JPH11134190A - System and method for detecting and reporting virus and storage medium stored with program regarding same method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent a virus from spreading by automatically informing a s specific user of virus infection if the virus infection is detected. SOLUTION: On an electronic mail server 101, a mail sent from an electronic mail client 102 is received by an electronic mail protocol front-end 111 and a virus check function 112 makes a virus check. The mail which is not infected is stored in a mail box 113. If the mail is infected with a virus, the virus check function 112 detects it and informs a virus detection informing function 114 of the detection of the virus infection. The virus detection informing function 114 discards the infected mail and sends a report on the virus detection to the electronic mail client 102 as the transmission source of the electronic mail and an electronic mail administrator terminal 103 through the electronic mail protocol front-end 111.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a virus detection notification system and method, and a storage medium storing a program according to the method, and in particular, automatically notifies a virus infection to a necessary person such as a system administrator. To prevent the spread of viruses.

[0002]

2. Description of the Related Art Conventionally, various kinds of software for detecting computer viruses have been known. For example, software that is installed on a personal computer (PC) to detect and remove a virus that infects a system, and that prevents virus infection is known.
Further, there is known software that operates on a proxy server, performs a virus check on various data relayed by the proxy server, and prevents data that is infected by a virus from passing through.

[0003]

In the above-described conventional virus detection system, when a virus is detected on a PC, a message is output to notify the user of the PC, or when a virus is detected on a proxy server. Similarly, a message was output for notification. On the other hand, when a virus is detected, it does not mean that the virus has to be removed by the detected PC or the like, and the infected file does not remain somewhere in the source of the infection or somewhere in the file transfer path. Considering various cases to prevent the spread of the virus, such as whether the file infected with the virus has been transmitted to another person, it is necessary to notify the person who needs to be notified. In the past, such work had to be done manually.

The present invention has been made in view of the above-described problems in the conventional art, and has been developed in a case where a virus infects various data (including programs) transferred from machine to machine on a network such as e-mail. It is an object of the present invention to detect a virus infection and automatically notify a predetermined person of the virus infection when a virus infection is detected, thereby preventing the spread of the virus.

[0005]

According to an aspect of the present invention, there is provided a virus detection notification system for checking whether data transferred on a network is infected with a virus. Virus checking means for performing a virus check on data transferred on the network, and virus detection notifying means for sending a virus detection notice to a predetermined user when a virus infection is detected by the virus checking means; It is characterized by having.

According to a second aspect of the present invention, there is provided a virus detection notification system for checking whether data transferred on a network is infected with a virus. Virus detection means for performing virus detection, and virus detection notification means for transmitting a virus detection notification to at least a system administrator and a transmission source or a request source of data in which the virus infection is detected when the virus check means detects a virus infection. It is characterized by having.

According to a third aspect of the present invention, there is provided a virus detection notification system for checking whether an e-mail transferred on a network is infected with a virus. A virus check unit for performing a virus check, and a virus detection that sends a virus detection notification to at least a system administrator and a source or a destination of an email in which the virus infection is detected when the virus check unit detects a virus infection. Notification means.

According to a fourth aspect of the present invention, in the third aspect, the virus detection notifying means determines a transmission source, a transmission destination, a reply destination, an error mail transmission destination, and / or a route from the header information of the electronic mail. It is characterized in that information on the relay server inside is read and a virus detection notification is sent to those destinations.

According to a fifth aspect of the present invention, there is provided a virus detection notification method executed on a machine which relays data transferred on a network, wherein a virus check is performed on the data transferred on the network. And a step of sending a virus detection notification to a predetermined user when a virus infection is detected in the step.

According to a sixth aspect of the present invention, there is provided a storage medium storing a virus detection notification program for performing a virus detection and notification on a machine that relays data transferred on a network, wherein the virus detection notification program comprises: A step of performing a virus check on data transferred on the network, and a step of sending a virus detection notification to a predetermined user when a virus infection is detected in the step. It is characterized by.

[0011]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 shows an example (outline of processing flow) in which the virus detection and notification system of the present invention is applied to an electronic mail system. E-mail server 101, e-mail client 102, and e-mail administrator terminal 103
Are connected to the network 104.

The electronic mail client 102 has a user interface 121 and an electronic mail protocol front end 122. The user interface 121 performs processing such as accepting a user's operation input and displaying various types of information on a display device (not shown), and also performs processing of creating, editing, transmitting, and receiving an e-mail. The e-mail protocol front end 122 plays a role of an interface when various messages such as e-mails are exchanged with the e-mail server 101 via the network 104. The outgoing mail output from the user interface 121 is transmitted to the e-mail server 10 via the e-mail protocol front end 122 and the network 104.
Transferred to 1.

The e-mail server 101 has an e-mail protocol front end 111, a virus check function 112, a virus detection notification function 114, a mailbox 113, and the like. Email Client 1
The e-mail transmitted from E.02 is received by the e-mail protocol front end 111 and is checked for viruses by the virus check function 112. If you are not infected with the virus, the mail will be sent to mailbox 11
3 is stored. If the email was infected by a virus, the virus check function 112 detects it and
The virus detection notification function 114 is notified that a virus infection has been detected. The virus detection notification function 114 discards the virus-infected mail, and further sends a virus detection notification via the e-mail protocol front end 111 to the e-mail client 102 and the e-mail administrator terminal 103 that are the source of the e-mail. Automatically send to.

The email client 102 receives the virus detection notification via the email protocol front end 122. The received virus detection notification is output via the user interface 121, so that the user can know that the e-mail transmitted by the user has been infected with the virus. The e-mail administrator terminal 103 receives the virus detection notification via the e-mail protocol front end 131. Since the detection notification is sent by e-mail, it is received by the e-mail reception function. The received virus detection notification is output via the user interface 132, so that the e-mail administrator can know that a virus has been infected in the managed e-mail system.

FIG. 2 shows a specific configuration example of a system to which the virus detection and notification system according to the present invention is applied. A client 20 is connected to an internal network 207 of a company.
5, a management terminal 206, and a proxy server (gateway) 204 are connected. In-house network 20
Reference numeral 7 is connected to another e-mail server 201, document server 202, and the like via the Internet 203. Here, only one client 205 is shown, but it is assumed that a plurality of similar clients are connected to the in-house network 207 and the Internet 203. It is assumed that the in-house network 207 and the server 204 and the client 205 connected thereto are managed by the administrator of the management terminal 206.
Similarly, the email server 201 and the document server 202 are not servers directly connected to the in-house network 207, but are servers owned by the company, and are managed by the administrator of the management terminal 206.

The client 205 is a client used by an in-house end user, and includes a user interface 251, a virus detection notification system 252, and a protocol front end 253. The client 205 performs the function of the e-mail client 102 described with reference to FIG. 1, and includes a user interface 251 and a protocol front end 253.
Perform the functions of the user interface 121 and the e-mail protocol front end 122, respectively, of FIG. The virus detection notification system 252
This is a virus detection notification system that has been used conventionally, and has a function of detecting a virus in the client 205 and notifying the user of the client 205 of the detection result.

The e-mail server 201 includes a protocol front end 211, a virus detection notification system 21
2 and a mailbox 213. The e-mail server 201 fulfills the function of the e-mail server 101 described in FIG. 1, and the protocol front end 211 and the mailbox 213 perform the functions of the e-mail protocol front end 111 and the mailbox 113 in FIG. 1, respectively. To fulfill. The virus detection notification system 212 is a system having features according to the present invention, and is a program that implements the virus check function 112 and the virus detection notification function 114 described with reference to FIG.

The management terminal 206 includes a protocol front end 263, a virus detection / reception system 262, and a user interface 261. Management terminal 2
06 is the terminal 103 of the e-mail administrator described in FIG.
The protocol front end 263 and the user interface 261 fulfill the functions of the e-mail protocol front end 131 and the user interface 132 of FIG. 1, respectively. The virus detection / reception system 262 is for receiving a virus detection notification transmitted from the virus detection / notification system 212 of the e-mail server 201. Here, the e-mail reception function may be used as it is.

The operations of the client 205, the e-mail server 201, and the management terminal 206 in FIG. 2 are the same as those described with reference to FIG. That is, the client 205
When a virus is transmitted to an e-mail transmitted from the e-mail server 201, the virus detection notification system 21 of the e-mail server 201
2 detects this, and transmits a virus detection notification to the client 205 and the management terminal 206 as the transmission source. The client 205 receives the virus detection notification by the mail receiving function, whereby the user of the client 205 knows that the mail transmitted by the client 205 is infected with a virus, and the file or machine handled by the client 205 is infected with the virus. Various anti-virus measures can be performed, such as whether or not they have been performed. Further, the administrator using the management terminal 206 receives the virus detection notification by the virus detection / reception system 262, knows that a virus infection has been detected in the system, and can take necessary anti-virus measures. The virus detection notification system 212 transmits a virus detection notification immediately upon detection of a virus, so that prompt measures can be taken.

The client 205 uses the virus detection and notification system 252 in its own device to check the e-mails sent by itself for viruses. However, the latest version of the virus detection system is always installed in each client 205. Not necessarily. Therefore, it is conceivable that a virus that cannot be detected by the virus detection notification system in each client 205 is infected with the mail and transmitted. However, even in such a case, if the virus detection notification system 212 of the e-mail server 201 is the latest one, the virus can be detected here. The administrator does not need to pay attention to the latest virus detection notification system 252 of each client 205, and only the latest virus detection notification system 212 of the e-mail server 201 needs to be updated.

In the above example, the virus detection notification system applied to the electronic mail system has been described.
A similar virus detection notification system is provided in the document server 202 and the proxy server 204.

The document server 202 is a server that provides each client with various document management services. The document server 202 includes a protocol front end 221, a virus detection notification system 222, and a file server 223. The protocol front end 221 serves as an interface when various messages are exchanged with each client via the network 104. File server 22
Reference numeral 3 denotes a file server that manages document files.

The virus detection / notification system 222 of the e-mail server 201
It has the same function as. Virus detection is performed by the virus detection notification system 222 when the document management service is executed in response to a request from each client. Notification is sent. For example, when a document file is transmitted from the client 205 together with a document file storage request, the virus detection notification system 222 performs virus detection on the document file, and when the document file is infected with a virus,
Client 205 that has sent the virus detection notification
And transmits it to the management terminal 206 of the system administrator.

The proxy server 204 has a function of accepting an access request to the Internet 203 from a client 205 inside the company network 207 and acting as a proxy for the access. The proxy server 204 includes a protocol front end 241, a virus detection notification system 242, and a relay server 243. The protocol front end 241 serves as an interface when various messages are exchanged with each client via the network 104. The relay server 223 has a function of relaying various messages when proxying an access request from a client.

The virus detection notification system 242 is provided by the virus detection notification system 212 of the electronic mail server 201.
It has the same function as. The virus detection notification system 242 performs virus detection when executing a message relay service in response to a request from each client, and when a virus infection is detected, the creator of the message or a system administrator informs the virus of the virus. A detection notification is sent. For example, when the client 205 issues an access request to a certain site on the Internet 203, the virus detection notification system 242 performs virus detection on the data downloaded from the site by the relay server 243, and the virus has been infected. At this time, a virus detection notification is transmitted to the requesting client 205 and the management terminal 206 of the system administrator.

Each server 201, 202, 2 in FIG.
04 virus detection notification system 212, 222, 24
In 2, the virus detection notification is transmitted to the administrator of the management terminal 206. It is assumed that the address is held in each server in advance as the address of the system administrator. In addition, virus detection notification systems 212 and 22
In steps 2 and 242, the virus detection notification is transmitted to the client that issued the request, and it is assumed that the address is included in the request received by each server. For example, in the case of an e-mail, since the sender address is stored in the header of the e-mail sent from the client (described in detail in FIG. 4), the virus detection notification system 212 of the e-mail server 201 puts the header in the e-mail. Refer to and know the address to send the virus detection notification.

FIG. 3 is a flowchart showing the operation procedure of the virus detection and notification system according to the present invention. Here, the respective procedures of the client 205, the e-mail server 201, and the management terminal 206 described with reference to FIG.

FIG. 3A shows a processing procedure of the client 205 (or another mail system).
When a data transmission request is made by the user in step 301, it is determined in step 302 whether the data to be transmitted is infected with a virus (by the virus detection notification system 252). If not, the process proceeds to step 305, where the data is transmitted to the server to be transmitted, and the process is terminated. Step 302
In step 303, a message notifying of the virus infection is displayed on the self screen.
Then, in step 304, the user is made to select whether or not to transmit. When transmitting, the data is transmitted to the server in step 305, and the process is terminated. If no transmission is to be made in step 304, the process ends. Note that data infected with a virus may not always be transmitted.

FIG. 3B shows a procedure of the electronic mail server 201 for receiving the data transmitted in step 305. In step 311, the transmitted data is received. In step 312, it is checked whether the received data is infected with a virus (by the virus detection notification system 212). If no virus has been infected, the received data is stored in a predetermined area (mailbox 213) of the server in step 316, and the process is terminated. If the data received in step 312 is infected with a virus, in step 313 a notification destination to be notified that a virus has been detected is determined. It is assumed that the notification destination includes at least the data transmission source client and the system administrator. Next, in step 314, a virus detection notification is transmitted to those notification destinations. Then, in step 315, the user is made to select whether or not to store the received data. When storing the data, the data is stored in the server in step 316, and the process is terminated. If the data received in step 315 is not to be stored, the data is discarded and the process ends.

FIG. 3C shows the procedure of the client 205 that receives the virus detection notification transmitted in step 314. In step 321, a virus detection notification is received, and in step 322, the user is made to select whether to issue a request for deleting the data to the server. To delete, a deletion request is transmitted to the server in step 323, and the process ends. If not, the process ends. It is possible not to issue a deletion request to the server, and steps 322 and 323 may be omitted.

FIG. 3D shows the procedure of the management terminal 206 that receives the virus detection notification transmitted in step 314. When the virus detection notification is received in step 331, the system administrator is caused to select whether or not to delete the data in step 332. To delete, a deletion request is sent to the server in step 333, and the process ends.
If not deleted in step 332, the process ends. Do not issue a deletion request to the server,
Steps 332 and 333 may be omitted.

Although the e-mail server 201 has been described as an example in FIG. 3, the document server 20 in FIG.
The same applies when the present invention is applied to the proxy server 2 or the proxy server 204. 3A may be replaced with a process of transmitting a predetermined request to each server, and the process of FIG. 3B may be performed by the document server 202 or the proxy server 204.

FIG. 4 shows header information of an electronic mail used on the Internet or the like. The header information stores the sender and destination of the electronic mail, the destination of the carbon copy, the destination of the reply, the destination of the error mail, the route information, and the like. Therefore, when a virus infection is detected in an electronic mail (including an attached file) having such a header, a virus detection notification can be sent to a sender, a destination, a reply destination, a destination of an error mail, and the like. For this purpose, when determining the destination of the virus detection notification in step 313, these destination addresses may be obtained from the header information of the mail.

Further, a virus infection notification may be sent to each server in the route information of the header information in FIG. When the mail is transferred to each server in the route, the virus may infect other files on the server in the route, or a copy of the mail may remain on the server in the route. Because it can be done. Further, a server that relays various data may be provided with the virus detection notification system of the present invention. In this case, a virus check is performed on the data transferred from server to server, and when a virus is detected, the data to be sent is determined with reference to the data to determine the sender of the virus detection notification, such as the source and destination, Send virus detection notification.

FIG. 5 is a diagram for explaining a specific example of an operation in a network to which the virus detection notification system according to the present invention is applied. Network 501,502
Server 511-514 and client PC 52
1 to 525 are connected. Now, assume that the PC 524 has transmitted an e-mail with an attached file. It is assumed that the e-mail is transferred from the PC 524 to the server 513, where a virus infection is detected in the attached file by the virus detection notification system. The virus detection notification system of the server 513 immediately notifies the transmission source PC 524 of the virus detection notification.
At 24, data can be prevented from being sent to another device until the virus removal of the own device is completed.

It is also assumed that a mail with an attached file sent from the PC 524 passes through the servers 513 and 512, and the server 511 detects a virus infection in the attached file. The virus detection notification system of the server 511 immediately notifies the transmission source PC 524 and the transmission destination PC 521 of the virus detection notification, and prevents the mail from being sent to another server.

[0038]

As described above, according to the present invention,
When a virus is detected, a virus detection notification is automatically sent to a user such as a system administrator or a data transmission source, so that anti-virus measures can be taken promptly and the spread of the virus can be prevented. In particular, when applied to an e-mail system, a virus detection notification can be sent to the source, destination, reply destination, error mail destination, and relay server on the route of the e-mail. Since a certain person can be quickly notified, the spread of the virus can be prevented as much as possible.

[Brief description of the drawings]

FIG. 1 is a schematic diagram of a processing flow of an example in which a virus detection notification system of the present invention is applied to an electronic mail system.

FIG. 2 is a diagram showing a specific configuration example of a system to which the virus detection notification system according to the present invention is applied;

FIG. 3 is a flowchart showing an operation procedure of the virus detection and notification system according to the present invention.

FIG. 4 is a diagram showing header information of an e-mail.

FIG. 5 is an explanatory diagram of a specific example of an operation in a network to which the virus detection notification system according to the present invention is applied;

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 101 ... E-mail server, 102 ... E-mail client, 103 ... E-mail administrator terminal, 104 ... Network, 111 ... E-mail protocol front end, 112 ... Virus check function, 113 ... Mail box, 114 ... Virus detection notification function , 121, 1
32 ... User interface, 122, 131 ... E-mail protocol front end.

 ──────────────────────────────────────────────────続 き Continued on the front page (72) Inventor Tomofumi Hatsumi 5030 Totsukacho, Totsuka-ku, Yokohama-shi, Kanagawa Prefecture Software Development Division of Hitachi, Ltd.

Claims (6)

[Claims] 1. A virus detection notification system for checking whether data transferred on a network is infected with a virus, comprising: a virus check unit for performing a virus check on data transferred on the network; A virus detection notification system, comprising: a virus detection notification unit that sends a virus detection notification to a predetermined user when a virus infection is detected by the virus check unit. 2. A virus detection notification system for checking whether data transferred on a network is infected with a virus, comprising: a virus check unit for performing a virus check on data transferred on the network; A virus detection notifying unit that sends a virus detection notification to at least a system administrator and a transmission source or a request source of data in which the virus infection is detected when a virus infection is detected by the virus check unit. And virus detection notification system. 3. A virus detection notification system for checking whether an e-mail transferred on a network is infected with a virus, wherein the e-mail transferred on the network is checked for viruses. Means for detecting a virus infection by the virus check means, and a virus detection notifying means for sending a virus detection notice to at least a system administrator and a source or a destination of an e-mail in which the virus infection is detected. A virus detection notification system, characterized in that: 4. The virus detection notifying means reads information on a source, a destination, a reply destination, an error mail destination, and / or a relay server in a route from header information of the electronic mail, and reads those information. The virus detection notification system according to claim 3, wherein a virus detection notification is sent to the destination. 5. A virus detection notification method executed on a machine that relays data transferred on a network, the method comprising: performing a virus check on data transferred on the network; If a virus infection is detected,
Sending a virus detection notification to a predetermined user. 6. A storage medium storing a virus detection notification program for detecting and notifying a virus on a machine which relays data transferred on a network, wherein the virus detection notification program is transferred on the network. Performing a virus check on the data to be transmitted; and
Sending a virus detection notification to a predetermined user. A storage medium storing a virus detection notification program.