JP3597686B2 - Virus check network system and virus check device - Google Patents

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention is a virus check networkSystem andVirus check device, especially a virus check network that checks for viruses and prevents virus intrusionSystem andThe present invention relates to a virus check device that performs a virus check to prevent a virus from entering.
[0002]
[Prior art]
In recent years, information communication network technology such as multimedia communication has been rapidly advanced. Also, due to the trend of the Internet and the like, services provided by networks are widely used not only for corporations but also for ordinary households.
[0003]
On the other hand, the increase in computer viruses and the speed of infection are accelerating with the spread of networks, and it has been reported that many corporate users are suffering from virus damage.
[0004]
Conventionally, in order to protect networks from virus infection, vaccine software has been introduced into clients and proxy servers. By using this vaccine software, the virus can be removed from the file infected with the virus and the file can be repaired.
[0005]
[Problems to be solved by the invention]
However, since the conventional virus countermeasures as described above are performed on the client side, in order to prevent infection, vaccine software must be individually introduced to all clients.
[0006]
For this reason, for a new virus, the upgraded vaccine software must be introduced one by one from the beginning, and there is a problem that it takes much time and the efficiency is low.
[0007]
In addition, conventional virus countermeasures on the client side entail the problem that it is difficult to conduct thorough virus monitoring because the operation management, such as updating the pattern file when a new virus is found, is left to each user. there were.
[0008]
The present invention has been made in view of such a point, and a virus check network which prevents a virus on a network side and improves an anti-virus efficiency.systemThe purpose is to provide.
[0009]
Another object of the present invention is to provide a virus check device which prevents viruses on the network side and improves the anti-virus efficiency..
[0011]
[Means for Solving the Problems]
In the present invention, in order to solve the above problems, a virus check network for performing a virus check as shown in FIG.systemIn step 1, a virus pattern storage unit 11 for storing a virus pattern and a virus check to determine whether or not the received packet is an infected packet Pa infected with a virus based on the virus pattern are performed.A plurality of virus check areas are provided, and the virus check area assigned to each device is assigned. If the virus check area is newly placed on the network, the virus check charge area information is collected from other devices and the responsible area is collected. DetermineA plurality of virus check devices 10a to 10n each including a virus check unit 12 and a packet transmission unit 13 that, when an infected packet Pa is detected, sets a bit in the packet indicating infection and transmits it as an infection display packet Pb. A client terminal 20a to 20m comprising: an infected packet detection unit 21 for detecting an infected packet Pa based on the bit; and a file execution control unit 22 for disabling execution of a file corresponding to the infected packet Pa. A virus information management station 30 composed of virus pattern information distribution means 31 for distributing virus pattern information to the virus check devices 10a to 10n by multicast, and virus pattern information management means 32 for centrally managing the virus pattern information. Characterized by having I Luz check networksystem1 is provided.
[0012]
Here, the virus pattern storage unit 11 stores a virus pattern. The virus checking means 12 checks the received packet for a virus to determine whether it is an infected packet Pa infected with a virus based on the virus pattern.A plurality of virus check areas are provided, and the virus check area assigned to each device is assigned. If the virus check area is newly placed on the network, the virus check charge area information is collected from other devices and the responsible area is collected. To determine.When detecting the infected packet Pa, the packet transmitting means 13 sets a bit in the packet indicating the infection and transmits the bit as the infection indication packet Pb. The infected packet detection means 21 detects the infected packet Pa based on the bit. The file execution control means 22 transmits the infected packetPaMakes the file corresponding to unexecutable. The virus pattern information distribution means 31 distributes the virus pattern information to the virus check devices 10a to 10n by multicast. The virus pattern information management means 32 centrally manages virus pattern information.
[0013]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a virus check network of the present invention.systemFIG.
[0014]
Virus check networksystemReference numeral 1 is composed of virus check devices 10a to 10n, client terminals 20a to 20m, and a virus information management station 30, and performs a virus check to prevent virus intrusion.
[0015]
The virus pattern storage means 11 stores a virus pattern. The virus checking means 12 compares the received packet with a stored virus pattern, and checks whether the packet is an infected packet Pa infected with a virus.RowU.
[0016]
When detecting the infected packet Pa, the packet transmitting unit 13 sets a bit indicating the preset infection in the infected packet Pa, and transmits the bit as the infection display packet Pb.
[0017]
The infected packet detecting means 21 detects the infected packet Pa based on the bit of the infected indication packet Pb. The file execution control unit 22 disables execution of the file corresponding to the infected packet Pa.
[0018]
The virus pattern information distribution means 31 distributes the latest virus pattern information to the virus check devices 10a to 10n by multicast. The distributed virus pattern is stored in the virus pattern storage unit 11.
[0019]
The virus pattern information management means 32 centrally manages new setting and updating of virus pattern information.
Next, the virus check network of the present inventionsystemAn embodiment in which 1 is applied to a network on the Internet constituted by a router will be described below. The virus check devices 10a to 10n of the present invention are arranged in some routers., CPerform a virus check.
[0020]
Note that the router in which the virus check device is arranged is hereinafter referred to as a virus check router.
FIG. 2 is a diagram showing an outline of a network in which a virus check router is arranged. The network 1 includes routers R1 to R8, client terminals 20a to 20m, and a virus information management station 30.
[0021]
In the figure, routers R1, R2, R3 and R4 are virus check routers, and the others have only normal router functions. The virus information management station 30 connects to the virus check router R2, and the client terminals 20a to 20m connect to the virus check router R4.
[0022]
The virus check routers R1 to R4 are responsible for determining which part (head, middle, and end) of the virus is to be checked, and are arranged to pass each charge at least once.
[0023]
Each of the virus check routers R1 to R4 receives the virus pattern VP distributed by multicast from the virus information management station 30, and always keeps the latest virus information.
[0024]
The virus check routers R1 to R4 compare the received packet with the stored virus pattern VP. If so, set a bit in the packet.
[0025]
At this time, a warning packet Pw1 is simultaneously returned to the transmission source, and a warning information packet Pw2 is distributed to each virus check router R1 to R4 by multicast.
[0026]
Each of the virus check routers R1 to R4 that has received the alert information packet Pw2 detects the virus preferentially or cuts off communication with the infection source.
The client terminals 20a to 20m constantly monitor the packet, and display a message to the user when the bit indicating the infection is set or when the packet is the warning packet Pw1, and prompt the user to delete the received file.
[0027]
Next, the virus pattern VP will be described. The virus pattern VP is periodically distributed on a multicast. When a new type of virus is found, the virus information management station 30 sends the newly created virus pattern VP to each of the virus check routers 10a to 10n by multicasting. Update.
[0028]
FIG. 3 is a diagram showing a format of the virus pattern VP. The virus pattern VP has Ether Header and IP Header (Multicast) in the header VP-1.
It has a code VP-2 indicating virus pattern distribution, a serial number VP-3 indicating the type of virus, and its version (revision number) VP-4.
[0029]
After these, from the actual virus binary, the leading part (virus pattern in the first area) VP-6, the middle part (virus pattern in the second area) VP-7, and the ending part (virus pattern in the third area) VP Attach -7 extracted for each fixed length byte.
[0030]
The extracted portion is arbitrarily determined by the virus information management station 30, and is changed periodically to update the version VP-4.
In addition, the virus information management station 30 determines the threat level VP-5 according to the risk of the virus. This makes it possible to respond according to the degree of danger.
[0031]
The virus check routers 10a to 10n add their own virus pattern VP to a search table described later based on the received data. At this time, each of the virus check routers 10a to 10n has determined which area is to be assigned, and receives only its own pattern from the received packet.
[0032]
Next, the storage format of the virus pattern VP will be described. FIG. 4 is a diagram showing the storage format of the virus pattern storage means 11.
The virus pattern storage means 11 stores the virus pattern VP separately in a search table 11a and serial number holding information 11b.
[0033]
The search table 11a has a hierarchical tree structure. These are referred to as a primary hierarchy, a secondary hierarchy, a tertiary hierarchy,. Also, each branch part is associated with a serial number.
[0034]
The serial number holding information 11b holds the current serial number, version, and threat level of the user, and when a multicast packet of the virus pattern VP arrives, compares it with the multicast packet to determine whether or not a change is necessary. .
[0035]
Next, a process for newly adding a virus packet VP to the search table 11a will be described. Each of the virus check routers 10a to 10n stores the serial number and the version number of the virus pattern VP held by itself in the serial number holding information 11b separately from the search table 11a.
[0036]
Upon receiving its own charge from the new virus pattern VP by multicast, the virus pattern VP search table 11a is updated based on the serial number holding information 11b recording the virus pattern VP information.
[0037]
First, check the serial number and version to determine if any changes are needed. When it is determined that a change is necessary, the search table 11a is compared with the first layer, the second layer,... To search for a portion that does not overlap, and a new branch is extended therefrom. Thereafter, the newly added branch is moved to the top and the registration is completed.
[0038]
FIG. 5 is a flowchart showing a processing procedure when a virus pattern VP is newly registered in the virus pattern storage means 11.
[S1] It is determined whether the serial number is stored in the virus check router. If it has, go to step S2; otherwise, go to step S4.
[S2] It is determined whether the version is updated. If it is an update, the process proceeds to step S3, and if not, the process ends.
[S3] The branch of the target serial number is deleted.
[S4] Compare with the first layer. Details of step S4 will be described with reference to FIG.
[0039]
FIG. 6 is a flowchart showing a processing procedure when a new branch is created in comparison with the n-th hierarchical level.
[S10] One character is taken from the virus pattern.
[S11] The search table 11a is compared with the n-th layer of the existing search table 11a.
[S12] If hit, go to step S13, otherwise go to step S14.
[S13] Compare with the next (n + 1) th layer.
[S14] Branches are added.
[S15] The branch priority is raised.
[0040]
According to the processing procedure described above, a branch corresponding to the new type of virus pattern VP is created and stored.
Next, the configuration of the virus check router 10 will be described. FIG. 7 is a diagram showing a configuration of the virus check router 10.
[0041]
The normal packet shown in the figure is subjected to virus check by the virus check filter 12 corresponding to the virus check means 12 of the present invention.
Here, the packet to be subjected to the virus check is a packet whose contents are TCP and any one of ftp, http, and smtp, and have not yet been checked.
[0042]
However, other packets are passed through the virus check filter 12 without performing a virus check in order to reduce the load. Also, a packet having an offset value equal to or more than a certain value, that is, a packet at the end of the flow is passed. At this time, a virus checked bit is set.
[0043]
On the other hand, the multicast packet is subjected to a virus pattern update process using the serial number holding information 11b, and is stored in the search table 11a in a hierarchical tree structure.
[0044]
Then, after the route calculation unit 13a calculates the route, the packet generation / transmission unit 13b generates an infection indication packet Pb in which a bit is set in an optional field of an IP header described later for the packet caught by the virus check. . Bits are set for subsequent packets of the same flow.
[0045]
Further, the packet generation and transmission unit 13b generates a warning packet Pw1 toward the transmission source of the IP packet. After that, an infection display packet Pb and a warning packet Pw1 are transmitted.
[0046]
The alert mode setting means 14 for setting the alert mode to block communication with the infection source will be described later.
On the other hand, the client terminal 20 monitors a bit indicating a virus infection in the IP header by software. The client terminal 20, which has received the infection display packet Pb and the warning packet Pw1 in which the bit has been set, displays a message to the user that a virus has been infected.
[0047]
Next, the configuration of the IP header will be described. FIG. 8 is a diagram showing the configuration of the IP header.
The version is 4 bits and indicates the format of the Internet header. The IHL (Internet Header Length) is 4 bits, and the header length is indicated in 32-bit words. The service type is 8 bits and indicates service quality such as throughput. The total length is 16 bits and indicates the length measured in octets. Note that the total length includes a header and data.
[0048]
The identification number is 16 bits and is used when assembling a datagram fragment with a value assigned to identify the sender. Flag is 3 bits and indicates control such as permission or continuation of fragment division. The fragment offset is 13 bits and indicates the position occupied by the fragment in the datagram.
[0049]
ttl is 8 bits and indicates the minimum value of the time that the datagram can stay in the Internet system. The protocol is 8 bits and indicates the transport layer protocol to which the data part of the datagram should be passed. The header checksum is 16 bits and indicates a checksum for the header.
[0050]
The start address is 32 bits and indicates the IP address of the start point. The destination address is 32 bits and indicates the IP address of the destination. Options are of variable length and can be arbitrarily defined by the user. In the present invention, an infection display packet Pb, a warning packet Pw1, and a warning information packet Pw2 are generated using this optional area.
[0051]
Next, the virus checking means 12 will be described. FIG. 9 is a flowchart illustrating a virus check processing procedure.
[S20] It is determined whether another virus check router has already performed the check. If the check has been completed, the process proceeds to step S30; otherwise, the process proceeds to step S21.
[S21] It is determined whether the offset value is equal to or greater than a predetermined value. If it is not less than a certain value, go to step S30, otherwise go to step S22.
[S22] It is determined whether the packet is a TCP packet and one of http, ftp, and smtp. In that case, go to step S23, otherwise go to step S30.
[S23] A virus check is performed. Details will be described with reference to FIG.
[S24] It is determined whether the computer is infected. If infected, go to step S28, otherwise go to step S25.
[S25] One byte of the next packet is taken.
[S26] It is determined whether or not the processing is to be ended. If the processing has been completed, the process returns to step S27; otherwise, the process returns to step S23.
[S27] A checked bit is set.
[S28] A bit is set in the option field of the IP header.
[S29] A warning packet Pw1 and a warning information packet Pw2 are issued.
[S30] The route is calculated.
[0052]
Next, the virus check routine in step S23 will be described. One byte in the packet is taken and compared with the first layer in the search table 11a. If there is the same one, the next one byte is taken from the packet and compared with the second layer under the coincident branch.
[0053]
If this is not the case, the next byte of the packet is taken out and the comparison is repeated from the beginning. If this is repeated until the end, this byte is determined to be infected with a virus, and a bit is set in an optional field of the IP header.
[0054]
If the packet ends in the middle of the search, it is assumed that the packet has not been infected, and instead, it is left to the virus check router that is in charge of another area.
FIG. 10 is a flowchart showing the procedure of the virus check routine.
[S40] One byte is extracted from the packet.
[S41] It is determined whether the packet is completed. If the packet has been completed, the process ends; otherwise, the process proceeds to step S42.
[S42] The virus pattern is compared with the n-th layer.
[S43] It is determined whether a hit has occurred. If there is a hit, go to step S46, otherwise go to step S44.
[S44] The hierarchy is returned to the primary level.
[S45] The primary layer is checked.
[S46] The hierarchy is set to the (n + 1) th level.
[S47] It is determined whether the virus check has been completed. If it is completed, the process proceeds to step S49, otherwise, the process proceeds to step S48.
[S48] The (n + 1) th layer is checked.
[S49] Judge as virus infection.
[0055]
Next, the bits set at the time of virus check will be described. When a virus check is performed by the virus check router, first, the IHL field is incremented by 1 to secure an optional area. Then, a bit is set in the secured option area.
[0056]
FIG. 11 is a diagram showing a format of an IP packet of the infection indication packet Pb. First, the IHL field is incremented by one. Then, the option area is set as The Copied flag = 0, The option Classes = 3 (area for future reservation), The option Number = 1 (infection display packet Pb: code indicating that virus check was performed), and Length = 5. I do.
[0057]
In addition, as the Option Value, the first bit is assigned to the first area check not / completed, the second bit is assigned to the second area check not / completed, and the third bit is assigned to the third area check not / completed. That is, information indicating whether a virus check has been performed is described.
[0058]
The fourth bit indicates virus uninfected / infected, indicating 0 if not infected and 1 if infected, indicating an infection indication packet Pb. The fifth and subsequent bits are a serial number.
[0059]
Next, the warning packet Pw1 will be described. When a virus is detected by the virus check router, a warning packet Pw1 is transmitted to the transmission source, and a warning information packet Pw2 is transmitted by multicast to surrounding virus check routers. This will help detect viruses early and prevent their spread.
[0060]
The warning packet Pw1 sets the bit of the option area of the IP header similarly to the packet at the time of virus detection, and is delivered to the transmission source in the following format.
FIG. 12 is a diagram showing a format of the warning packet Pw1. First, the IHL field is incremented by one. Then, the option area is set as The Copied flag = 0, The option Classes = 3 (area for future reservation), The option Number = 2 (code indicating the warning packet Pw1), and Length = 3. Then, the unchecked / unchecked option described with reference to FIG. 11 is added. The destination address is the address of the infection source.
[0061]
Next, processing on the client side will be described. FIG. 13 is a diagram showing a configuration of the client terminal 20. The infected packet detection means 21 of the present invention is included in the LAN driver 21a, and the file execution control means 22 is included in the TCP / IP driver 22b.
[0062]
The LAN driver 21a looks at the virus check bit of each packet for each flow sent. Then, it is determined whether or not the bit is set, and the result is notified to the TCP / IP driver 22b.
[0063]
Upon receiving the notification that the bit is set, the TCP / IP driver 22b disables the corresponding file and displays a message 20-1 to delete the file.
[0064]
Next, the flow of bit monitoring in the client terminal 20 will be described. FIG. 14 and FIG. 15 are flowcharts showing the processing procedure of the bit monitoring of the client terminal 20.
[S50] The packet is read.
[S51] It is determined whether the flow is a new flow. If it is a new flow, go to step S52, otherwise go to step S53.
[S52] Flow information is added.
[S53] It is determined whether the flow is an end flow. In the case of the end flow, the process proceeds to step S54, and otherwise, the process proceeds to step S55.
[S54] The corresponding flow is deleted from the flow information.
[S55] The bit is checked.
[S56] It is determined whether a hit has occurred. If there is a hit, go to step S58, otherwise go to step S57.
[S57] The process is passed to the TCP / IP driver 22b.
[S58] It is determined whether the packet is a warning packet Pw1. If it is a warning packet, go to step S59, otherwise go to step S60.
[S59] A warning message is displayed.
[S60] The right to execute the file is removed.
[S61] A warning message 20-1 is displayed.
[0065]
Next, the alert information packet Pw2 will be described. When a virus is detected by the virus check router, a warning information packet Pw2 is output to each virus check router by multicast. The alert information packet Pw2 has the serial number of the virus packet and the source IP address as information, and is distributed by multicast.
[0066]
Each virus check router that has received the alert information packet Pw2 increases the search priority of the virus pattern VP of the received serial number.
FIG. 16 is a diagram showing a format of the alert information packet Pw2. The alert information packet Pw2 has Ether Header and IP Header (Multicast) in the header Pw2-1.
[0067]
It has a code Pw2-2 indicating alert information, a serial number Pw2-3 indicating the type of virus, and its version (revision number) Pw2-4.
Further, a threat level Pw2-5 according to the degree of risk of the virus and an IP address Pw2-6 of the virus infection source are given.
[0068]
Next, a processing procedure of a search order when the alert information packet Pw2 is received will be described. FIG. 17 is a diagram illustrating a processing procedure of a search order when the alert information packet Pw2 is received.
[S70] The serial number is obtained from the alert information packet Pw2.
[S71] The search order of the first hierarchical level, the second hierarchical level,..., The nth hierarchical level is increased to the highest level.
[0069]
Next, the alert mode setting means 14 for interrupting communication with the infection source will be described. If the threat level is higher than a certain level, the virus check router interrupts communication with the host for a certain period of time to prevent its spread.
[0070]
Looking at the threat level in the alert information packet Pw2, if the threat level is higher than a certain level, the IP address is stored in a table, and the mode shifts to the alert mode.
In the alert mode, packets that come before normal processing are checked, and packets that come from the address in the table and packets that go to the address in the table are all discarded for a certain period of time.
[0071]
The time for discarding is such that the retransmission request times out, and a counter is set together when the data is stored in the table.
If no packet arrives within this time, it is deleted from the table and the alert mode is released. Conversely, when a packet arrives, the time (count value of the counter) is extended.
[0072]
FIG. 18 is a flowchart showing a procedure in the alert mode performed by the alert mode setting means 14.
[S80] It is determined whether the threat level is equal to or higher than a certain level. If the value is equal to or more than a certain value, the process proceeds to step S81;
[S81] An IP address and a counter value for counting the time to keep in the alert mode are set in the alert IP address table holding the alert IP address.
[S82] The packet is read.
[S83] It is determined whether or not the start / end addresses match the table. If they match, go to step S84, otherwise go to step S86.
[S84] The packet is discarded.
[S85] The counter value is extended. That is, the time for setting the alert mode is further extended.
[S86] The counter value is decreased. That is, the time for the alert mode is reduced.
[S87] It is determined whether to end the counter. If the processing has been completed, the process returns to step S88; otherwise, the process returns to step S82.
[S88] The IP address and the counter value are deleted from the alert IP address table.
[S89] Normal mode is set.
[0073]
Next, a description will be given of load balancing and improvement of check accuracy by cooperation of virus check routers. The binary data of the virus is small, and the binary may be divided across the packets. Therefore, the virus pattern VP assigned to each virus check router is shared differently and held.
[0074]
As a result, even if a virus binary is cut in the middle of a packet in a certain area, another packet is checked in another area.
[0075]
Each assignment of the virus pattern to the virus check router can be set manually or automatically. However, in the case of manual setting, the configuration is such that all areas are checked before the packet arrives at the destination, that is, the configuration is such that the packet passes at least once through the assigned virus check router. There is a need to.
[0076]
Next, the case of automatically setting will be described. FIG. 19 is a diagram showing the format of the assigned area request packet. Automatically set using the format shown in the figure.
[0077]
First, the new virus check router distributes the assigned area request packet 100 to all the virus check routers to which it can distribute.
In this case, it is necessary to set the ttl region to be small and to avoid applying an unnecessary load as much as possible.
[0078]
Also, based on its own routing information, it issues a packet in which the destination address is inserted to each virus check router to which it is connected.
The optional area is set as The Copied flag = 0, The option Classes = 3 (area for future reservation), The option Number = 3 (code indicating assigned charge area request packet 100), Length = 3, and “empty” .
[0079]
Each virus check router that has received the assigned area request packet 100 returns its assigned area in the assigned area request response packet 101 as follows to the transmission source. FIG. 20 is a diagram showing the format of the assigned assignment area request response packet 101.
[0080]
If ttl still remains, it broadcasts to all virus check routers within the deliverable range other than the virus check router received by itself.
The optional areas of the assigned assignment area request response packet 101 are The Copied flag = 0, The option Classes = 3 (area for future reservation), The option Number = 4 (code indicating the assigned assignment area request response packet 101), Length = 3, “assigned area” is set.
[0081]
Further, the virus check router on the transmitting side totals the number of routers in charge of each area from the returned assigned area request packet 101, and determines the area with the fewest routers in charge in its own area. And
[0082]
As described above, the virus check network of the present inventionsystem1 is that by installing a virus check function in a virus check router, a virus can be detected on the network side, and virus intrusion can be prevented for more clients and more reliably.
[0083]
In addition, the latest virus pattern information is always exchanged and notified between virus check routers by multicast, and the only update method is to issue multicast packets. Therefore, it is easy and quick to respond to new viruses. Can be. There is no need to update on the client side.
[0084]
Furthermore, each virus check router simultaneously issues a warning about the detected virus, thereby preventing early detection and preventing spread. Then, a virus packet can be notified to the transmission source by sending a warning packet.
[0085]
In addition, by sharing the virus check area with each virus check router, the load on each virus check router can be distributed, and even if a virus exists between frames, the virus that is in charge of one of them is assigned. The check can be performed by the check router, and the accuracy of the virus check is improved.
[0086]
Further, by setting a bit in the IP header and notifying the receiving side without dropping the packet in which the virus is detected, unnecessary increase in traffic due to retransmission or the like can be prevented. Since the communication is cut off in accordance with the threat level of the virus, the spread of infection can be prevented.
[0087]
【The invention's effect】
As described above, the virus check network of the present inventionsystemHas multiple virus checking devices, CThe virus check was performed. As a result, the virus can be prevented from occurring on the network side, so that the infection and spread of the virus can be prevented, and the efficiency of the virus check countermeasure can be improved.
[Brief description of the drawings]
FIG. 1 is a virus check network of the present invention.systemFIG.
FIG. 2 is a diagram showing an outline of a network in which a virus check router is arranged.
FIG. 3 is a diagram showing a format of a virus pattern VP.
FIG. 4 is a diagram showing a storage format of a virus pattern VP storage unit.
FIG. 5 is a flowchart showing a processing procedure when a virus pattern VP is newly registered in the virus pattern storage means.
FIG. 6 is a flowchart illustrating a processing procedure when a new branch is created in comparison with the n-th hierarchical level.
FIG. 7 is a diagram showing a configuration of a virus check router.
FIG. 8 is a diagram showing a configuration of an IP header.
FIG. 9 is a flowchart showing a virus check processing procedure.
FIG. 10 is a flowchart illustrating a processing procedure of a virus check routine.
FIG. 11 is a diagram showing a format of an IP packet of an infection indication packet.
FIG. 12 is a diagram showing a format of a warning packet.
FIG. 13 is a diagram illustrating a configuration of a client terminal.
FIG. 14 is a flowchart illustrating a bit monitoring processing procedure of the client terminal.
FIG. 15 is a flowchart illustrating a bit monitoring process performed by a client terminal;
FIG. 16 is a diagram showing a format of an alert information packet.
FIG. 17 is a diagram showing a processing procedure of a search order when an alert information packet is received.
FIG. 18 is a flowchart illustrating a processing procedure in the alert mode.
FIG. 19 is a diagram showing a format of a charge sharing area request packet.
FIG. 20 is a diagram showing a format of a charge sharing area request response packet.
[Explanation of symbols]
1 virus check networksystem
10a-10n virus check device
11 Virus pattern storage means
12 Virus checking means
13 Packet transmission means
20a-20m Client terminal
21 Infected packet detection means
22 File execution control means
30 Virus Information Management Bureau
31 Virus pattern information distribution means
32 Virus pattern information management means
Pa infection packet
Pb infection indication packet

Claims (8)

In a virus check network system that performs virus check and prevents virus intrusion,
And virus pattern storage means for storing a virus pattern, based on the received packet to the virus pattern, have rows the virus check whether infectious packets that are infected with a virus, a plurality of areas for performing the virus check Te, share the virus check area in charge for each device, when placed on the network novel, and virus checking means for determining the coverage area to collect charge area information of the virus checking from another device, A plurality of virus check devices, comprising: a packet transmitting unit that sets a bit in a packet indicating infection and transmits the packet as an infection indication packet when detecting the infected packet;
A client terminal comprising: an infected packet detection unit that detects the infected packet based on the bit; and a file execution control unit that disables execution of a file corresponding to the infected packet.
A virus information management station comprising: virus pattern information distribution means for distributing virus pattern information to the virus check device by multicast; and virus pattern information management means for centrally managing the virus pattern information;
A virus check network system comprising: 2. The virus check network system according to claim 1, wherein the virus check means selects the packet to be checked for the virus by looking at a header of the packet. The virus check network system according to claim 1, wherein the virus check device is arranged in a router. The virus check network system according to claim 1, wherein the virus check devices notify the virus pattern information to each other by the multicast. 2. The virus check network system according to claim 1, wherein the virus check device further includes a security mode setting unit that sets a security mode according to a threat level of the virus and shuts off communication with a host for a predetermined time. . The packet transmitting unit transmits a warning packet to a transmission source of the infected packet together with the transmission of the infected indication packet, and a warning information packet in which information of the infected packet to be watched by another virus check device is written. 2. The virus check network system according to claim 1, wherein the virus check is distributed by multicast. 7. The virus check network system according to claim 6, wherein the virus check unit performs the virus check by increasing a priority of the virus pattern of the infected packet described in the alert information packet. In a virus check device that performs virus check and prevents virus intrusion,
Virus pattern storage means for storing a virus pattern;
Based the received packet to the virus pattern, have rows the virus check whether infectious packet infected with a virus, by providing a plurality of areas for performing the virus check, a virus check area in charge for each device sharing and, when placed on the network novel, and virus checking means for determining the coverage area to collect charge area information of the virus checking from another device,
In the case of the infected packet, a packet transmitting unit that sets a bit in the packet indicating the infection and transmits the packet as an infected indication packet;
A virus check device comprising:

Images