TW594472B - Computer virus scanning method for network data packet - Google Patents

Abstract

The computer virus scanning method of network data packet in the invention makes the anti-virus program resident in layer structure of customer premise network equipment. Thus, the invention can perform virus scanning process on input and output data packets with respect to customer premise network equipment. If no virus found, then regularly transmit data packet, if virus found, then modify infected portion and continue normal transmission of data packet or discard the data packet to stop the service. As a result, the web information containing virus will be totally expelled out of the customer premise network computer system.

Description

594472 V. Description of the invention 0) The computer virus scanning method of the network data packet according to the present invention is applied to the client network equipment, and can scan the data packets output and input by the client network equipment. At present, the anti-virus scanning software on the market is a method for scanning files in the form of files (F i 1 e). When computer users use the Internet to receive or transmit messages, they face computer viruses that have become files. It is a passive defense mode. Although the user's computer has anti-virus software installed, it is also possible for the virus entering the computer to take advantage of the fact that the user did not start the anti-virus software normally or the anti-virus software did not change the latest version in real time. In view of this, the present inventors have exhausted their minds and relying on their many years of experience in related research, the invention has finally come into being. Therefore, the present invention provides a computer virus scanning method for network data packets. The method uses a resident virus scanning program resident in a network device on a client side. Therefore, the virus scanning program can target the output and input of the network device on the client side. Data packets are used for virus scanning. The method of the present invention is different from the current virus scanning mode by detecting and removing computer viruses after the computer virus has entered the client's computer system. The computer virus has not yet become a file type. The state is about to remove it. Therefore, the purpose of the present invention is to provide a computer virus scanning method for network data packets. The method is to extract and remove computer viruses from data packets, which can prevent computer viruses from entering the client computer system as files. . To achieve the above object, the present invention is implemented as follows: A computer virus scanning method for network data packets is applied to a client-side network device, and includes at least the following steps in order:

594472 V. Description of the invention (2) (a) The resident antivirus program is in the hierarchical structure of the client-side network equipment, which is one of the following: the network access layer of the TCP / IP protocol; TCP / IP Internet layer of communication protocol; Host-to-host transmission layer of TCP / IP communication protocol; Application layer of TCP / IP communication protocol; Data link layer of OSI standard; * Internet layer of OSI standard; Transport layer of OSI standard; OSI Standard conversation layer; OSI standard presentation layer; or OSI standard application layer; (b) Anti-virus program for data packets output and input from client network equipment 'If there is no virus, data packets will be transmitted normally If there is a virus, carry out any of the following methods: I. Modify the virus; (i) Modify the virus part of the data packet; and (ii) Continue to transmit the modified data packet; II. Discard the data packet So that the service is interrupted, so that computers in the same domain will not receive data packets with viruses, and in addition, packets sent from the domain will not carry computer viruses. In order for your reviewers to further understand the structural features and functions of the present invention, the following specific embodiments are used in conjunction with the accompanying drawings to

594472 V. Description of the invention (3) The invention is explained in detail as follows: Hierarchical structure of data packets and communication protocols The personal computer can achieve the purpose of sharing resources with other people's computers through the computer host (h 0), Hardware components such as gateways and network transmission lines and software components such as TCP / IP communication protocols. The TCP / IP communication protocol is applicable to many types of network architectures, such as: Ethernet, tong ring, and X · 25 networks, etc., making network communications all over the world compatible. Content, so that information can be exchanged between domains of different network architectures, in addition to facilitating network communication, and also giving computer viruses a faster and wider channel of transmission. As shown in Figure 1, it is a diagram of the Internet architecture. Different network architectures communicate with each other through the TCP / IP protocol, and the internal network 10 is connected by the ring network 16 differently. Host computer (ho st), while LAN 2 0 is connected to different computer hosts by Ethernet 2 6, and internal network 10 and local network 2 0 pass through gateway 1 4 and gate respectively. Channel 2 4 is connected to the X. 2 5 network. Suppose there is a file currently. To transfer from the first client 1 2 of the token ring network 16 to the second client 2 2 of the Ethernet 2 6, you need to pass through the token ring network 1 6, X in order. . 2 5 network 30 and Ethernet 2 6. Among them, the client network equipment used mainly includes computer hosts (12, 22) and gateways (14, 24). Because the communication between the domain and the domain is through software and hardware architecture, in order to enable the computer systems of different clients to link to each other, the industry currently has standards for software and hardware manufacturers or producers to comply with For example ...

594472 V. Description of the invention (4) Communication protocol with TCP / IP and so on. As shown in Table 1, it is the hierarchical structure and corresponding relationship between the OSI standard and the TCP / IP communication protocol. Table 1 OSI Standard Application Layer (Application Layer) (Application Layer) (Presentation Layer) t-host-to-host Transport Layer Session Layer (Transport Layer) stele Network Layer Network Layer Data 4¾ Date Lint Layer and S5 · Ole t work Access Layer (Real Layer 0¾sicai Layer) Figure 2 shows the TCP / IP protocol. The hierarchical structure describes the communication mechanism between the domain and the domain. As shown in the figure, when the domain and the domain are performing link communication, if the TCP / IP protocol is used, the host computer (1 2, 2 2 ) Partially passed datagrams must pass through the application layer 4 1, host-to-host transmission layer 4 2, internet layer 43 and network access layer 4 4; and in the gateway (1 4, 2 4) The transmitted data packets must pass through the Internet layer 4 3 and the network access layer 4 4. Therefore, to transmit data using the Internet, at least go through the Internet layer 4 3 and the network access layer 4 of the TCP / IP protocol. 4. The packet was formed because of different networks The architecture has a defined maximum transmission unit.

594472 V. Description of the invention (5) U nit, Μ TU), so the data packet to be transmitted is cut into gateways in the network domain into data packets, and the different network architectures must also use different MTU to data Package to adjust. Please refer to Figure 3, in terms of the TCP / IP communication protocol, when the client sends data, it must pass through the application layer 4 1, the host-to-host transmission layer 42, the Internet layer 4 3 and network access in order. Layer 44; and when the other end user receives data, they pass through the network access layer 4 4, the Internet layer 4 3, and the host-to-host transmission layer 4 2 and the application layer 41 in the reverse order. Please refer to Figure 4 again. During the transmission of Internet data, a header A is added before the data B after each layer, and so on; One level, one meter A will be removed. It is known from the foregoing that the transmission process of the Internet adopts the type of cutting the file into several data packets, and the TCP / IP communication protocol must pass the Internet layer, network access layer, and host-to-host transmission layer and application. Similarly, when passing the OSI standard, you need to pass the data link layer, internet layer, transmission layer, conversation layer, presentation layer, application layer and physical layer. Therefore, the present invention resides in the hierarchical structure of the client's network equipment on the antivirus program (Note: Except the physical layer of the OSI standard, as it only represents the hardware component part). The data packet can be detected and removed during the process to prevent computer viruses from intruding into the computer system of the client. Scanning Network Data Packets Take the TCP / IP protocol as an example. The resident virus scanner is on the client computer.

594472 V. Description of the invention (6) In the unavailable network access layer, when the hierarchical structure obtains the data packet, the information recorded in the header will be analyzed and the data part will be scanned. During scanning: [After completion], the data package can be released, because the virus file 'will be cut into several copies during the network transmission process, so scanning for viruses will need to scan several data packages' to know that they belong to the same service. (HTTP, FTP, SMTP, POP 3 · · ·) Whether virus files are entrained. Master @: ίί After a case with a virus eaves in a service, immediately address the disease. No, Tian Guanghuan will make a clearing action, such as rewriting the virus part and filling it into 〇. Then the β is divided into clean packets, and then passed into the domain or out = domain. In this way, the transmission direction of the original Tcp / Ip protocol is not changed or affected, and the virus file can be cleared from each data package. As shown in Figures 5, 6 and 7. Please refer to Figure 5 for details. After sending all the packets 1 00, the service packet to be concealed will be transitioned out 1 0, and the system will determine whether it is the first packet of the service 1 2 0. If not, then according to the service number, send this ^ packet to the corresponding anti-virus program 130, and then decide whether to wait for the next packet 1 50 or end the anti-virus process 6 through step 40 of whether the service ends. 0. In step 120, if the service is the first packet, a new anti-virus schedule 170 will be established. Among them, according to whether the type of the SMTP / P3 service is 180, it is decided to enter the SMTP and Step 4 of the POP3 service packet, step 0 0 or step 3 for the SMTP and POP3 service packets, then go to Figure 6. If it is a packet for the SMTP and POP3 service, the root scan schedule, whether the service is infected with a virus 2 1 0 'If not, decode the encoding format of the file 2 2 0' Then scan the decoded content and judge

594472 V. Description of the invention (7), whether there is a virus file 2 3 0 in the service, if there is no virus file, the packet 2 4 0 is normally transmitted; if there is a virus, the part of the packet that is a virus 2 5 0 is modified, For example, rewrite the part of the virus and fill it with π 0 ”, and then send a clean packet 2 60 and record the service entrained ^ virus file 270 in the anti-virus schedule. After completing the recording, it will wait for the next packet Enter 2 80 ° 'In the step 2 10 of determining whether a service is infected with a virus, if the previous packet of the service has been determined to be infected with a virus, the system will directly proceed to step 2. 50 to modify the content of the packet to be a virus. Continued from Figure 7. If it is for packets that are not SMTP and POP3 services, if the service is infected with virus 3 1 0 according to the anti-virus schedule, if not, scan the contents of the packet to determine the service. If there is a virus file 3 2 0, if there is no virus file, the packet 3 3 0 is transmitted normally; if there is a virus, modify the part of the packet that is a virus 3 4 0. For example, rewrite the virus part and fill it with π 0π. , Then send Clean packet 3 50, and record virus files 3 60 0 in the anti-virus schedule. After the recording is completed, it will wait for the next packet to enter 3 7 0. In the step of determining whether the service is entrained with virus 3 1 0 If the previous packet of the service has been judged to be infected with a virus, the system will directly proceed to step 3 40 to modify the content of the packet as a virus. In the processing flow of the method of the present invention, it may further include making a virus scanning program. The step of recording the results, in which the contents of the record of the results of the anti-virus program include: schedule number, service number, service attribute and poisoning, as shown in Table 2.

Page 10 594472 V. Description of the invention (8) Table 2 Schedule number Service number Service attribute Poisoning or not UU UU http, ftp, smtp, P〇ρ3 Yes, no

In the foregoing embodiment, the network access layer of the T CP / IP communication protocol is used to describe where the anti-virus program of the present invention resides. In practical applications, it can be the Internet layer of the TCP / IP communication protocol and host-to-host transmission. Or application layer; if it is applied in the OSI standard, the anti-virus program resides in any of the data link layer, internet layer, transmission layer, conversation layer, presentation layer or application layer. In addition, when the system finds that the scanned data packet contains a virus, it can also directly discard the data packet to interrupt the transmission service of the data packet. As shown in Figure 8 and Figure 9, respectively, for SMTP / P0P3 and The processing flow of the data packets that are not part of the SMTP / POP3 service is different from the previous embodiment in that when the system detection service contains a virus, the packet is directly discarded (2 50 ', 3 40') To end the program (2 6 0 ', 3 5 0').

The location of the anti-virus program is based on the client network equipment. If TCP / IP is used as an example, if the anti-virus program is to be resident in the network gateway, the network gateway only contains The network access layer and the internet layer can only reside in either layer.

Page 11 594472 V. Description of the invention (9) According to the foregoing description, the computer virus scanning method of the network data packet of the present invention resides in the hierarchical structure of the network equipment on the client side. The hierarchical structure is TCP / Either the network access layer, the Internet layer, the host-to-host transmission layer, or the application layer in the IP protocol; or the data link layer, the Internet layer, the transmission layer, the conversation layer, the presentation layer, or the application layer in the OSI standard Any layer. Therefore, the present invention can perform a virus scanning program on the output and input data packets of the client-side network equipment. If there is no virus, the data packet is normally transmitted; if there is a virus, the virus part is modified, and then the virus-free packet is continued to be transmitted. , Internet data containing viruses will be completely screened in the client computer system, which can be said to be creative and progressive, comply with the statutory requirements of invention patents, and file an invention patent application according to law. Although the present invention is disclosed as above with a preferred embodiment, it is not intended to limit the scope of implementation of the present invention. Anyone skilled in the art can make some changes and modifications without departing from the spirit and scope of the present invention. That is, all equal changes and modifications made in accordance with the present invention shall be covered by the scope of the patent of the present invention. The definition shall be based on the scope of patent application.

Page 12 594472 Schematic description Figure 1 is a schematic diagram of the Internet architecture. Figure 2 shows the hierarchical structure of the TCP / IP protocol. Figure 3 is the first schematic diagram of data transmission of TCP / IP communication protocol. Figure 4 is the second schematic diagram of data transmission of TCP / IP communication protocol. FIG. 5 is a first schematic view of the process of the present invention. Figure 6 is the second schematic diagram of the process of the present invention. Fig. 7 is the third schematic diagram of the process of the present invention. FIG. 8 is another schematic view of the first process of the present invention. FIG. 9 is another schematic diagram 2 of the present invention. Brief description of drawing number: 10 · · · Intranet 12 · · · First client (computer host) 1 4 · · · Gateway 1 6 · · · Marked ring network 2 0 · · · LAN 22 · ·· Second client (computer host) 2 4 · · · Gateway 2 6 · · · Ethernet 3 0 · · · X · 2 5 Network 4 1 · •• Application layer

Page 13 594472 Brief description of the diagram 4 2 parameters 1. The service packet to be scanned by the agency 1 2 0 • • Whether it is the first packet of the service 1 3 0 • • Send this packet to the corresponding anti-virus program 1 4 0 • • Whether the service ends 1 5 0 • • Wait Next packet 1 6 0 • • End the anti-virus schedule 1 7 0 • • Create a new anti-virus schedule 1 8 0 • • Whether it is the type of SMTP / P0P3 service 2 0 0 • • For SMTP and POP 3 service packets Step 2 1 0 • • Whether the service is infected with a virus 2 2 0 • • Decodes the mail encoding format 2 3 0 • • Determines whether the service has a virus slot 2 4 0 • • Normally sends packets 2 5 0 • • Modify the The part of the packet that is a virus 2 6 0 Net packet 2 7 0 • • Record the case of this service with a virus slot 2 8 0 • • Wait for the next packet to enter 2 5 0, •• Discard the packet

Page 14 594472 Brief description of the diagram 2 6 0, • · End the program 3 0 0 · • Step 3 for non-SMTP and POP3 service packets 3 1 0 · • Whether the virus is entrained 3 2 0 · • Determine whether the service is entrained Virus slot 3 3 0 • • Normally transmit the packet 3 4 0 • • Modify the content of the packet as a virus 3 5 0 • • Transmit a clean packet 3 6 0 • • Record this service with a virus file 3 7 0 • • Will wait The next packet enters 3 4 0 '· · Drops the packet 3 5 0' · · Ends the program

Page 15

Claims (1)

594472 6. Scope of patent application1. A computer virus scanning method for network data packets, which is applied to client network equipment, and contains at least the following steps in order: (a) The hierarchy of resident virus scanners on the client network equipment In the framework; (b) Perform a virus scan procedure on the data packets output and input by the client-side network device. If there is no virus, the data packet is transmitted normally; if there is a virus, (i) modify the data packet. And (ii) continue to send modified data packets, whereby computers in the same domain will not receive virus-informed data packets, and packets sent from that domain will not Can carry computer viruses. 2 · The computer virus scanning method for network data packets as described in item 1 of the scope of the patent application, wherein the hierarchical structure of the client network equipment is the network access layer of the TCP / IP communication protocol. 3. The computer virus scanning method for network data packets as described in item 1 of the scope of patent application, wherein the hierarchical structure of the client-side network equipment is the Internet layer of the TCP / IP communication protocol. 4 · The computer virus scanning method for network data packets as described in item 1 of the scope of patent application, wherein the hierarchical structure of the client-side network equipment is the host-to-host transport layer of the TCP / IP communication protocol. 5 · The computer virus scanning method of the network lean packet described in item 1 of the scope of patent application, wherein the hierarchical structure of the client-side network equipment is the application layer of the TCP / IP communication protocol ° Page 16 594472 6. Scope of Patent Application ·· 6 · The computer virus scanning method for network data packets as described in Item 1 of the scope of patent application, wherein the hierarchical structure of the client-side network equipment is the data chain of the OSI standard Layer. 7 · Computer sickness of network data packets as described in item 1 of the scope of patent application:: The method of virus scanning, in which the hierarchical structure of the client network equipment is the Internet layer of the 0 SI standard. · '8 · The computer virus scanning method for network data packets as described in item 1 of the scope of patent application, wherein the hierarchical structure of the client-side network equipment is the _ OSI standard transmission layer. 9 · The method of scanning for computer disease-virus of network data packets as described in the first item of the scope of patent application, wherein the hierarchical structure of the client-side network equipment is the conversation layer of the φ OSI standard. 10 · The method for scanning computer viruses for network data packets as described in item 1 of the scope of patent application, wherein the hierarchical structure of the client-side network equipment is the presentation layer of the OSI standard. 1 1 · The computer virus scanning method for network data packets described in item 1 of the scope of patent application, wherein the hierarchical structure of the client-side network equipment is the application layer of the OSI standard. 1 2 · The computer virus scanning method for network data packets as described in item 1 of the scope of patent application, wherein the client network device is the computer host. 1 3 · The computer for network data packets described in item 1 of the scope of patent application. Virus scanning method, in which the 'client network equipment is a network gateway. Page 17 594472 VI. Patent Application Range 1 4 · The computer virus scanning method for network data packets as described in item 1 of the patent application range, wherein if the virus scanning process is performed on the output and input data packets, Viruses fill in the virus part of the data packet with digital filling. 1 5 · The computer virus scanning method for network data packets as described in item 1 of the scope of patent application, wherein when the virus scanning process is performed on the output and input data packets, if there is a virus, the data packets are modified by filling in the symbols In the virus section. 1 6 · Computer for network data packets as described in item 1 of the scope of patent application The virus scanning method further includes a step of preparing a record table of the results of the virus scanning program. 17 · The method for scanning computer viruses for network data packets as described in item 16 of the scope of patent application, wherein the contents of the record table for the results of the virus scan program include: schedule number, service number, service attribute, and poisoning or not . 1 8 — A computer virus scanning method for network data packets, which is applied to client network equipment and includes at least the following steps in order: (a) a resident virus scanner in the hierarchical structure of the client network equipment, ( b) anti-virus program for the data packets output and input by the client network equipment, If there is no virus, the data packet is transmitted normally; if there is a virus, the data packet is returned, so that computers in the same domain will not receive the virus data Page 18 594472 VI. Scope of patent application Packets, and packets sent from this domain will not carry encephalitis virus. 19 · The computer virus scanning method for network data packets as described in item 18 of the scope of the patent application, wherein the hierarchical structure of the client-side network equipment is the network access layer of the TCP / IP communication protocol. 20 • The method for scanning a computer virus for network data packets as described in item 18 of the scope of patent application, wherein the hierarchical structure of the client-side network equipment is the Internet layer of the TCP / IP communication protocol. 2 1 · The computer virus scanning method for network data packets as described in item 18 of the scope of patent application, wherein the hierarchical structure of the client-side network equipment is the host-to-host transmission layer of the TCP / IP communication protocol. 2 2 · The computer virus scanning method for network data packets as described in Item 18 of the scope of patent application, wherein the hierarchical structure of the client-side network equipment is the application layer of the TCP / IP communication protocol. 2 3. The method for scanning computer viruses of network data packets as described in item 18 of the scope of patent application, wherein the hierarchical structure of the client-side network equipment is the data link layer of the OSI standard. 24. The method for scanning computer viruses for network data packets as described in item 18 of the scope of the patent application, wherein the hierarchical structure of the client-side network equipment is the Internet layer of the 0 SI standard. 25 • The method for scanning a computer virus for network data packets as described in item 18 of the scope of patent application, wherein the hierarchical structure of the client-side network equipment is the transport layer of the OSI standard. 2 6 · Electricity of network data packets as described in item 18 of the scope of patent application Page 19 594472 6. Scope of patent application Brain virus scanning method, in which the hierarchical structure of client-side network equipment is the conversation layer of the OSI standard. 27 • The method for scanning computer viruses for network data packets as described in item 18 of the scope of patent application, wherein the hierarchical structure of the client-side network equipment is the presentation layer of the 0 SI standard. 2 8 · The computer virus scanning method for network data packets as described in item 18 of the scope of patent application, wherein the hierarchical structure of the client-side network equipment is the application layer of the 0 SI standard. 2 9 · The computer virus scanning method for network data packets as described in item 18 of the scope of patent application, wherein the client-side network equipment is a computer host. 30 • The method for scanning a computer virus in a network data packet as described in item 18 of the scope of patent application, wherein the client network device is a network gateway. 3 1 · The computer virus scanning method for network data packets as described in item 18 of the scope of patent application, further comprising the step of preparing a record table of the results of the virus scanning program. 3 2 · The computer virus scanning method for network data packets as described in item 31 of the scope of the patent application, wherein the contents of the record table for the results of the virus scanning program include: schedule number, service number, service attribute, and whether it is poisoned .