobile wireless device based on data specific to the mobile wireless device;

wherein the information describing the mobile wireless device includes log data;

wherein the log data records at least one of malware activity and program activity;

wherein the log data records when services are started and stopped;

wherein the data is accessed utilizing an abstract file system interface;

wherein the mobile wireless device is updated on a schedule that is coordinated with a plurality of other mobile wireless devices for maintaining a performance of the wireless network;

wherein the anti-malware scanner utilizes a platform abstraction layer that provides components with platform independent system interfaces that interface with the mobile wireless device and an operating system thereof utilizing interfaces provided by the abstract file system interface;

wherein the platform abstraction layer includes a storage I/O component utilized to access and modify objects stored on a storage device and managed by a file system, a network socket I/O component utilized to create a socket, initialize a socket, accept a socket, read from a socket, write to a socket, and close a socket, a process control component utilized to list processes, free a process, terminate a process, open a process., and close a process, a memory component utilized to allocate memory and free memory, an event handler component utilized to set an event hander and get an event handler, a system information component utilized to get an identification code associated with the mobile wireless device, an error status component utilized to set an error and get a last error, and a miscellaneous component utilized to suspend execution for a time, set memory, copy memory, execute a buffer, and execute a file.