System and method for triggering and performing scans to protect virtual environments

• US 9,256,737 B2
• Filed: 08/26/2008
• Issued: 02/09/2016
• Est. Priority Date: 08/26/2008
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Hamilton, Rick A. II, O'Connell, Brian M., Pickover, Clifford A., Walker, Keith R.
• Primary Examiner(s): Khoshnoodi, Nadia
• Application Number:
  US12/198,145
• Publication Number:
  US 20100057478A1
• Time in Patent Office: 2,723 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: A63F 13/75 Enforcing rules, e.g. detecting foul play or generating lists of cheating players
• CPC Class Codes: A63F 13/79 involving player-related data, e.g. identities, accounts, preferences or play histories
• CPC Class Codes: A63F 2300/535 for monitoring, e.g. of user parameters, terminal parameters, application parameters, network parameters
• CPC Class Codes: A63F 2300/5553 user representation in the game field, e.g. avatar
• CPC Class Codes: A63F 2300/5586 for enforcing rights or rules, e.g. to prevent foul play
• CPC Class Codes: G06F 16/90344 by using string matching techniques
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06Q 10/087 Inventory or stock management, e.g. order filling, procurement or balancing against orders
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 30/0643 Graphical representation of items or shoppers
• CPC Class Codes: G07F 17/3241 Security aspects of a gaming system, e.g. detecting cheating, device integrity, surveillance computer security G06F21/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A system and method in a virtual universe system for triggering scans of virtual items and inventories of virtual items and for scanning the virtual items and inventories wherein the scans may be triggered by an avatar moving or teleporting from one region to another, or by an avatar picking up, dropping off, or accepting or purchasing an item. The degree of scanning may depend upon factors such as location where these scan triggers occur. The signature of the item may be identified by the scan process. The item signature may be compared against signatures of known malicious items stored in an inventory item signatures database and a summary of the signature comparison may be sent to a resident and stored in the resident'"'"'s inventory.

Claims

1. A computer system comprising a processor and a memory, the computer system generating a virtual universe having at least one avatar, the computer system comprising:

a trigger identification unit for receiving an identified item scan trigger circumstance;

an item scanner for scanning, based on a location of the virtual item in the virtual universe, each virtual item in an inventory of the avatar, including the virtual item, to determine whether the virtual item is malicious, wherein a frequency of scanning the inventory of the avatar is increased in the case that the location of the virtual item in the virtual universe indicates a higher potential for malicious items;

an item movement sensor for sensing the movement of the virtual item; and

an avatar teleport sensor for sensing the teleporting of the avatar.

2. The system as defined in claim 1, wherein the trigger identification unit comprises an item acceptance sensor for sensing an acceptance of a virtual item by an avatar and an item purchase sensor for sensing a purchase of a virtual item by an avatar.

3. The system as defined in claim 1 further comprising an inventory item signatures database having signatures of known malicious virtual items, and wherein the item scanner identifies the scanned item signature and compares the scanned item signature with the signatures in the inventory item signatures database.

4. The system as defined in claim 3, wherein the signatures in the inventory item signatures database include scripts, and wherein the item scanner comprises a script scanner for scanning the scripts of a virtual item and for comparing the scanned scripts with the scripts in the inventory item signatures database.

5. The system as defined in claim 4, wherein the avatar has an inventory having one or more virtual items, and wherein the item scanner provides a summary of the scan of the virtual item to the avatar for storing the summary in the inventory.

6. A method for triggering scans of items in a virtual universe, the virtual universe having at least one avatar owned by a resident, the at least one avatar having a virtual item and an item inventory, the method comprising:

receiving an item scan trigger circumstance; and

scanning, based on a location of the virtual item in the virtual universe, each virtual item in an inventory of the avatar, including the virtual item, to determine whether the virtual item is malicious, wherein a frequency of scanning the inventory of the avatar is increased in the case that the location of the virtual item in the virtual universe indicates a higher potential for malicious items;

determining if background monitoring is enabled and, if background monitoring is enabled, scanning at least a portion of the item inventory belonging to the avatar;

determining if the virtual item is acting differently than a normal virtual item, and if so;

triggering an item alert and blocking the virtual item,

checking attributes against attributes of known malicious virtual items, and

updating an inventory item safety summary accordingly.

7. The method as defined in claim 6 further comprising determining if the virtual item is being placed in or removed from the item inventory belonging to the avatar.

8. The method as defined in claim 6 further comprising determining if the virtual item is being picked up from or deposited in a region of the virtual universe.

9. The method as defined in claim 6 further comprising determining if the virtual item is being purchased by the avatar.

10. A method for deploying a computing infrastructure comprising integrating computer-readable code into a computing system, wherein the code in combination with the computing system is capable of performing a process for triggering scans of virtual items in a virtual universe, the virtual universe having at least one avatar owned by a resident, the at least one avatar having a virtual item and an item inventory, the process comprising:

receiving an item scan trigger circumstance;

scanning, based on a location of the virtual item in the virtual universe, each virtual item in an inventory of the avatar, including the virtual item, to determine whether the virtual item is malicious, wherein a frequency of scanning the inventory of the avatar is increased in the case that the location of the virtual item in the virtual universe indicates a higher potential for malicious items;

determining if background monitoring is enabled and, if background monitoring is enabled, scanning at least a portion of the item inventory belonging to the avatar;

determining if the virtual item is acting differently than a normal virtual item, and if so;

triggering an item alert and blocking the virtual item,

comparing attributes of the virtual item with attributes of known malicious virtual items,

identifying similarities and differences between the attributes of the virtual item with attributes of known malicious items,

determining the maliciousness of the virtual item based upon the identified similarities and the differences, and

updating an inventory item safety summary with the determined maliciousness of the virtual item.

11. The method as defined in claim 10, wherein the process further comprises determining if the virtual item is being placed in or removed from the item inventory belonging to the avatar.

12. The method as defined in claim 10, wherein the process further comprises determining if the virtual item is being picked up from or deposited in a region of the virtual universe.

13. The method as defined in claim 10, wherein the virtual item has a signature, and the virtual universe has an inventory item signature database having signatures of known malicious virtual items, and wherein the process further comprises:

scanning the signature of the virtual item based upon the location;

comparing the item signature with signatures of known malicious virtual items in the inventory item signature database;

determining the maliciousness of the virtual item based upon the extent of similarity of the match between the item signature and the signatures of the known malicious virtual items in the inventory item signature database; and

notifying the resident of the maliciousness determination result.

14. The method as defined in claim 10, wherein the process further comprises creating a summary of the virtual item scan and sending the summary to a resident for storage in an inventory.

15. A computer program product embodied in a computer readable storage device for operating in a system comprising at least one computer system having a network adapter for accessing a network, a processing unit, and a memory, for implementing a method for triggering scans of virtual items in a virtual universe, the virtual universe having at least one avatar owned by a resident, the at least one avatar having a virtual item and an item inventory, the method comprising:

receiving item scan trigger circumstance has occurred;

scanning, based on a location of the virtual item in the virtual universe, each virtual item in an inventory of the avatar, including the virtual item, to determine whether the virtual item is malicious, wherein a frequency of scanning the inventory of the avatar is increased in the case that the location of the virtual item in the virtual universe indicates a higher potential for malicious items;

determining if background monitoring is enabled and, if background monitoring is enabled, scanning at least a portion of the item inventory belonging to the avatar;

determining if the virtual item is acting differently than a normal virtual item, and if so;

triggering an item alert and blocking the virtual item,

comparing attributes of the virtual item with attributes of known malicious virtual items,

identifying similarities and differences between the attributes of the virtual item with attributes of known malicious items,

determining the maliciousness of the virtual item based upon the identified similarities and the differences, and

updating an inventory item safety summary with the determined maliciousness of the virtual item.

16. The computer program product embodied in a computer readable storage device as defined in claim 15, wherein the method further comprises, if an item scan trigger circumstance has not occurred, determining if an item inventory scan trigger circumstance has occurred, and wherein the method further comprises, if the item inventory scan trigger circumstance has occurred, scanning at least a portion of the item inventory belonging to the avatar, the item inventory having one or more virtual items possessed by the avatar.

17. The computer program product embodied in a computer readable storage device as defined in claim 16, wherein the method further comprises, if an item inventory scan trigger circumstance has not occurred, determining if background monitoring is enabled and, if background monitoring is enabled, scanning at least a portion of the item inventory belonging to the avatar.

18. The computer program product embodied in a computer readable storage device as defined in claim 17, wherein the virtual item has a signature, the virtual universe has an inventory item signature database having signatures of known malicious items, and wherein the method further comprises:

scanning the signature of the virtual item based upon the location;

comparing the item signature with the signatures of known malicious virtual items in the inventory item signature database;

determining the maliciousness of the virtual item based upon the extent of the similarity between the item signature and the signatures of the known malicious virtual items in the inventory item signature database; and

notifying the resident of the maliciousness determination result.