Network anti-virus system

[0001] Claims the benefit of provisional application No. 60/251,220 filed Dec. 6, 2000.

• • [0002] U.S. Pat. No. 5,623,600, April, 1997, Ji et al.
  • [0003] U.S. Pat. No. 5,832,208, November, 1998, Chen et al.
  • [0004] U.S. Pat. No. 5,960,170, September, 1999, Chen et al.
  • [0005] U.S. Pat. No. 6,088,803, July, 2000, Tso et al
  • [0006] U.S. Pat. No. 6,094,731, July, 2000, Waldin et al.

[0007] The existing anti-virus systems are relatively slow to respond to the emergence of new viruses. This is due to the professional character of the virus attacks, the growing sophistication of the virus code and the fast development of new viruses. The systems are vulnerable because it takes time to detect the new virus code in the infected files, to study how it works and to develop new virus removal modules for the virus scanners. It also takes time to deliver simultaneously large numbers of copies of the virus scanner update patches to the clients, what also consumes the bandwidth of the network nodes. The fact that this has to be done constantly over and over again makes the things worse. In addition in the client side there may be unwillingness or carelessness to allow the virus scanner to check for new virus updates as frequently as it should be done, or to have all the downloaded files to be scanned by the virus scanner for old—let alone new viruses. It is not either uncommon to neglect obtaining a virus scanner. And even if a virus scanner is in use, its user may be perplexed by the complex and confusing scanning options. In addition it takes time to publicize the new virus discoveries in the organizations because of public relations reasons. The existing systems also waste processing power of network servers and home computers, because they require that each downloaded file is scanned for viruses. This is exacerbated by the rapid pace which the virus signature databases are growing in size.

[0008] The present invention was developed in order to overcome these problems with an efficient and well-organized Internet based anti-virus system which is capable to quickly response to the threats posed by new viruses. The introduced anti-virus system frees the network servers and home computers from redundant virus scanning by centralizing the virus combating functions. The centralization guarantees that the information about new viruses is immediately benefiting all the clients belonging to the system, and because of the architecture of the system a mere detection of an infected file is enough to impose an instant internet-wide download blockage for it without having to wait for the development and distribution of the virus removal modules for virus scanners. At the core of the system, the detection of the infected files is based mainly on the comparison of tiny-sized file identifications, wherefor no bandwidth or processing power is wasted. The system also lowers the barrier for the organizations to disclose the suspected new virus infections, because it has not necessarily to be done publicly but can simply be done to a central anti-virus host computer anonymously.

[0009] Prior art covers anti-virus systems where the downloaded files or e-mail are scanned in a client computer, LAN server, ISP's server or any host computer. In the systems meant for the reduction of unsolicited e-mail, the e-mail messages have been filtered on the basis of the properties of e-mail messages. This has normally been done either by a client computer, LAN server, ISP's mail server or any host computer which acts as a mail server or provides web-based e-mail accounts. The systems meant for limiting internet browsing include an internet browser software in a client computer preventing access to unsafe web sites, and an ISP's server preventing access of client computers to web sites which have adult content.

[0010] A network based anti-virus system especially for wide area networks, like the Internet. In the system when a client computer downloads files or other web content from the network, their identifications are sent to an anti-virus host computer which compares them to a database of the identifications of known virus infected files or other known virus infected web content. Security measures are taken if a sent identification has a close enough match in the database. The system includes optionally an intermediate computer, like a LAN server, an ISP's server, network node computer or the source host computer of the downloaded files or other web content; which delivers the identifications to the anti-virus host computer on the behalf of the client computer. Security measures include the client computer or the intermediate computer preventing the download of the detected dangerous files or other web content to the client computer, or the client computer deleting the same from the client computer if they have already been downloaded; the client computer, the intermediate computer or the anti-virus host computer scanning the same for viruses when needed; and the client computer scanning itself for viruses when needed.

[0011] The system can be used directly by the home users and individual users in businesses and other organizations, or the businesses and organizations can use it to protect their workstations by signing up their servers for the system. The internet operators can sign up their relay servers and mail servers for the system to protect their clients. The web site operators can protect their visitors by including the system support in their download links or download features in the web pages. In individual use the system interface can be integrated to an internet browser software or to an independent download manager software.

[0012] In the system the file and other web content identifications can be sent in compressed form over the network to further reduce their tiny size. When privacy is needed, the identifications can be sent in encrypted form over the network.

[0013] In addition of preventing the download of virus infected files and other web content, the system can also be used to prevent downloading of non-wanted/unacceptable files and other web content.

[0035] A network based anti-virus system especially for wide area networks, like the internet, where one or more anti-virus host computers (AVHC) handle requests of client computers to inspect if said client computers are in danger to be infected with computer viruses. Said AVHCs are any computers in the network chosen for that purpose. When client computers download files from ordinary host computers, they inquire from an AVHC either before or after said downloading, if any of said files may contain viruses. Said ordinary host computers are here any computers in the network retaining or relaying files.

[0036] A client computer downloading a file gathers optionally file identification information (FII) about said file, and sends said FII to the AVHC (see FIG. 1). Said FII comprises one or more of the following properties of said file: source URL-address, source computer URL-address, name, type, content type, size, creation date, version number, publisher, authentication certificate, or other properties of said file.

[0037] When said inquiring happens after said downloading, a client computer which has downloaded a file, optionally gathers data identification information (DII) about said file in addition to or without gathering the FII for said file, and sends said DII to the AVHC (see FIG. 2). Said DII is generated by A) calculating a check-sum or any identification value for a downloaded file based upon the data of said file, and/or B) by sampling data according to a certain pattern, algorithm or other rule from a downloaded file, or C) by copying all data of a downloaded file.

[0038] The FII and/or DII for a file is alternatively acquired by the AVHC self independently and directly from the source computer of said file using the URL-address of said file provided by the client computer which requested the inspection of said file (see FIG. 3). Said source computer optionally cooperates with the AVHC, gathering the DII for said file on behalf of the AVHC and sending it to the AVHC so that the AVHC does not necessarily have to download said file or a part of said file to gather the DII for said file.

[0039] When the AVHC has received or acquired the FII and/or DII for an inspected file, it checks if the properties of said FII and/or DII match or resemble in certain part(s) the properties of FII and/or DII detected earlier in instances of virus infected files, malicious web sites or host computers, malicious publishers, or other harmful or potentially harmful situations. If said compared properties in said certain part(s) match or resemble each other to a certain extent, the AVHC determines that said inspected file is a security threat, being harmful or potentially harmful, and sends information to respective client computer which requested said inspection, to inform said client computer that said file is a security threat, and to warn the user of said client computer about said security threat (see FIGS. 1 and 2, right sides). The AVHC optionally informs said client computer if the AVHC has determined that said inspected file is not a security threat.

[0040] In said checking, if the AVHC has only the FII of a file to be used in said checking and if the result of said checking was not sure enough, then the AVHC optionally requests the DII for said file from the client computer which requested the inspection of said file, so that the AVHC is able to perform more thorough checking. In said checking, if the AVHC has only the DII of a file to be used in said checking and if the result of said checking was not sure enough, then the AVHC optionally requests the FII for said file from the client computer which requested the inspection of said file, so that the AVHC is able to perform more thorough checking.

[0041] In case of a said security threat file, said client computer downloads said file if it has not downloaded said file yet and sends it to the AVHC, or alternatively said file is downloaded directly by the AVHC self independently and directly from the source computer of said file using the URL-address of said file picked from the FII of said file, or using the URL-address of said file delivered separately to the AVHC by said client computer (see FIG. 4). Alternatively, if said client computer has earlier sent said security threat file to the AVHC as the DII of said file, then that copy of said file is used by the AVHC. The AVHC scans said security threat file for viruses, or delegates said scanning to other host computer.

[0042] In alternative to said AVHC performed or AVHC delegated virus scanning, said client computer itself optionally downloads newest anti-virus software or update patch(es) for said anti-virus software from the AVHC or other host computer, uses said anti-virus software to scan said security threat file for viruses, and if said anti-virus software finds virus(es) in said file, said client computer informs the AVHC about said virus infection and sends said file to the AVHC.

[0043] Said security threat file is not scanned for viruses if said file's FII and/or DII resemble enough the FII and/or DII of an earlier detected infected file. The AVHC deems said resemblance to be a verification of an infection in said security threat file.

[0044] In case of a virus scan or said FII and/or DII resemblance verified virus infection of said security threat file, the AVHC stores the FII and/or DII of said infected file, or adds said infection case to a statistics record for said FII and/or DII if the AVHC has earlier stored identical said FII and/or DII. The AVHC stores optionally also said infected file itself. The database of said stored FII and DII along with said related infection statistics and said stored infected files are used by the AVHC in said anti-virus system for recognition and profiling of harmful or potentially harmful: files, web sites or host computers, publishers and situations having security risk.

[0045] In case of a virus scan verified virus infection of said security threat file, the AVHC optionally stores also information about and/or source code of the virus which caused said virus infection, and/or delivers said virus information and/or source code to certain other host computers keeping databases of viruses.

[0046] In case of a virus scan verified virus infection of said security threat file, the AVHC informs about said infection the client computer which requested said inspection (see FIG. 4, right side), and said client computer destroys said infected file in said client computer if said client computer has already downloaded said infected file, or said client computer prevents the download of said infected file to said client computer if said client computer has not yet downloaded said infected file.

[0047] The client computers optionally make lists of the frequently and/or recently visited web sites or host computers, and authenticated publishers of frequently and/or recently downloaded files, that the AVHC has determined to be trustworthy or relatively trustworthy, and if the source web site or host computer, or the authenticated publisher of a file that a client computer wants to download is found in a said list, then said client computer downloads said file without having inspection for said file's FII or DII, or for said file itself by the AVHC (see FIG. 5).

[0048] The AVHC optionally provides temporary lists for the client computers about harmful and potentially harmful: files, publishers, and web sites or host computers. When a client computer wants to download a file, and said file, said file's publisher, or said file's source web site or host computer is found in a said temporary list, then said client computer notifies the user of said client computer about that and prevents the download of said file to said client computer without having said file inspected by the AVHC (see FIG. 6). This is useful when dangerous virus(es) are spreading wide and fast in the network, to prevent the AVHC from blocking because of numerous requests of client computers to inspect downloaded files, and to effectively obstruct the spreading of the viruses.

[0049] The AVHC optionally informs the user of a client computer about new infection cases where the properties of FII and/or DII of infected files match or resemble in certain part(s) the properties of FII and/or DII of one or more files that said user has downloaded earlier within certain time window, or the properties of FII and/or DII of one or more files belonging to certain number of latest said user downloaded files (see FIG. 7).

[0050] The AVHC optionally keeps register of download statistics for the users of client computers, said register containing FII and/or DII, and risk ratings for the files that a user of client computer has downloaded. Said risk ratings are determined by the AVHC as a measure of harmfulness or potential harmfulness of said downloaded files. Said register contains optionally also information about newly detected infection cases for the earlier downloaded and inspected files, in which the AVHC could not earlier have detected a virus infection. The user of client computer is able to login to the AVHC and view said risk ratings and any said afterwards detected infections for the files which he or other user using the same client computer has earlier downloaded (see FIG. 8, left side). The AVHC contacts and alerts the users of client computers who self have downloaded or who are using a client computer on which another person has downloaded any said files which were afterwards detected to be infected, and provides a software for said users, said software acting in a client computer to remove said afterwards detected virus(es) and optionally to remove said infected files itself (see FIG. 8, right side).

[0051] The AVHC optionally seeks infected files in host computers independently using FII and/or DII of the known infected files in recognition of said infected files (see FIG. 9, left side). The AVHC optionally seeks infected files in host computers independently by downloading some files from said host computers and scanning said files for viruses, or delegating said scanning to other host computer (see FIG. 9, right side). In said two seeking methods, if a file is found to be infected with a virus, the AVHC stores the FII and/or DII for said infected file or adds said infection case to a statistics record for said FII and/or DII if the AVHC has earlier stored identical said FII and/or DII, and optionally stores said infected file itself.

[0052] The FII and/or DII for a file about to be downloaded by a client computer is optionally provided to the AVHC by an intermediate computer like the local area network host computer of said client computer, the internet service provider computer of said client computer, the source computer of said file, or other computer, like a node computer, in the downloading chain from the source computer of said file to the downloading client computer (see FIGS. 10 and 11). The FII and/or DII for said file is alternatively acquired by the AVHC independently and directly from the source computer of said file using the URL-address of said file provided by said intermediate computer (see FIG. 12). Said source computer optionally cooperates with the AVHC, gathering the DII for said file on behalf of the AVHC and sending it to the AVHC so that the AVHC does not necessarily have to download said file or a part of said file to gather the DII for said file.

[0053] Said intermediate computer receives feedback from the AVHC about the security risk relating to said file about to be downloaded by said client computer (see FIGS. 10 and 11, right sides), and if said security risk exceeds a certain level, said intermediate computer prevents the download of said file, delivers optionally a message to said client computer about said prevention and optionally sends said withheld file to the AVHC. If said withheld file is not delivered to the AVHC by said intermediate computer, then the AVHC downloads said withheld file independently and directly from the source computer of said file using the URL-address of said file picked from the FII of said file, or using the URL-address of said file delivered separately to the AVHC by said intermediate computer (see FIG. 13). Alternatively, if said intermediate computer has earlier sent said withheld file to the AVHC as the DII of said file, then that copy of said file is used by the AVHC.

[0054] Said security risk is determined by the AVHC by checking if the properties of the FII and/or DII of said inspected file match or resemble in certain part(s) the properties of FII and/or DII detected earlier in instances of virus infected files, malicious web sites or host computers, malicious publishers, or other harmful or potentially harmful situations. What more said compared properties in said certain part(s) match or resemble each other, the greater security risk rating the AVHC gives to said inspected file. In said checking, if the AVHC has only the FII of a file to be used in said checking and if the result of said checking was not sure enough, then the AVHC optionally requests the DII for said file from said intermediate computer, so that the AVHC is able to perform more thorough checking. In said checking, if the AVHC has only the DII of a file to be used in said checking and if the result of said checking was not sure enough, then the AVHC optionally requests the FII for said file from said intermediate computer, so that the AVHC is able to perform more thorough checking.

[0055] The AVHC performs virus scan for said withheld file which has said security risk exceeding certain level, or delegates said virus scan to other host computer, and provides information about the results of said virus scan to said intermediate computer (see FIG. 13, right side). In alternative to said AVHC performed or AVHC delegated virus scanning, said intermediate computer itself optionally downloads newest anti-virus software or update patch(es) for said anti-virus software from the AVHC or other host computer, uses said anti-virus software to scan said withheld file for viruses, and if said anti-virus software finds virus(es) in said file, said intermediate computer informs the AVHC about said virus infection and sends said file to the AVHC.

[0056] Said withheld file is not scanned for viruses if said file's FII and/or DII resemble enough the FII and/or DII of an earlier detected infected file. The AVHC deems said resemblance to be a verification of an infection in said withheld file.

[0057] In case of a virus scan or said FII and/or DII resemblance verified virus infection of said withheld file, the AVHC stores the FII and/or DII of said infected file, or adds said infection case to a statistics record for said FII and/or DII if the AVHC has earlier stored identical said FII and/or DII. The AVHC stores optionally also said infected file itself. The database of said stored FII and DII along with said related infection statistics and said stored infected files are used by the AVHC in said anti-virus system for recognition and profiling of harmful or potentially harmful: files, web sites or host computers, publishers and situations having security risk. The AVHC optionally stores also information about and/or source code of the virus which caused said virus infection, and/or delivers said virus information and/or source code to certain other host computers keeping databases of viruses.

[0058] In case of a virus infection of said withheld file, said intermediate computer optionally informs about said infection the client computer wanting to download said infected file, and optionally prevents permanently the download of said infected file through said intermediate computer by said downloading client computer, other client computers, downstream node computers and any other computers that are not specifically authorized to download it (see FIG. 14). If said withheld file is not found to be infected with a virus, said intermediate computer allows the download of said withheld file to continue normally (see FIG. 15).

[0059] Said intermediate computers deliver optionally together or in cooperation with the client computers to the AVHC all the needed FII and/or DII information for the downloaded files and also optionally said downloaded files itself when needed by the AVHC.

[0060] Said intermediate computers optionally make lists of the frequently and/or recently visited web sites or host computers, and authenticated publishers of frequently and/or recently downloaded files, that the AVHC has determined to be trustworthy or relatively trustworthy, and if the source web site or host computer, or the authenticated publisher of a file that a client computer wants to download is found in a said list, then said client computer is allowed to download said file normally without said intermediate computer having inspection for said file's FII or DII, or for said file itself by the AVHC (see FIG. 16).

[0061] The AVHC optionally provides temporary lists for said intermediate computers about harmful and potentially harmful: files, publishers, and web sites or host computers. When a client computer wants to download a file, and said file, said file's publisher, or said file's source web site or host computer is found in a said temporary list, then a said intermediate computer optionally notifies the user of said client computer about that, and prevents the download of said file without having said file inspected by the AVHC (see FIG. 17). This is useful when dangerous virus(es) are spreading wide and fast in the network, to prevent the AVHC from blocking because of numerous requests of intermediate computers to inspect downloaded files, and to effectively obstruct the spreading of the viruses.

[0062] In said anti-virus system with or without said participating intermediate computers, the AVHC optionally provides case specific statistical information to the client computers, to the users of client computers and to said intermediate computers about the earlier AVHC inspected files. Said case specific statistical information tells how many virus infection and/or virus-free download cases it has been detected for those of said earlier inspected files which have had FII and/or DII matching or resembling in one or more properties the FII and/or DII of a file which is currently in said inspection. The AVHC optionally provides security risk ratings to the client computers, to the users of client computers and to said intermediate computers, a said risk rating calculated on the basis of said statistical information for a file which is currently in said inspection. The client computer optionally destroys the downloaded file or prevents the download of the file to said client computer, for which the AVHC has given a certain level of said risk rating. Said intermediate computer optionally prevents the download through said intermediate computer of the file, for which the AVHC has given a certain level of said risk rating. The AVHC optionally samples files among the inspected files which are not scanned for viruses but which have said risk ratings exceeding a certain level, and scans said sampled files for viruses. Said sampling happens optionally more frequently for the files which have greater said risk ratings.

[0063] In said anti-virus system with or without said participating intermediate computers, when there are multiple AVHCs, said AVHCs optionally deliver to each other information about the FII and DII of infected and potentially harmful files, and optionally said infected and potentially harmful files itself, and optionally information about viruses.

[0064] In said anti-virus system with or without said participating intermediate computers, when the AVHC detects an infected file, the AVHC optionally informs about said infection the operator of the host computer which contains or relays said infected file (see FIG. 18).

[0065] In said anti-virus system with or without said participating intermediate computers, the mentioned files are alternatively e-mail messages, e-mail message attachments, web pages containing program scripts or other client computer processed components, independent program scripts or other client computer processed components, or any data downloaded by a client computer from any host computer.

[0066] In said anti-virus system with or without said participating intermediate computers, the mentioned URL-addresses are alternatively other type of data retrieval addresses, or sets of data retrieval instructions/steps.

[0067] Said anti-virus system with or without said participating intermediate computers is used optionally for a file transfer system where files are transferred from client computers or host computers to certain host computers. Said client computers and host computers from which files are transferred in said file transfer system correspond to the host computers in said anti-virus system, and said certain host computers to which said files are transferred to in said file transfer system correspond to the client computers in said anti-virus system (see FIGS. 19 and 20). In said file transfer system, said file transfer happens either through uploading method, where said file transfer is initiated by said client computers and host computers from which the files are transferred, or through downloading method, where said file transfer is initiated by said certain host computers to which the files are transferred (see FIG. 21). Said uploading and downloading transfers in said file transfer system correspond to the client computer performed downloading in said anti-virus system.

[0068] Said anti-virus system with or without said participating intermediate computers is optionally used for preventing the download of adult material. Said adult material download prevention system corresponds to said anti-virus system with the following modifications: The viruses mentioned in said anti-virus system correspond to adult material, the files mentioned in said anti-virus system correspond to web pages, files, e-mail messages, e-mail message attachments or other data; the virus infection mentioned in said anti-virus system corresponds to presence of adult material in a file or other data, and the virus scanning mentioned in said anti-virus system corresponds to adult material seeking/scanning. Said adult material download prevention system is used with or without said anti-virus system.