Granted Patent B1

US 6,963,978 · App. 09/916,981 · Granted Nov 8, 2005

Abstract

Claims (81)

1. A method for detecting viruses in software, comprising:

(a) comparing subject data with a plurality of virus definitions in a first database;

(b) executing a security event if the subject data is successfully compared with at least one of the virus definitions;

(c) comparing the subject data with fingerprints of innocent data in a second database;

(d) allowing access to the subject data if the subject data is successfully compared to the fingerprints of innocent data;

(e) transmitting information to a server for analysis purposes if the subject data is unsuccessfully compared to the virus definitions and the fingerprints of innocent data, wherein the information transmitted to the server includes a fingerprint associated with the subject data;

(f) comparing the fingerprint associated with the subject data and fingerprints associated with innocent data in a third database at the server;

(g) comparing the fingerprint associated with the subject data and fingerprints associated with virus definitions in a fourth database at the server; and

(h) transmitting the subject data to the server utilizing a network upon an unsuccessful comparison of the fingerprint associated with the subject data and fingerprints associated with the innocent data in the third database and the virus definitions in the fourth database at the server;

wherein the analysis utilizes a virus detection algorithm to detect whether the subject data is malicious or innocent.

2. The method as recited in claim 1 , wherein the security event is selected from the group consisting of cleaning the subject data, quarantining the subject data, and blocking the subject data.

3. The method as recited in claim 1 , and further comprising reporting that the subject data is innocent if the subject data is successfully compared to the fingerprints of innocent data.

4. The method as recited in claim 1 , wherein the third and fourth databases are updated more frequently than the first and second databases.

5. The method as recited in claim 1 , and further comprising analyzing the subject data transmitted to the server.

6. The method as recited in claim 1 , wherein the subject data is transmitted to the server in separate parts.

7. The method as recited in claim 5 , and further comprising updating at least one of the first database, the second database, the third database, and the fourth database based on the analysis.

8. The method as recited in claim 1 , wherein the information is transmitted to the server via the Internet.

9. The method as recited in claim 1 , wherein the first database and the second database are both components of a client computer coupled to the server via a network.

10. A computer program product for detecting viruses in software, comprising:

(a) computer code for comparing subject data with a plurality of virus definitions in a first database;

(b) computer code for executing a security event if the subject data is successfully compared with at least one of the virus definitions;

(c) computer code for comparing the subject data with fingerprints of innocent data in a second database;

(d) computer code for allowing access to the subject data if the subject data is successfully compared to the fingerprints of innocent data;

(e) computer code for transmitting information to a server for analysis purposes if the subject data is unsuccessfully compared to the virus definitions and the fingerprints of innocent data, wherein the information transmitted to the server includes a fingerprint associated with the subject data;

(f) computer code for comparing the fingerprint associated with the subject data and fingerprints associated with innocent data in a third database at the server;

(g) computer code for comparing the fingerprint associated with the subject data and fingerprints associated with virus definitions in a fourth database at the server; and

(h) computer code for transmitting the subject data to the server utilizing a network upon an unsuccessful comparison of the fingerprint associated with the subject data and fingerprints associated with the innocent data in the third database and the virus definitions in the fourth database at the server;

wherein the analysis utilizes a virus detection algorithm to detect whether the subject data is malicious or innocent.

11. The computer program product as recited in claim 10 , wherein the security event is selected from the group consisting of cleaning the subject data, quarantining the subject data, and blocking the subject data.

12. The computer program product as recited in claim 10 , and further comprising computer code for reporting that the subject data is innocent if the subject data is successfully compared to the fingerprints of innocent data.

13. The computer program product as recited in claim 10 , wherein the third and fourth databases are updated more frequently than the first and second databases.

14. The computer program product as recited in claim 10 , and further comprising computer code for analyzing the subject data transmitted to the server.

15. The computer program product as recited in claim 14 , wherein the subject data is transmitted to the server in separate parts.

16. The computer program product as recited in claim 14 , and further comprising computer code for updating at least one of the first database, the second database, the third database, and the fourth database based on the analysis.

17. The computer program product as recited in claim 10 , wherein the information is transmitted to the server via the Internet.

18. The computer program product as recited in claim 10 , wherein the first database and the second database are both components of a client computer coupled to the server via a network.

19. A system for detecting viruses in software, comprising:

(a) logic for comparing subject data with a plurality of virus definitions in a first database;

(b) logic for executing a security event if the subject data is successfully compared with at least one of the virus definitions;

(c) logic for comparing the subject data with fingerprints of innocent data in a second database;

(d) logic for allowing access to the subject data if the subject data is successfully compared to the fingerprints of innocent data;

(e) logic for transmitting information to a server for analysis purposes if the subject data is unsuccessfully compared to the virus definitions and the fingerprints of innocent data, wherein the transmitted information includes a fingerprint associated with the subject data;

logic for comparing the fingerprint associated with the subject data and fingerprints associated with innocent data in a third database;

(g) logic for comparing the fingerprint associated with the subject data and fingerprints associated with virus definitions in a fourth database; and

(h) logic for transmitting the subject data to the server utilizing a network upon an unsuccessful comparison of the fingerprint associated with the subject data and fingerprints associated with the innocent data in the third database and the virus definitions in the fourth database;

wherein the analysis utilizes a virus detection algorithm to detect whether the subject data is malicious or innocent.

20. A method for detecting viruses in software, comprising:

(a) comparing subject data with a plurality of virus definitions in a first database;

(b) executing a security event if the subject data is successfully compared with at least one of the virus definitions;

(c) comparing the subject data with fingerprints of innocent data in a second database;

(d) reporting that the subject data is innocent if the subject data is successfully compared to the fingerprints of innocent data; and

(e) transmitting a fingerprint of the subject data over a network to a server for analysis purposes if the subject data is unsuccessfully compared to the virus definitions and the fingerprints of innocent data;

(f) comparing the fingerprint associated with the subject data and fingerprints associated with innocent data in a third database;

(g) comparing the fingerprint associated with the subject data and fingerprints associated with virus definitions in a fourth database; and

(h) transmitting the subject data to the server utilizing a network upon an unsuccessful comparison of the fingerprint associated with the subject data and fingerprints associated with the innocent data in the third database and the virus definitions in the fourth database;

wherein the analysis utilizes a virus detection algorithm to detect whether the subject data is malicious or innocent.

21. A method for detecting viruses in software, comprising:

(a) receiving a fingerprint associated with subject data from a client computer for analysis purposes upon the subject data being unsuccessfully compared to virus definitions and fingerprints of innocent data stored on the client computer;

(b) comparing the fingerprint associated with the subject data and the fingerprints associated with innocent data at a server;

(c) comparing the fingerprint associated with the subject data and fingerprints associated with virus definitions at the server;

(d) requesting the subject data from the client computer utilizing a network upon an unsuccessful comparison of the fingerprint associated with the subject data, and the fingerprints associated with the innocent data and the virus definitions at the server;

(e) receiving the subject data transmitted from the client computer in response to the request;

(f) analyzing the subject data transmitted from the client computer; and

(g) updating at least one of the virus definitions and the fingerprints of innocent data based on the analysis;

wherein the analysis utilizes a virus detection algorithm to detect whether the subject data is malicious or innocent.

22. A method for detecting viruses in software, comprising:

(a) receiving a fingerprint associated with subject data from a client computer for analysis purposes upon the subject data being unsuccessfully compared to virus definitions stored on the client computer;

(b) comparing the fingerprint associated with the subject data and fingerprints associated with virus definitions at a server;

(c) requesting the subject data from the client computer utilizing a network upon an unsuccessful comparison of the fingerprint associated with the subject data, and the fingerprints associated with the virus definitions at the server;

(d) receiving the subject data transmitted from the client computer in response to the request;

(e) analyzing the subject data transmitted from the client computer; and

(f) updating the virus definitions based on the analysis;

wherein the analysis utilizes a virus detection algorithm to detect whether the subject data is malicious or innocent.

23. A security method, comprising:

(a) receiving a fingerprint associated with subject data from a client computer for analysis purposes upon the subject data being unsuccessfully compared to fingerprints associated with innocent data stored on the client computer;

(b) comparing the fingerprint associated with the subject data, and fingerprints associated with innocent data at a server;

(c) requesting the subject data from the client computer utilizing a network upon an unsuccessful comparison of the fingerprint associated with the subject data, and the fingerprints associated with the innocent data at the server;

(d) receiving the subject data transmitted from the client computer in response to the request;

(e) analyzing the subject data transmitted from the client computer; and

(f) updating the fingerprints associated with the innocent data based on the analysis;

wherein the analysis utilizes a virus detection algorithm to detect whether the subject data is malicious or innocent.

Assignments (11)