Instant messaging malware protection

• US 8,689,330 B2
• Filed: 09/05/2007
• Issued: 04/01/2014
• Est. Priority Date: 09/05/2007
• Status: Expired due to Fees

• Current Assignee: R2 Solutions LLC (Acacia Research Corporation)
• Original Assignee: Yahoo! Inc. (Apollo Global Management, Inc.)
• Inventors: Sinn, Richard, Jiang, Hongyan, Wong, Dudley
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US11/850,557
• Publication Number:
  US 20090064335A1
• Time in Patent Office: 2,400 Days
• Field of Search: 726/24
• US Class Current: 726/24
• CPC Class Codes: G06F 21/561 Virus type analysis
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system including a content server and a plurality of instant messaging clients is configured to enable each client device to scan for malware on incoming or outgoing instant messages. The content server may receive malware configuration information and distribute the malware configuration information to each client device. Each client device may employ the malware configuration information to perform a number of actions, including determining one or more malware scanners to use, selectively scanning incoming or outgoing instant messages, reporting instances of malware that are detected, or selectively restricting one or more instant messaging functions. The system may include a malware information repository that receives and reports of detected malware, analyzes the reports, and determines sources of malware.

Claims

1. On a client device, a method for providing security from instant messaging malware, comprising:

receiving, from a server, malware configuration information stored on the server;

receiving at least one instant message from an instant message system;

selecting from a plurality of malware scanning components a subset of two or more malware scanners based on the malware configuration information;

employing the selected malware scanners to scan the instant message for malware, at least partly based on the malware configuration information;

if at least one of the selected malware scanners detects malware, then inhibiting at least one other of the selected malware scanners from scanning;

transmitting to the server an identification of the detected malware and an identification of the at least one of the selected malware scanners that detected the malware;

receiving, in response to the transmission, further configuration information providing an order for applying the selected scanners to subsequent instant messages, the further configuration information is based on a determination of effectiveness of the selected scanners in detecting malware as made from the transmission; and

altering application of the selected scanners so that the selected scanners are applied on the subsequent instant messages in the order specified in the further configuration information.

2. The method of claim 1, further comprising selecting the subset of malware scanners from the plurality of malware scanning components installed on the client device, at least partly based on a characteristic of the client device or the identification of the user.

3. The method of claim 1, further comprising selectively employing another malware scanner to concurrently scan another instant message for malware, at least partly based on the malware configuration information.

4. The method of claim 1, further comprising:

selectively employing another malware scanner to scan the instant message for malware, at least partly based on the malware configuration information; and

determining an ordering to employ the malware scanner and the other malware scanner, at least partly based on information associated with the instant message.

5. The method of claim 1, wherein selectively employing the malware scanner is at least partly based on at least one of a geographic location associated with a sender of the instant message, a group membership associated with the sender of the instant message, or a type of the instant message.

6. The method of claim 1, further comprising if malware associated with the instant message is detected, sending information associated with the detected malware to a malware information repository.

7. The method of claim 1, further comprising if malware associated with the instant message is detected, disabling a function associated with a type of the instant message.

8. The method of claim 1, further comprising

selectively scanning another instant message for malware, at least partly based on the malware configuration information;

and

selectively sending the other message to another client device, ai least partly based on the selective scanning of the other instant message.

9. The method of claim 1, wherein the malware configuration information received from the server is at least partly based on information sent from the client device to the server that includes at least one of geographic information, group membership, subscription information, preferences, or capacities associated with the client device.

10. The method of claim 1, further comprising:

detecting another instant message to be sent from the client device; and

employing the plurality of malware scanners on the other instant message for malware, at least partly based on the malware configuration before the other message is allowed to be transmitted by the client device to another client device.

11. A system for providing security comprising

a processor and a processor readable memory comprising program logic that causes the processor to:

receive from a server, malware configuration information stored on the server;

receive an instant message from an instant message system;

select from a plurality of malware scanning components, a subset of two or more malware scanners based on the malware configuration information;

employ the selected malware scanners to scan the instant message for malware based at least on the malware configuration information;

if at least one of the selected malware scanners detects malware, then inhibit at least one other of the selected malware scanners from scanning;

transmit to the server an identification of the detected malware and an identification of the at least one of the selected malware scanners that detected the malware;

receive in response to the transmission, further configuration information providing an order for applying the selected scanners to subsequent instant messages, the further configuration information is based on a determination of effectiveness of the selected scanners in detecting malware as made from the transmission;

alter application of the selected scanners so that the selected scanners are applied on the subsequent instant messages in the order specified in the further configuration information.

12. A computing device for providing security to a plurality of client devices communicating by sending and receiving instant messages, the computing device comprising:

a memory for storing a plurality of components; and

a processor for executing components, including;

at least one content component that receives and stores malware configuration information, and sends the malware configuration information to each client device, the malware configuration information enabling each of the plurality of client devices to selectively scan instant messages for malware, the malware configuration information enabling each client device to select from a plurality of malware scanning components, a subset of two or more malware scanners to be employed to scan instant messages based in part on a characteristic of each client device; and

a repository component that determines from malware reports transmitted by the plurality of clients, an identity of malware detected by a client of the plurality of clients and an identification of at least one of the malware scanning components that detected the malware, the repository component configured to determine effectiveness of malware detection by the subset of selected malware scanners based on the malware reports and provide to the plurality of client devices, within further configuration information an order of applying the subset of malware scanners to scan instant messages based on the determined effectiveness.

13. The computing device of claim 12, further comprising a malware searching component that performs actions, including:

based on the malware reports, determines a source of at least one malware instance; and

generates additional malware configuration information that enables each of the plurality of clients to restrict instant messaging communication with the source of the at least one malware instance.

14. The computing device of claim 12, further comprising an interface to another system that enables the other system to restrict communication with a source of at least one malware instance, based on the malware reports, wherein the communication is at least one of an email communication or a communication with a web site.

15. The computing device of claim 12, wherein the malware configuration information enables each of the plurality of clients to determine an instant messaging function to be disabled and to at least partially disable the determined instant messaging function.

16. The computing device of claim 12, wherein the malware configuration information enables each of the plurality of clients to, in response to receiving an instant message, determine a malware scanner to invoke at least partially based on at least one of a source of the instant message, a type of the message, or a location of the receiving client.

17. A system for providing security to a plurality of client devices communicating by sending and receiving instant messages, the system comprising a processor and a processor readable memory comprising program logic which when executed by the processor causes the processor to:

receive from at least one of a plurality of client devices, malware configuration information comprising an identification of a detected malware and an identification of the one or more of a selected plurality of malware scanners that detected the malware;

store the received malware configuration information;

distribute the malware configuration information to each of the plurality of client device

cause each of the plurality of client devices to selectively scan instant messages for malware including instant messages originating at the client device and prior to the instant message being transmitted from the client device to another client device; and

enable each client device of the plurality of client devices to selectively determine at least two malware scanners to invoke for scanning a received instant message, to selectively scan the received instant message, and to selectively restrict instant messaging communication, at least partly based on information associated with the received instant message.

18. The system of claim 17, further comprising an instant messaging system, and that distributes at least a portion of the malware configuration information to each client device of the plurality of client devices in response to each client device logging on to the instant messaging system.

19. The system of claim 17, further comprising a malware information repository that receives reports of a plurality of malware instances from client devices of the plurality of client devices, processes the reports, and determines sources of the plurality of malware instances.

20. The system of claim 17, wherein enabling each client device to selectively invoke a malware scanner further comprises transmitting computer-executable instructions, wherein the execution of the computer-executable instructions provides for enabling actions including registering at least one malware scanner and selectively scanning the received instant message at least partly based on information associated with the received instant message.