Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Protection at a particular protocol layer
Reexamination Certificate
1998-09-30
2002-01-08
Wright, Norman Michael (Department: 2184)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Protection at a particular protocol layer
C714S028000, C714S054000
Reexamination Certificate
active
06338141
ABSTRACT:
This invention relates to a stand-alone computer process that uses a single information engine to produce a collection of relational data which performs any, or all, of four operations involved in the detection of various types of computer viruses in real time. These four operations are (1) system integrity checking, (2) known virus detection, (3) unknown variant detection, and (4) new virus analysis and detection.
This relational anti-virus engine is referred to hereinafter as RAVEN.
Depending on the virus type, the relationship of about 70 different data items can be used in detection. The entire process is performed on a single, stand-alone computer system in real time. However, the process can also be run from on the stand-alone system from a connected, remote computer system, which remote system can maintain the known virus databases.
BACKGROUND OF INVENTION
The Field of the Invention
The invention relates in general to computer systems. In particular this invention relates to the detection of computer viruses. Primarily those viruses that execute on Intel and Intel-compatible processors under DOS, and versions of Microsoft Windows such as program viruses, boot sector viruses, and OLE viruses. However, the invention is specifically designed to be implemented on a wider variety of platforms (i.e. to be able to look for Intel-based viruses on systems with other processors).
Antivirus programs have been in existence since the late 1980s. An example of how traditional antivirus products work can be seen in a program written by this author in 1988. That program detected viruses and related hostile software in two ways: (1) It scanned each file for byte streams (this is called “signature scanning”) matching known viruses and (2) it scanned each file for known virus-like code (this is called “heuristic scanning”). Other techniques in early antivirus programs involved either preventing virus-like activity (this is called “behavior blocking”) or by checking a file for changes (this is called “integrity checking”).
SUMMARY OF INVENTION
Raven is a single information engine, which gathers and uses a variety of relational data in order to perform four basic functions:
Gather, store, and compare information about computer system integrity.
Use the information supplied by analysis to detect known computer viruses.
Use the information supplied by analysis to detect variants of known computer viruses.
Automate computer virus analysis and output virus detection information.
These functions may be used independently, or as part of an overall antivirus development and updating process, or as part of a single, real-time process on a single computer system. The engine functions by analyzing the contents of a buffer. Usually, the buffer contains all or portion of a executable program file. The data extracted by the engine represents a unique complex collection of interrelated data based on the buffer's (file's) contents.
The unique features of this antivirus system are it's single-engine automation basis and its use of relational signature objects in virus detection.
In the case of known-virus detection, traditional approach was to use single, specific signature types to detect viruses—one virus, one signature. In contrast, Raven uses a large relational set of applicable data, (signatures and flags), to detect any given virus. Depending on the file type, the relationship of over 30 different “signatures” can be used to detect any single computer virus. So, for any given virus, a combination of many signatures and flags is used for precise identification. To our knowledge, the Raven system is unique. No other antivirus product we know of uses the combination and relationship of multiple signatures, signature types, and additional data to detect known viruses.
The core functionality of Raven involves gathering a specific data set from any given, recognized file type (technically, a stream type). The data set is used for different purposes; including file integrity management and virus detection. When used for virus detection the data represents a set of traditional and non-traditional signature types as well as heuristic flags and other information about the file.
It is the unique combination of this data, rather than any single data item (such as one single virus signature) that is used by Raven to detect viruses. How these different data relate to one another accounts for the “relational” nature of Raven.
Having multiple, usable signatures for each virus is advantageous. It allows Raven to verify infections with a high degree of certainty and helps in the avoidance of false identifications. Although all of the relational data is available, not all of it is used in every case. Rather, a subset of specific critical data is often used. This allows Raven to maintain good verification, while also allowing it to easily recognize new variants of known viruses. Additionally, the data can be easily overridden or modified in various ways to enhance performance. Generally, however, the data are never modified. In fact, most of the data is never touched, or even seen, by the developer, because the Raven detection system is built almost entirely by an automated system.
From its inception, Raven was specifically designed as part of an automated virus analysis and detection system. That is, the virus detection databases and updates are created as part of an automated virus analysis system. The purpose is to automate as much as possible the process of developing detection for new viruses as they appear. To this end, Raven is implemented in two distinct forms.
Raven is first implemented as part of a virus analysis tool. This tool is run on a large collection of viruses. The virus collection must meet certain criteria and have a known format. The output from the analysis-implementation of Raven is then input to a build system that, in turn, outputs a virus-detection database or update to be that is used by the second implementation of Raven.
Raven is implemented in this second form as part of a virus detection tool. When this tool is run on any given system (such as a user's system), the gathered data for each file checked is tested against the relational data that represents the known viruses stored in the virus-detection database. An exact match of all related data indicates a known virus is present. In addition, if most, but not all, of the data is matched, there is a high probability that an unknown (but closely related) virus is present.
While a few viruses may still need to be examined by a virus researcher, most are analyzed and accepted automatically. The automated system produces over 90 percent of the data sets used by Raven. The automated system allows for rapid response for new viruses.
Raven was specifically designed for portability. The core Raven functionality is written entirely ANSI C. This single antivirus engine that can be compiled and run on a variety of processors and operating systems. In addition, these different compiles of Raven all use the same virus-detection database. That is, copies of a single binary form of an original or update database may be used with compiles of Raven on different platforms.
REFERENCES:
patent: 5144659 (1992-09-01), Jones
patent: 5319776 (1994-06-01), Hile et al.
patent: 5452442 (1995-09-01), Kephart
patent: 5483649 (1996-01-01), Kuznetsov et al.
patent: 5485575 (1996-01-01), Chess et al.
patent: 5537540 (1996-07-01), Miller et al.
patent: 5613002 (1997-03-01), Kephart et al.
patent: 5623600 (1997-04-01), Ji et al.
patent: 5696822 (1997-12-01), Nachenberg
patent: 5826013 (1998-10-01), Nachenberg
patent: 5832208 (1998-11-01), Chen et al.
patent: 5918008 (1999-06-01), Togawa et al.
patent: 5948104 (1999-09-01), Glack et al.
patent: 5951698 (1999-09-01), Chen et al.
patent: 5960170 (1999-09-01), Chen et al.
patent: 6006329 (1999-12-01), Chi
patent: 6016546 (2000-01-01), Kephart et al.
CyberSoft, Inc.
Wright Norman Michael
LandOfFree
Method and apparatus for computer virus detection, analysis,... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Method and apparatus for computer virus detection, analysis,..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Method and apparatus for computer virus detection, analysis,... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2843448