Viral replication detection using a counter virus

Details Viral replication detection using a counter virus Viral replication detection using a counter virus

1999-08-17

2004-11-02

Barrón, Gilberto (Department: 2132)

Electrical computers and digital processing systems: support

Multiple computer communication using cryptography

Protection at a particular protocol layer

C713S152000, C713S152000, C714S028000, C714S038110

Reexamination Certificate

active

06813712

ABSTRACT:

FIELD OF THE INVENTION
The present invention relates to a parasitic counter virus for detection of previously unseen malicious computer viruses through the infection of such computer viruses.
BACKGROUND OF THE INVENTION
Computer viruses generally have three components: a search mechanism to determine which files the virus can infect; an infection mechanism which causes the virus to replicate; and a payload, which can vary between simply displaying a message on a computer screen to completely destroying the contents of a hard disk.
Traditionally, viruses have tended to be passed from computer to computer within executable code, and anti-virus technology has largely concentrated on detecting such viruses. As such, existing virus detectors rely on the detection of one or a combination of the following:
a known virus signature;
a typical virus behaviour; or
a change in a system metric such as an integrity checksum.
Previously, computer users have assumed that only executable files could host and transmit viruses and so receiving non-executable documents from third parties, which is increasingly common with rapidly expanding Internet e-mail use, was considered to be safe. However, a new type of virus has recently emerged—the macro virus. Such viruses are passed between computers within general purpose application files, for example, a word processor document, a spreadsheet or database file.
These viruses take advantage of scripting facilities now commonly available within general purpose applications enabling development of user defined applications. Examples are Microsoft applications which include a Visual Basic interpreter within MS Office applications such as Word, Excel and Access, and Lotus applications which use Lotus script with Smartsuite applications such as Wordpro, Lotus 1-2-3, Approach and Freelance.
In general these scripting languages comprise an application-specific object oriented class structure, with each class having a pre-defined set of properties, methods and events, which can be used in conjunction with the processing facilities provided by the scripting language. Users are free to write macros which are responsive to events on instantiated objects and which carry out a specific task. For example, a user who is worried about losing changes to a spreadsheet, may write a macro which responds to the cellvaluechanged event triggering on the range of values being edited to cause the spreadsheet to be saved every time a change to the range is made.
Macros are usually stored within a host document, but in the case of Microsoft Word, in particular, it is possible to store a macro within a global template, Normal.dot, with that macro activating whenever the same event triggers in every document subsequently being opened in MS Word. So, for example, a macro placed in the global template could respond to every document being saved or opened to cause a backup copy of the document to be made.
Macro viruses are generally triggered when their host document is loaded into an application. Their search mechanism usually finds one or more documents on the hard disk generated from the same application. It is usually possible to open these documents without them being viewed by the user and then to copy the macro virus into the other document. Visual Basic provides a specific command “MacroCopy” to allow this infection mechanism to operate. The payload is usually triggered at some point in the future to give the virus time to infect documents without being detected. For example, the virus can include a macro which responds to a file save event to check the date or time and if this is say April, 13 or the 55th second of the hour, the payload macro can in many cases do literally anything, such as deleting system files as in the case of the Nuclear.B virus.
DISCLOSURE OF THE INVENTION
Accordingly, the present invention provides a counter virus agent for detecting viral infection of a computer system comprising: a means for identifying potential host files for said agent within said computer system; a means for controlling replication of said agent within said host files to maintain said agent at a pre-determined population level; a means, instantiable within one of said host files, for determining the population level of said agent within said computer system; and means, responsive to said population level exceeding said pre-determined population level, for indicating possible viral infection of said computer system.
Preferably the counter virus, not only detects macro viruses, but any viruses which can be parasitically infected and which allow the counter virus to be replicated with said viruses.
The invention involves the deliberate release of a beneficial counter virus with a pre-determined population level. On execution, the counter virus scans the visible file system for other instances of the counter virus, determines the counter virus population level and either self-destructs or infects other files depending on the population level. These actions are taken with the sole objective of maintaining the counter virus population at a level which represents a fraction of the overall files in the system. In this way the population is maintained unless the counter virus infects another (unauthorised) virus, in which case the replication mechanism of the unauthorised virus overcomes the population control mechanism of the counter virus. The resulting increment in population of the counter virus reveals the existence of an unauthorised replication mechanism and therefore the existence of an unknown virus.
The population increment is detected at the next execution of an instance of the counter virus when the counter virus can advise the computer user of the infection of the file system and possibly enable the system to be cleaned-up before the virus payload operates.
Preferably, the counter virus infects an unauthorised virus in such a way that it does not interfere with the operation of the unauthorised virus and is replicated along with the unauthorised virus. For example, a macro virus which replicates using a macro copy command will be vulnerable to detection by the counter virus of the invention, whilst a low level virus which replicates by copying a specified number of bytes will be less vulnerable.
Also, the counter virus should ensure that the replication of a host software component, which may only be a sub section of a file, also includes the replication of the agent.
Nonetheless, an important benefit of this invention is that there is no need for prior knowledge of either the attacking virus or the file system.


REFERENCES:
patent: 5278901 (1994-01-01), Shieh et al.
patent: 5452442 (1995-09-01), Kephart
patent: 5675711 (1997-10-01), Kephart et al.
patent: 5978917 (1999-11-01), Chi
patent: 6108799 (2000-08-01), Boulay et al.
patent: 11282673 (1999-10-01), None
“Welcome to Symantec.com” homepage, wysiwyg://46http://symantec.com/index.html, Jan. 17, 2000.
AntiVirus Research Center, SARC—“Computer Viruses: An Executive Brief”, http://www.symantec.com/avcenter/reference/corpst.html, pp. 1-14.
AntiVirus Research Center, SARC—“Macro Viruses”, http://www.symantec.com/avcenter/venc/data/wm.acro.html, pp. 1-9.
Supplier No. 20877795, “Antivirus Software”, Philip Albinus, Home Office Computing, vol. 16, No. 7, p. 105(6), Jul. 1998, ISSN: 0899-7373.

Affiliated with

Also associated with

Rating

Viral replication detection using a counter virus does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Viral replication detection using a counter virus, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Viral replication detection using a counter virus will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-3298553