Connect public, paid and private patent data with Google Patents Public Datasets

Threat protection network

Info

Publication number
WO2006039208A2
WO2006039208A2 PCT/US2005/034205 US2005034205W WO2006039208A2 WO 2006039208 A2 WO2006039208 A2 WO 2006039208A2 US 2005034205 W US2005034205 W US 2005034205W WO 2006039208 A2 WO2006039208 A2 WO 2006039208A2
Authority
WO
Grant status
Application
Patent type
Prior art keywords
threat
potential
system
server
computer
Prior art date
Application number
PCT/US2005/034205
Other languages
French (fr)
Other versions
WO2006039208A3 (en )
Inventor
Bing Liu
Original Assignee
Cyberdefender Corporation
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433Vulnerability analysis
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRICAL DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/22Detection or location of defective computer hardware by testing during standby operation or during idle time, e.g. start-up testing
    • G06F11/2294Detection or location of defective computer hardware by testing during standby operation or during idle time, e.g. start-up testing by remote test
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRICAL DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10Protecting distributed programs or content, e.g. vending or licensing of copyrighted material
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRICAL DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures
    • G06F21/56Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/568Computer malware detection or handling, e.g. anti-virus arrangements eliminating virus, restoring damaged files
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRICAL DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577Assessing vulnerabilities and evaluating computer system security
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to network resources
    • H04L63/102Entity profiles
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/12Applying verification of the received information
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network-specific arrangements or communication protocols supporting networked applications
    • H04L67/10Network-specific arrangements or communication protocols supporting networked applications in which an application is distributed across nodes in the network
    • H04L67/104Network-specific arrangements or communication protocols supporting networked applications in which an application is distributed across nodes in the network for peer-to-peer [P2P] networking; Functionalities or architectural details of P2P networks
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network-specific arrangements or communication protocols supporting networked applications
    • H04L67/10Network-specific arrangements or communication protocols supporting networked applications in which an application is distributed across nodes in the network
    • H04L67/104Network-specific arrangements or communication protocols supporting networked applications in which an application is distributed across nodes in the network for peer-to-peer [P2P] networking; Functionalities or architectural details of P2P networks
    • H04L67/1042Network-specific arrangements or communication protocols supporting networked applications in which an application is distributed across nodes in the network for peer-to-peer [P2P] networking; Functionalities or architectural details of P2P networks involving topology management mechanisms
    • H04L67/1044Group management mechanisms
    • H04L67/1053Group management mechanisms with pre-configuration of logical or physical connections with a determined number of other peers
    • H04L67/1057Group management mechanisms with pre-configuration of logical or physical connections with a determined number of other peers involving pre-assessment of levels of reputation of peers
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network-specific arrangements or communication protocols supporting networked applications
    • H04L67/10Network-specific arrangements or communication protocols supporting networked applications in which an application is distributed across nodes in the network
    • H04L67/104Network-specific arrangements or communication protocols supporting networked applications in which an application is distributed across nodes in the network for peer-to-peer [P2P] networking; Functionalities or architectural details of P2P networks
    • H04L67/1061Network-specific arrangements or communication protocols supporting networked applications in which an application is distributed across nodes in the network for peer-to-peer [P2P] networking; Functionalities or architectural details of P2P networks involving node-based peer discovery mechanisms
    • H04L67/1063Discovery through centralizing entities
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00Application independent communication protocol aspects or techniques in packet data networks
    • H04L69/30Definitions, standards or architectural aspects of layered protocol stacks
    • H04L69/32High level architectural aspects of 7-layer open systems interconnection [OSI] type protocol stacks
    • H04L69/322Aspects of intra-layer communication protocols among peer entities or protocol data unit [PDU] definitions
    • H04L69/329Aspects of intra-layer communication protocols among peer entities or protocol data unit [PDU] definitions in the application layer, i.e. layer seven
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRICAL DIGITAL DATA PROCESSING
    • G06F2221/00Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/07Indexing scheme relating to G06F21/10, protecting distributed programs or content
    • G06F2221/0757Licence
    • G06F2221/0773Recurrent authorisation
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network-specific arrangements or communication protocols supporting networked applications
    • H04L67/10Network-specific arrangements or communication protocols supporting networked applications in which an application is distributed across nodes in the network
    • H04L67/104Network-specific arrangements or communication protocols supporting networked applications in which an application is distributed across nodes in the network for peer-to-peer [P2P] networking; Functionalities or architectural details of P2P networks
    • H04L67/1061Network-specific arrangements or communication protocols supporting networked applications in which an application is distributed across nodes in the network for peer-to-peer [P2P] networking; Functionalities or architectural details of P2P networks involving node-based peer discovery mechanisms
    • H04L67/1072Discovery involving ranked list compilation of candidate peers
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network-specific arrangements or communication protocols supporting networked applications
    • H04L67/10Network-specific arrangements or communication protocols supporting networked applications in which an application is distributed across nodes in the network
    • H04L67/104Network-specific arrangements or communication protocols supporting networked applications in which an application is distributed across nodes in the network for peer-to-peer [P2P] networking; Functionalities or architectural details of P2P networks
    • H04L67/1074Network-specific arrangements or communication protocols supporting networked applications in which an application is distributed across nodes in the network for peer-to-peer [P2P] networking; Functionalities or architectural details of P2P networks for supporting resource transmission mechanisms
    • H04L67/1078Resource delivery mechanisms
    • H04L67/108Resource delivery mechanisms characterized by resources being split in blocks or fragments

Abstract

Threat protection networks are described. Embodiments of threat protection network in accordance with the invention use expert systems to determine the nature of potential threats to a remote computer. In several embodiments, a secure peer-to-peer network is used to rapidly distribute information concerning the nature of the potential threat through the threat protection network. One embodiment of the invention includes at least one client computer connected to a network, a server that stores threat definition data and is connected to the network, an expert system in communication with the server. In addition, the client computer is configured to refer potential threats to the server, the server is configured to refer to the expert system any potential threat forwarded by a client computer that is not identified in the threat definition data and the expert system is configured to determine whether the potential threat is an actual threat by exposing at least one test computer to the potential threat and observing the behavior of the test computer.

Description

THREAT PROTECTION NETWORK

BACKGROUND

The present invention relates to detecting and protecting computers from threats that can be spread over a computer network and more specifically to the use of remote expert systems in threat protection.

Networks such as the Internet can enable rapid communication of information between computers. Unfortunately, the capability of computers to communicate is often used to victimize computer systems and/or their users. A variety of known threats exist that are spread using networks. One example of a threat is a computer virus. Computer viruses are programs that typically seek to reproduce themselves and can also modify and/or damage the lost computer system. Another threat to a computer user is Phishing. Phishing schemes (also known as carding and spoofing) typically seek to fraudulently acquire sensitive information, such as passwords and/or credit card details, by masquerading as a trustworthy person or business in an apparently official electronic communication, such as an email, a web page or an instant message. Another type of threat is Spam. Spamming is the sending of unsolicited email messages in bulk. Spam usually does not represent a significant risk to a computer, however, large volumes of Spam can congest networks, result in increased email server costs and reduce the efficiency of computer operators. Spyware is another type of threat. Spyware is a broad category of malicious software intended to intercept or take partial control of a computer's operation without the user's informed consent. While the term taken literally suggests software that surreptitiously monitors the user, it has come to refer more broadly to software that subverts the computer's operation for the benefit of a third party. Examples of Spyware include software designed to deliver unsolicited pop-up advertisements (often referred to as "adware"), software that steals personal information (often referred to as "stealware"). Spyware as a class of threat is very broad and is difficult to characterize. Although not always the case, Spyware typically does not seek to reproduce and in this regard are often distinct from viruses. Another type of threat is hijacking. There are generally considered to be two classes of hijacking. Client hijacking is a term used to describe a threat involving a piece of software installed on a user's computer to hijack a particular application such as a search. Examples of client hijacking include redirecting a user from a know website to another website or appending affiliate information to a web search to generate revenue for the hijacker. A second class of hijacking is referred to as server hijacking. Server hijacking involves software that hijacks a server and usually involves hijacking a web site. The server hijacking may involve a simple redirection or could be the redirection of results generated by a search engine. Yet another type of threat is automated hacking. Automated hacking typically involves a computer program that is installed on the computer. Once the program is installed the program will attempt to steal confidential information such as credit card numbers and passwords. Computers can run software that is designed to detect threats and prevent them from causing harm to a computer or its operator. Often, threat signatures are used to identify threats. A threat signature is a characteristic of a threat that is unique and, therefore, distinguishes the threat from other potentially benign files or computer programs. A limitation of systems that use threat signatures to detect threats is that these systems do not, typically, possess a threat signature for a previously unknown threat. The lack of a threat signature can be overcome by attempting to identify a new threat as soon as it manifests itself. Once the threat is identified, a threat signature can be generated for the threat and the new threat signature distributed to all of the computers in the threat detection system, hi the case of mass spreading threats (i.e. threats designed to spread to a large number of computers very rapidly), the number of computers that fall prey to the threat is typically dependent upon the time between the threat first manifesting itself and the distribution of a threat signature.

SUMMARY OF THE INVENTION

Embodiments of the threat protection networks are described, hi many embodiments, clients generate threat signatures and compare them threat definition data. In the event that a potential threat is unknown, a client can refer the potential threat to a server. In several embodiments, the server compares the potential threat signature against its own copy of the threat definition data. When the server has no information concerning the nature of the potential threat, then the server can refer the potential threat to an expert system that is configured to determine the nature of the threat by exposing at least one test computer to the threat, hi several embodiments, updated threat definition data can be distributed using a secure peer-to-peer network.

One embodiment of the invention includes at least one client computer connected to a network, a server that stores threat definition data and is connected to the network, an expert system in communication with the server. In addition, the client computer is configured to refer potential threats to the server, the server is configured to refer to the expert system any potential threat forwarded by a client computer that is not identified in the threat definition data and the expert system is configured to determine whether the potential threat is an actual threat by exposing at least one test computer to the potential threat and observing the behavior of the test computer.

In a further embodiment, the client is configured to generate a signature for each potential threat.

In another embodiment, the signature includes two or more check sums generated using a file associated with the potential threat. In a still further embodiment, the server is configured to update the threat definition data based upon determinations made by the expert system. hi still another embodiment, the server is configured to notify clients that updated threat definition data is available.

In a yet further embodiment, the server and client computers form a secure peer-to- peer network and the updated threat definition data is distributed to client computers via the secure peer-to-peer network. In yet another embodiment, the expert system includes multiple test computers. hi a further embodiment again, at least two of the test computers use different operating systems. hi another embodiment again, at least two of the test computers use different versions of the same operating system. hi a still further embodiment again, the expert system is configured to assign a score to a potential threat based upon predetermined criteria. hi still another embodiment again, the predetermined criteria are chosen such that an actual threat is likely to obtain a score above a first threshold.

In a yet further embodiment again, the determination of whether a potential threat is an actual threat by the expert system is automatic.

In yet another embodiment again, the expert system is configured to refer potential threats to an operator in circumstances where the expert system is incapable of conclusively determining the nature of the potential threat.

In a further additional embodiment, the expert system is configured to isolate itself prior to exposing the test computer to the potential threat.

Another additional embodiment, includes client software installed upon the computer.

In addition, the client software is configured to monitor for predetermined behavior, the client software is configured to identify a source associated with the behavior, the client software is configured to generate a signature identifying the source and the signature includes at least two independent pieces of information generated using the source.

In a still further additional embodiment, the identified source is a file that includes a header and the signature includes a checksum generated using at least one bit from the file header.

In still another additional embodiment, the identified source is a file that includes a header and a body and the signature includes a checksum generated using at least one bit from a location within the file body.

In a yet further additional embodiment, the client software is configured to compare the signature to threat definition data and the client software is configured to obtain updated threat definition data via a secure peer-to-peer network. Yet another additional embodiment also includes threat definition data stored on the computer. In addition, the client software is configured to provide the threat definition data to peer computers upon request. hi a further additional embodiment again, threat definition data stored on the server, a list stored on the server and verification information stored on the server, hi addition, the list identifies a number of peer computers on which the threat definition data is also stored and the verification information can be generated by applying a predetermined algorithm to the threat definition data.

In another additional embodiment again, the server is configured to provide the list to a requesting computer upon request and the server is configured to add the identity of the requesting computer to the list. hi a still further additional embodiment again, the server is configured to remove a peer computer from the list as part of the addition of the requesting computer to the list. hi still another additional embodiment again, the server is configured to provide the verification information to requesting computer. hi a yet further additional embodiment again the server is configured to provide the threat definition data to a requesting computer. hi yet another additional embodiment again the server is configured to generate the verification data by applying the predetermined algorithm to the threat definition data.

A further additional embodiment includes an expert system installed on a host computer and at least one test computer connected to the host computer. In addition, the expert system is configured to expose the test computer to the potential threat, the expert system is configured to observe the behavior of the test computer and the expert system determines a score based upon the observed behavior and a set of predetermined criteria. hi a still further additional embodiment, the expert system determines whether the potential threat is an actual threat based upon the score.

, hi a yet further additional embodiment, the expert system is configured to determine that a score above a first threshold constitutes a threat and a score below a second threshold constitutes no threat. hi a further additional embodiment again, the first threshold and second threshold have the same value. hi a still further additional embodiment again, the expert system is configured to refer potential threats to an operator that are assigned a score below the first threshold and above the second threshold. hi a yet further additional embodiment again, at least two of the test computers use different operating systems. hi a still yet further embodiment, at least two of the test computers use different versions of the same operating system. In still yet another embodiment, the test computer is configured to operate in a simulated Internet environment during any exposure to a potential threat. An embodiment of the method of the invention includes monitoring the operation of the computer for predetermined types of behavior, identifying the source of the predetermined behavior, determining whether the source is a potential threat, exposing a remote computer system to the potential threat, determining the nature of the potential threat using an expert system and responding to the potential threat based on its nature. In a further embodiment of the method of the invention, the predetermined types of behavior include at least one of duplication of an executable file, creation of multiple threads, creation of files in system or shared directories, addition of auto-run entries to the operating system, attempting to automatically send e-mails to others that include attachments, connecting to a specific web site, opening a server port, blocking or disabling part of the system features or tasks and blocking firewall software.

In another embodiment of the method of the invention, determining whether the source is a potential threat includes generating a threat signature for the source of the predetermined behavior, comparing the threat signature to a white list to determine whether the threat signature is known to be safe, when the threat signature is not known to be safe, comparing the threat signature to a black list to determine whether the threat signature is known to be an actual threat and when the threat signature is not known to be safe or an actual threat, determining that the source of the predetermined behavior is a potential threat.

In a still further embodiment of the method of the invention, generating a threat signature includes generating at least two pieces of information concerning the source of the predetermined behavior using a predetermined algorithm.

In still another embodiment of the method of the invention generating a threat signature includes generating at least two check sums based on the source of the predetermined behavior.

In a yet further embodiment of the method of the invention, determining whether the source is a potential threat further includes sending the threat signature to a remote server, comparing the threat signature to an updated white list stored on the remote server to determine whether the threat signature is known to be safe, when the threat signature is not known to be safe, comparing the threat signature to an updated black list stored on the remote server to determine whether the threat signature is known to be an actual threat and when the threat signature is not known to be safe or an actual threat, determining that the source of the predetermined behavior is a potential threat.

In a further embodiment again of the method of the invention, at least two remote computers are exposed to the potential threat.

In another embodiment again of the method of the invention, at least two of the computers use different operating systems. In a still further embodiment again of the method of the invention, at least two of the computers use different versions of the same operating system. In still another embodiment again of the method of the invention, determining the nature of the potential threat using an expert system includes observing the behavior of the remote computers exposed to the threat and assigning a score to the predetermined threat based upon the observed behavior and a set of predetermined criteria.

In a yet further embodiment again of the method of the invention, determining the nature of the potential threat using an expert system further includes when the score exceeds a first threshold, determining that the potential threat is an actual threat and when the score is below a second threshold, determining that the potential threat is safe.

In yet another embodiment again of the method of the invention, determining the nature of the potential threat using an expert system further comprises referring potential threats to an operator when the score is between the first and second thresholds.

A further additional embodiment of the method of the invention also includes distributing information concerning the potential threat to a number of computers.

In another additional embodiment of the method of the invention, distributing information concerning the potential threat to a number of computers includes distributing the information using a secure peer-to-peer network.

In a still further additional embodiment of the method of the invention, distributing information concerning a potential threat using a secure peer-to-peer network includes including the information in an update, receiving update requests from other peer computers, recording information concerning the identity of peer computers that have requested an update, providing the update to at least one peer computer and providing the peer computers with information identifying peer computers that have already downloaded the update.

In still another additional embodiment of the method of the invention, distributing information concerning a potential threat using a secure peer-to-peer network also includes receiving requests from at least one peer computer that have obtained the update for verification of the reliability of the update and providing information to the peer computer verifying the reliability of the update.

A yet further additional embodiment of the method of the invention also includes generating a simulated Internet environment. In addition, the remote computer exposed to the potential threat operates within the simulated Internet environment.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic view of a threat protection network in accordance with an embodiment of the invention;

FIG. 2 is a flow chart showing a process for identifying threats and distributing threat signatures in accordance with an embodiment of the invention; FIG. 3 is a flow chart showing a process for determining whether a signature is associated with a program that is safe, a potential threat or an actual threat in accordance with an embodiment of the invention;

FIG. 4 is a flow chart showing a process that can be used by a client to communicate with a server to obtain information concerning a potential threat in accordance with the present invention;

FIG. 5 is a flow chart showing the operation of a server in response to a request for additional information by a client in accordance with an embodiment of the invention;

FIG. 6 is a flow chart showing the operation of a threat identification system in response to receiving a copy of a potential threat in accordance with an embodiment of the invention;

FIG. 7 is a flow chart showing the operation of a fully automated threat identification system in accordance with an embodiment of the invention;

FIG. 8 is a flow chart showing a process for updating threat definition data via a secure peer-to-peer network in accordance with an embodiment of the invention; and

FIG. 9 is a flow chart showing another process for updating threat definition data via a secure peer-to-peer network in accordance with an embodiment of the invention.

DETAILED DESCRIPTION OF THE INVENTION

Turning now to the drawings, embodiments of threat protection networks in accordance with the present invention are illustrated that include a number of computers and servers connected by a network. The computers run client software that is capable of protecting against at least some known threats and identifying other potential threats. In several embodiments, the type of threat detected is a virus. In many embodiments, the types of threats detected can include Phishing threats, Spam, Spyware, Hijacking threats, Automated Hacking threats or any other type of threat that is distributed via a computer network. In many embodiments, the client contacts a server and the server is able to direct the client to information concerning whether the potential threat is actually a threat. In several embodiments, the client refers the potential threat to a threat identification system. The threat identification system can deteπnine whether the potential threat is an actual threat by exposing at least one computer to the threat and observing its behavior. The conclusion of the threat protection system can then be provided to a server, which distributes the information to all of the computers in the threat protection network. In many embodiments, the information is distributed using a secure peer-to-peer network such as the secure peer-to- peer networks described in the U.S. Patent Application entitled "SYSTEM FOR DISTRIBUTING INFORMATION USING A SECURE PEER-TO-PEER NETWORK" filed on September 22, 2005. A threat protection network in accordance with an embodiment of the invention is shown in FIG. 1. The threat protection network 10 includes a number of computers 12 connected via a network 14, an alert server 16 and a threat identification system. In the illustrated embodiment, the threat identification system includes a threat identification server 18 that is connected to a number of isolated computers 20. Each of the isolated computers 20 can operate using a different operating system and the isolated computers, typically, can be isolated (i.e. prevented from sending information) to the broader network. Client software is installed on each of the computers 12 and, during operation, the computers execute the client software as a background process. In many embodiments, the client software includes plug-ins for web browsers and email programs that monitor emails received by or websites viewed by a computer. As will be discussed further, the client software is designed to operate in conjunction with the other aspects of the threat protection network to protect each of the computers from one or more classes of threat, hi many embodiments, the client software is capable of dealing with a number of known threats. "When the client software encounters an unknown potential threat, the client can contact the alert server 16 for information concerning the potential threat. In the event that no information is known about the potential threat, then the client can refer the potential threat to the alert server 16.

The alert server 16 can possess information concerning the nature of a potential threat and provide the information concerning the nature of the threat directly to the computer 12 that referred the potential threat to the alert server, hi the event the alert server 16 does not possess such information, the alert server 16 provides potential threats to the threat identification system, which exposes the isolated computers 20 to the potential threat and observes their behavior, hi many embodiments, the isolated computers 20 operate within a simulated Internet environment, hi this simulated environment, the computers behave as if they have full connectivity with the Internet and yet are incapable of communicating with other computers. Based upon the behavior of the isolated computers 20, the threat identification system can determine whether the potential threat is an actual threat, hi many embodiments, this determination is made automatically using an expert system located on the threat identification server 18. Once a determination has been made, the alert server 16 can generate an update for distribution to the computers 12.

As discussed above, the computers and servers of a threat protection network in accordance with the present invention communicate via a network, hi many embodiments, the network includes wired and/or wireless connections. In several embodiments, the network is a network of networks such as the Internet, hi addition, many embodiments include open networks, however, other embodiments implement threat protection networks within a closed network. In many embodiments, the alert server 16 and the computers 12 form a secure peer-to- peer network that facilitates dissemination of the update. A computer 12 can contact the alert server 16 to obtain information concerning peer computers that possess a desired update. The computer 12 can then contact the peers to obtain the update, the reliability of which can be verified with the alert server 16. hi the event that the information is not available from a peer computer, the alert server 16 can provide the information directly to the computer 12. In several embodiments, some of the functions described above in relation to the alert server are performed by one or more update servers.

The manner in which various aspects of threat protection networks in accordance with the present invention can operate is depicted in FIGS. 2 - 9. Referring first to FIG. 2, a flow chart showing the basic operation of a threat protection network in accordance with the invention, when confronted with a previously unknown threat, is illustrated. The process 30 includes identifying (32) a potential threat, determining (34) if the reported potential threat is an actual threat and distributing (36) updated information concerning the potential threat to all of the computers in the threat protection network.

A process for identifying a potential threat in accordance with an embodiment of the present invention is shown in FIG. 3. Typically, the process is invoked in circumstances where a suspicious event occurs. The characteristics of a suspicious event are discussed further below, but are typically activities that could be the precursor to harm such as the execution of a new program, the modification of the computer's operating system or configuration, receiving an email requesting personal financial information, viewing a particular website or being redirected to a website. The process (50) commences with the detection (52) of a suspicious event and includes determining (54) the source of the suspicious event. The source may be an executable file, the sender of an email, the host of a website or any other entity satisfying a set of predetermined criteria. Once the source of the suspicious event has been identified, a signature for the source is generated (56). A signature is one or more pieces of information that attempt to uniquely identify the source. The generation of a signature is discussed further below.

IQ order to ascertain whether the source is a threat, the signature is compared (58) to a white list that contains the signatures of sources that have been determined safe (60). When the signature is not present on the white list, the signature can be compared (62) to a black list. The black list contains the signatures of sources of suspicious events that have previously been identified as threats (64). When the source's signature is neither present on the black list or the white list, the process designates (66) the source to be a potential threat. hi the event that a source is determined (60) safe, the client can resume operation, hi the event that a source is determined (64) to be a threat, the client can respond in a number of ways including notifying the user of the existence of the threat (e.g. a pop-up notification that an email is part of a Phishing scheme), deleting files or emails (e.g. deleting a virus program or Spam email) and any other actions that may be necessary to minimize the potential impact of any particular threat. In some instances, a single client may be harmed prior to detection of a threat (e.g. the suspicious event was the act of personal information being stolen) and the client's major recourse is to notify the user of the harm. However, the detection of the harm can be communicated to other clients enabling them to protect against similar exposure and harm.

The process illustrated in FIG. 3 involves the detection (52) of a suspicious event. As mentioned previously, a suspicious event is typically an activity that could be the precursor to harm. Examples of suspicious events include the execution of a new program or a change in the settings of the operating system, such as an attempt to add a new program to the start up folder of a computer running the Windows® operating system manufactured by Microsoft Corporation of Redmond, WA. Other types of suspicious events can be the receipt of e-mail requesting financial information, a program executing the background collecting information about a user, receipt of e-mail from an unknown e-mail address, visiting a particular website and/or viewing a website that attempts to modify the web browser being used to view the site. Although several examples of events that can be deemed suspicious are discussed herein, many other types of activities associated with threats can also be deemed suspicious in accordance with an embodiment of the present invention. The set of suspicious events can include any type of activity that is characteristic of any type of threat. Many embodiments of the present invention define a set of activities that are deemed suspicious and the set can be modified as new threats are identified, hi many embodiments, the set is chosen to balance the need for protection against a requirement that minimal system resources be devoted to the detection of suspicious activities.

As discussed above, the determination of whether a source is safe, a threat or a potential threat in accordance with an embodiment of the present invention can involve generating a signature. A signature can be generated by determining a check sum based upon the bits of a file, hi one embodiment, a single check sum is used based upon an entire file. In other embodiments, the signature is generated by determining more than one check sum. hi many embodiments, check sums are determined using the bits of different regions of the file. In one embodiment, the signature includes a check sum generated using the bits of a program file's header. In another embodiment, the signature includes a check sum generated using bits from a randomly determined location within a file. Use of a signature that includes multiple check sums can decrease the likelihood that a threat file can be modified to avoid identification.

In several embodiments, the receipt of an email or the viewing of a website can be the source of the suspicious event, hi many embodiments, the source of an email or website can be compared against white lists and black lists to determine whether the email or website constitutes a threat, hi these embodiments, the signature of the source can be based upon the origin of the email or the location of the website. In one embodiment, the signature of the source of an email includes at least one of the mailer name or sender information associated with an email and the signature for the source of a website includes at least one of the IP address, domain name or specific URL path associated with a website. In several embodiments, the signature can also includes information derived using the bits of information that are used to represent the email or website.

The process illustrated in FIG. 3 demonstrates the use of signatures to determine the nature of a potential threat, hi many embodiments, a client in accordance with an embodiment of the present invention can also determine the nature of a potential threat based upon the nature of the source and/or the initial suspicious activity. For example, a program that includes the double extension ".zip.exe" can automatically be determined to be a threat irrespective of whether a signature for the program is listed on the black list, hi many embodiments, sources that do not pose a threat can obtain certification, which can be used to identify that the source does not pose a threat even if the source is not included on a white list.

When a program is determined to be a potential threat, then a client in accordance with an embodiment of the present invention can contact a server to obtain more information concerning the potential threat. A flow chart showing a process by which a client can obtain information concerning the nature of a potential threat in accordance with an embodiment of the present invention is illustrated in FIG. 4. The process 80 commences with the determination (82) of a potential threat. The signature of the potential threat is sent (84) to an alert server in order to obtain additional information about the threat. The alert server responds by sending a return code that is received (86) by the client. In one embodiment, the return code contains information concerning the latest update of threat definition data that has been distributed, information concerning whether the queried signature is associated with a known threat and a field indicating whether the potential threat should be referred to a threat identification system. In other embodiments, the server can provide other types of information relating to the potential threat.

If the client determines (88) that its threat definition data (i.e. the client's white list, black list and any other information used by the client in the identification of potential threats) is not up to date, then the client can commence obtaining the updated threat definition data. In addition, the client can inspect (90) the return code for information concerning whether the potential threat is an actual threat, hi circumstances where the potential threat is a known threat, then the client can handle (92) the threat and obtain the updated threat definition data. When the potential threat is known to be safe, then the client removes (94) the block on the potential threat and obtains updated threat definition data.

When the client determines (88) that it has the most up to date threat definition data and/or the return code does not include information concerning the threat, then the client can inspect the return code to ascertain (96) whether the potential threat has previously been reported by another client. If the potential threat has been reported, then the client can wait for updated threat definition data to be made available by the alert server. If another client has not previously reported the potential threat, then the client can provide (98) a copy of the potential threat to the threat identification system. In many embodiments, the copy of the potential threat is provided to the alert server, which then forwards the copy to the threat identification system. A process that can be used by a server to respond to a request for information concerning a potential threat made by a client in accordance with an embodiment of the invention is shown in FIG. 5. The process 110 commences with the receipt (112) of a threat signature of a potential threat from a client. The server compares (114) the threat signature to the threat definition data. If the threat signature is listed in the threat definition data (the threat signature may be indicated as safe or as a threat), then the server sends (116) a return code that indicates the nature of the potential threat. In one embodiment, the return code includes information indicating the latest version of the threat definition data, whether the potential threat is safe or an actual threat and information indicating that a copy of the potential threat is required by the server. In many embodiments, enabling clients to obtain information concerning a potential threat at the time the information is required by the client can increase the likelihood that the threat protection network will minimize harm to the computer. Several embodiments also configure clients to regularly seek updated threat definition data, which can reduce the number of potential threats referred to the alert server by clients. When the threat signature is not listed in the threat definition data, then a determination (118) is made as to whether another client has contacted the server in relation to a potential threat possessing the same threat signature. If another client has previously reported the threat signature, then a return code indicating that the potential threat has previously been reported and that its nature is not yet known can be sent (120). In one embodiment, the return code includes information identifying the latest version of the threat definition data, an indication that the nature of the potential threat is unknown and information informing the client that a copy of the potential threat is not required.

In the event that the server has not received any previous reports relating to the threat signature, the server can send (122) a return code that includes a request for a copy of the potential threat. In one embodiment the return code includes information indicating the latest version of the threat definition data, an indication that the nature of the potential threat is unknown and a request that a copy of the potential threat be forwarded to the server.

When a copy of the potential threat is received (124) by the server, the server forwards the copy to the threat identification system. The threat identification system generates a report concerning the potential threat, which is received (126) by the server, and the report is used by the server to create a new version of the threat definition data, hi one embodiment, the new version of the threat definition data is created by taking the previous version and adding the threat signature to either the white list or black list depending upon the outcome of the report provided by the threat identification system. The server can then make (128) the new version of the threat definition data available for download. In many embodiments, the threat definition data is encrypted by the alert server and the verification information for the threat definition data enables the decryption of the threat definition data. A process that can be used by a threat identification system to analyze a potential threat in accordance with an embodiment of the invention is shown in FIG. 6. The process 130 includes receiving (132) a copy of the potential threat. Once the copy of the threat is received, the threat identification system is isolated (134) from the network. In several embodiments, isolation is achieved by preventing the threat identification system from sending messages using the network, hi one embodiment, the threat identification system is prevented from sending email by implementing a socket layer filter. In other embodiments, isolation is complete and involves the threat identification system neither sending nor receiving messages via the network.

Once the threat identification system has been isolated from the network, at least one computer can be exposed (136) to the potential threat. In many embodiments, multiple computers are exposed and in several embodiments a number of the computers are configured differently. For example, some embodiments include a number of computers running different operating systems and/or a number of computers running different versions of the same operating system. Although the computers are isolated from the network, many embodiments of threat identification systems in accordance with the present invention generate a simulated Internet environment that enables computers exposed to a threat to behave as they would if they were connected to an actual network. In addition, threats that involve the execution of software can be run in one or both of normal execution mode or debugging mode. Once the computer(s) have been exposed to the potential threat, the behavior of the computers is observed. In the event that the computer is modified by exposure to the threat, the computer can be restored to an unmodified state upon the completion of observations, hi one embodiment, a virtual twin of each computer is created prior to exposure that can be restored automatically by the threat identification system using software such as Shadow User Pro 2.0 manufactured by StorageCraft Technology Corp. - ShadowStor of Draper, Utah, hi many instances, activity of the computer(s) may not be capable of observation. When observation is not possible, the potential threat can be referred (140) to an operator. The operator can observe the nature of the potential threat using a debugging mode that enables the sequential observation of activities performed by a computer system exposed to the potential threat. When the operation of the computer system can be observed, the threat identification system can use the observations to generate (142) a threat score. In one embodiment, the threat score is generated using an expert system that allocates score points in response to activities that are characteristic of sources constituting actual threats. The use of an expert system in identifying files constituting actual threats is discussed further below. Using the threat score, a determination (144) can be made as to whether the potential threat is an actual threat. If the potential threat is an actual threat, then the network connection can be enabled and a report sent (146) to the alert server indicating that the potential threat is an actual threat. The threat score can also enable a determination (148) of whether a potential threat is in fact safe, in which case a connection with the network can be established and a report sent (150) to the alert server indicating that the potential threat is safe. In some instances, the threat score may be ambiguous as to the nature of the potential threat. When the threat score does not indicate definitively the nature of the actual threat, then the potential threat can be referred (140) to an operator for review.

As discussed above, many embodiments of the present invention use expert systems to determine the nature of potential threats. In one embodiment, the expert system is located on the threat identification server 18. The expert system observes the operation of the various computers that have been exposed to the potential threat and awards scores based upon activities performed by the computers that are characteristic of exposure to an actual threat. Such activities can include duplication of the potential threat, creation of multiple threads, creation of files in system folders or shared folders, addition of auto-run entries into the computer's operating system, attempting to send e-mails to others that include the potential threat, connection to a specific web site, opening a server port, the fact the potential threat arrived as an email attachment, blocking or disabling part of the system features or specific tasks such as the "RegEdit.exe" or "TaskManager.exe", which are part of the Windows® XP operating system, blocking of firewall software, the nature of an email address, the nature of a domain name, requests and/or covert collection of information. In many embodiments, a set of factors are chosen and an embodiment of an expert system in accordance with the present system is developed by training the expert system using known threats. The training of the expert system can result in the allocation of scores to each of the factors that enable the determination of whether a previously unknown potential threat is an actual threat. In several embodiments, multiple expert systems are used that are each trained to identify a specific type of threat (e.g. virus, Phishing, Spam, Shareware, Hijacking, Automated Hacking or any other type of threat).

In many embodiments, a determination that a previously unknown potential threat is an actual threat is indicated by a threat score exceeding a predetermined threshold. In addition, a determination that the potential threat is safe is indicated by a threat score below a second threshold. In instances where the first and second threshold are not the same (an example where the thresholds are the same is discussed below), the possibility exists for a potential threat to obtain a threat score that is between the two thresholds. In this instance, the expert system cannot draw a definitive conclusion. Therefore, the expert system can refer the potential threat to an operator. The operator can analyze the potential threat and issue a report to the alert server. In instances where the potential threat is an actual threat, the operator can also identify new factors that should be considered by the expert system in response to what may constitute a new type of threat. As indicated above, an expert system may use a single threshold for determining whether a potential threat is an actual threat. Such systems can be fully automated, removing the need for an operator. A process that can be performed by an expert system that classifies potential threats automatically using a threat score generated by the expert system in accordance with an embodiment of the invention is shown in FIG. 7. The process 130' is similar to the process 130 shown in FIG. 6 with the exception that the potential threats that are referred to an operator in the process 130 are designated as threats in the process 130'.

Once a threat identification system has determined the nature of a potential threat and an alert server has generated updated threat definition data, clients can obtain the updated threat definition data. As discussed above, several embodiments of threat protection networks 10 in accordance with the present invention use secure peer-to-peer networks to distribute updated threat definition data to clients. Examples of secure peer-to-peer networks are described in the U.S. Patent Application entitled "SYSTEM FOR DISTRIBUTING INFORMATION USING A SECURE PEER-TO-PEER NETWORK".

A process by which a computer 12 can obtain updated threat definition data via a secure peer-to-peer network in accordance with an embodiment of the present invention is shown in FIG. 8. The process 160 commences when updated threat definition data is generated (162). At intermittent time intervals, computers contact the alert server inquiring (164) as to the existence of an update, hi many embodiments, clients contact the alert server every four hours. In other embodiments, clients contact the alert server at other time intervals. The server notifies (166) the computer that an update is available and in several embodiments provides the computers with information indicating peer computers that have already obtained the updated threat definition data. The computer that contacted the server seeking the updated threat definition data can contact peer computers and request (168) that the peer computers provide the update. The actions of the computer seeking the update are then determined (170) based upon whether any of the peers contacted by that computer possess the updated threat definition data. In the event that a peer computer includes the updated threat definition data, then the remote peer can provide (172) the update to the requesting computer. The requesting computer can then contact the server to verify the reliability of the update (174). In one embodiment the verification process involves obtaining one or more check sums from the server that can be compared with the updated threat definition data. In the event that none of the remote peers contacted by the computer possess updated threat definition data, then the computer can request (174) the data directly from the alert server.

Another embodiment of a process for obtaining updated threat definition data via a secure peer-to-peer network is shown in FIG. 9. The process 200 includes a peer requesting (202) a peer table from a server. The peer then sets a timer (204) and waits (206) for the server to provide a peer table. In the event that the server does not provide a peer table, then the peer can obtain (208) the update directly from the server.

When the server possesses a peer table, it can be downloaded (210) by the peer. In one embodiment, the peer table is limited to a small number of peers (e.g. 20) and the peer table does not include peers that are located behind a firewall. Once a peer has obtained a peer table from the server, the peer is added to the peer table and one peer is dropped from the peer table, hi one embodiment, a FIFO process is used to select the peer that is dropped from the peer table and peers that are behind firewalls are not added to the peer table. In other embodiments, any variety of criteria can be used to select the peers that remain within the peer table including the bandwidth of the peer's connection to the network.

The downloaded peer table is used by the peer to request (212) updated threat definition data from each peer on the peer table. Once a request has been sent, the peer's actions are determined (214) based upon whether a peer is able to provide the update. Following the request, the peer sets (216) a timer and waits for a response from any of the remote peers. In the absence of a response, the peer obtains (214) the update directly from the server. When a remote peer can provide the updated definition data, then it is downloaded by the requesting peer and verified using information provided by the server.

While the above description contains many specific embodiments of the invention, these should not be construed as limitations on the scope of the invention, but rather as an example of one embodiment thereof. For example, the functions of the alert server can be performed by one or more servers. In addition, the threat protection network can include numerous mirrored servers. Furthermore, the threat protection network can include more than one expert system to analyze multiple threats simultaneously, hi many embodiments, different expert systems can handle different types of threats. In one embodiment, separate expert systems exist for determining the nature of virus type potential threats, Phishing type potential threats, Spam type potential threats, Spyware type potential threats, hijacking type potential threats and automated hacking type potential threats, hi other embodiments, expert systems are capable of determining the nature of multiple different types of potential threats. Furthermore, expert systems in accordance with the present invention can be deployed without any initial threat definition data and can be deployed in closed networks running proprietary software. An expert system trained in accordance with the present invention can rapidly build appropriate threat definition data in almost any type of networked environment. Accordingly, the scope of the invention should be determined not by the embodiments illustrated, but by the appended claims and their equivalents.

Claims

WHAT IS CLAIMED IS:
L A threat protection network for detecting potential threats, comprising: at least one client computer connected to a network; a server that stores threat definition data and is connected to the network; an expert system in communication with the server; wherein the client computer is configured to refer potential threats to the server; wherein the server is configured to refer to the expert system any potential threat forwarded by a client computer that is not identified in the threat definition data; wherein the expert system is configured to determine whether the potential threat is an actual threat by exposing at least one test computer to the potential threat and observing the behavior of the test computer.
2. The threat protection network of claim 1, wherein the client is configured to generate a signature for each potential threat.
3. The threat protection network of claim 2, wherein the signature includes two or more check sums generated using a file associated with the potential threat.
4. The threat protection network of claim 1, wherein the server is configured to update the threat definition data based upon determinations made by the~expert system.
5. The threat protection network of claim 4, wherein the server is configured to notify clients that updated threat definition data is available.
6. The threat protection network of claim 4, wherein: the server and client computers form a secure peer-to-peer network; and the updated threat definition data is distributed to client computers via the secure peer-to-peer network.
7. The threat protection network of claim 1, wherein the expert system includes multiple test computers.
8. The threat protection network of claim 7, wherein at least two of the test computers use different operating systems.
9. The threat protection network of claim 8, wherein at least two of the test computers use different versions of the same operating system.
10. The threat protection network of claim 1, wherein the expert system is configured to assign a score to a potential threat based upon predetermined criteria.
11. The threat protection network of claim 1, wherein the predetermined criteria are chosen such that an actual threat is likely to obtain a score above a first threshold.
12. The threat protection network of claim 1, wherein the determination of whether a potential threat is an actual threat by the expert system is automatic.
13. The threat protection network of claim 1, wherein the expert system is configured to refer potential threats to an operator in circumstances where the expert system is incapable of conclusively determining the nature of the potential threat.
14. The threat protection network of claim 1, wherein the expert system is configured to isolate itself prior to exposing the test computer to the potential threat.
15. A computer, comprising: client software installed upon the computer; wherein the client software is configured to monitor for predetermined behavior; wherein the client software is configured to identify a source associated with the behavior; wherein the client software is configured to generate a signature identifying the source; and wherein the signature includes at least two independent pieces of information generated using the source.
16. The computer of claim 15, wherein: the identified source is a file that includes a header; and the signature includes a checksum generated using at least one bit from the file header.
17. The computer of claim 15 , wherein: the identified source is a file that includes a header and a body; and the signature includes a checksum generated using at least one bit from a location within the file body.
18. The computer of claim 15 , wherein: the client software is configured to compare the signature to threat definition data; and the client software is configured to obtain updated threat definition data via a secure peer-to-peer network.
19. The computer of claim 15, further comprising: threat definition data stored on the computer; wherein the client software is configured to provide the threat definition data to peer computers upon request.
20. A server, comprising: threat definition data stored on the server; a list stored on the server; and verification information stored on the server; wherein the list identifies a number of peer computers on which the threat definition data is also stored; and wherein the verification information can be generated by applying a predetermined algorithm to the threat definition data.
21. The server of claim 20, wherein: the server is configured to provide the list to a requesting computer upon request; and the server is configured to add the identity of the requesting computer to the list.
22. The server of claim 21, wherein the server is configured to remove a peer computer from the list as part of the addition of the requesting computer to the list.
23. The server of claim 22, wherein the server is configured to provide the verification information to requesting computer.
24. The server of claim 20, wherein the server is configured to provide the threat definition data to a requesting computer.
25. The server of claim 20, wherein the server is configured to generate the verification data by applying the predetermined algorithm to the threat definition data.
26. A threat identification system configured to evaluate potential threats to a remote computer system, comprising: an expert system installed on a host computer; at least one test computer connected to the host computer; wherein the expert system is configured to expose the test computer to the potential threat; wherein the expert system is configured to observe the behavior of the test computer; wherein the expert system determines a score based upon the observed behavior and a set of predetermined criteria.
27. The threat identification system of claim 26, wherein the expert system determines whether the potential threat is an actual threat based upon the score.
28. The threat identification system of claim 26, wherein the expert system is configured to determine that: a score above a first threshold constitutes a threat; and a score below a second threshold constitutes no threat.
29. The threat identification system of claim 28, wherein the first threshold and second threshold have the same value.
30. The threat identification system of claim 28, wherein the expert system is configured to refer potential threats to an operator that are assigned a score below the first threshold and above the second threshold.
31. The threat identification system of claim 26, wherein at least two of the test computers use different operating systems.
32. The threat identification system of claim 26, wherein at least two of the test computers use different versions of the same operating system.
33. The threat identification system of claim 26, wherein the test computer is configured to operate in a simulated Internet environment during any exposure to a potential threat.
34. A method of protecting a computer against threats, comprising: monitoring the operation of the computer for predetermined types of behavior; identifying the source of the predetermined behavior; determining whether the source is a potential threat; exposing a remote computer system to the potential threat; and determining the nature of the potential threat using an expert system; responding to the potential threat based on its nature.
35. The method of claim 34, wherein the predetermined types of behavior include at least one of: duplication of an executable file; creation of multiple threads; creation of files in system or shared directories; addition of auto-run entries to the operating system; attempting to automatically send e-mails to others that include attachments; connecting to a specific web site; opening a server port; blocking or disabling part of the system features or tasks; and blocking firewall software.
36. The method of claim 34, wherein determining whether the source is a potential threat comprises: generating a threat signature for the source of the predetermined behavior; comparing the threat signature to a white list to determine whether the threat signature is known to be safe; when the threat signature is not known to be safe, comparing the threat signature to a black list to determine whether the threat signature is known to be an actual threat; when the threat signature is not known to be safe or an actual threat, determining that the source of the predetermined behavior is a potential threat.
37. The method of claim 36, wherein generating a threat signature includes generating at least two pieces of information concerning the source of the predetermined behavior using a predetermined algorithm.
38. The method of claim 37, wherein generating a threat signature includes generating at least two check sums based on the source of the predetermined behavior.
39. The method of claim 36, wherein determining whether the source is a potential threat further comprises: sending the threat signature to a remote server; comparing the threat signature to an updated white list stored on the remote server to determine whether the threat signature is known to be safe; when the threat signature is not known to be safe, comparing the threat signature to an updated black list stored on the remote server to determine whether the threat signature is known to be an actual threat; and when the threat signature is not known to be safe or an actual threat, determining that the source of the predetermined behavior is a potential threat.
40. The method of claim 34, wherein at least two remote computers are exposed to the potential threat.
41. The method of claim 40, wherein at least two of the computers use different operating systems.
42. The method of claim 40, wherein at least two of the computers use different versions of the same operating system.
43. The method of claim 34, wherein determining the nature of the potential threat using an expert system comprises: observing the behavior of the remote computers exposed to the threat; and assigning a score to the predetermined threat based upon the observed behavior and a set of predetermined criteria.
44. The method of claim 43, wherein determining the nature of the potential threat using an expert system further comprises: when the score exceeds a first threshold, determining that the potential threat is an actual threat; and when the score is below a second threshold, determining that the potential threat is safe.
45. The method of claim 44, wherein determining the nature of the potential threat using an expert system further comprises referring potential threats to an operator when the score is between the first and second thresholds.
46. The method of claim 34, further comprising distributing information concerning the potential threat to a number of computers.
47. The method of claim 34, wherein distributing information concerning the potential threat to a number of computers comprises distributing the information using a secure peer-to-peer network.
48. The method of claim 47, wherein distributing information concerning a potential threat using a secure peer-to-peer network comprises: including the information in an update; receiving update requests from other peer computers; recording information concerning the identity of peer computers that have requested an update; providing the update to at least one peer computer; and providing the peer computers with information identifying peer computers that have already downloaded the update.
49. The method of claim 48, wherein distributing information concerning a potential threat using a secure peer-to-peer network further comprises: receiving requests from at least one peer computer that have obtained the update for verification of the reliability of the update; and providing information to the peer computer verifying the reliability of the update.
50. The method of claim 34, further comprising: generating a simulated Internet environment; wherein the remote computer exposed to the potential threat operates within the simulated Internet environment.
PCT/US2005/034205 2004-09-22 2005-09-22 Threat protection network WO2006039208A3 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US52237404 true 2004-09-22 2004-09-22
US60/522,374 2004-09-22

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
EP20050821356 EP1854019A4 (en) 2004-09-22 2005-09-22 Threat protection network

Publications (2)

Publication Number Publication Date
WO2006039208A2 true true WO2006039208A2 (en) 2006-04-13
WO2006039208A3 true WO2006039208A3 (en) 2007-08-02

Family

ID=36119438

Family Applications (2)

Application Number Title Priority Date Filing Date
PCT/US2005/034205 WO2006039208A3 (en) 2004-09-22 2005-09-22 Threat protection network
PCT/US2005/034069 WO2006036763A3 (en) 2004-09-22 2005-09-22 System for distributing information using a secure peer-to-peer network

Family Applications After (1)

Application Number Title Priority Date Filing Date
PCT/US2005/034069 WO2006036763A3 (en) 2004-09-22 2005-09-22 System for distributing information using a secure peer-to-peer network

Country Status (3)

Country Link
US (3) US7836506B2 (en)
EP (1) EP1854019A4 (en)
WO (2) WO2006039208A3 (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102982280A (en) * 2012-11-07 2013-03-20 北京奇虎科技有限公司 Methods and device of avoiding computer aided design (CAD) virus infection
US8484742B2 (en) 2007-01-19 2013-07-09 Microsoft Corporation Rendered image collection of potentially malicious web pages

Families Citing this family (57)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7739494B1 (en) 2003-04-25 2010-06-15 Symantec Corporation SSL validation and stripping using trustworthiness factors
US7571119B2 (en) * 2004-09-30 2009-08-04 Qurio Holdings, Inc. Method and system for supporting secure transactions in a peer-to-peer network
US20060095971A1 (en) * 2004-10-29 2006-05-04 Microsoft Corporation Efficient white listing of user-modifiable files
US8316446B1 (en) * 2005-04-22 2012-11-20 Blue Coat Systems, Inc. Methods and apparatus for blocking unwanted software downloads
US20070089174A1 (en) * 2005-10-14 2007-04-19 David M. Bader Content management system and method for DRM enforcement in a client-server system
US20070097986A1 (en) * 2005-11-02 2007-05-03 Abu-Amara Hosame H Peer-to-peer communication architecture and terminals
US8353029B2 (en) * 2005-11-10 2013-01-08 Microsoft Corporation On demand protection against web resources associated with undesirable activities
US7831915B2 (en) * 2005-11-10 2010-11-09 Microsoft Corporation Dynamically protecting against web resources associated with undesirable activities
US8301767B1 (en) * 2005-12-21 2012-10-30 Mcafee, Inc. System, method and computer program product for controlling network communications based on policy compliance
US8826411B2 (en) * 2006-03-15 2014-09-02 Blue Coat Systems, Inc. Client-side extensions for use in connection with HTTP proxy policy enforcement
US8332947B1 (en) * 2006-06-27 2012-12-11 Symantec Corporation Security threat reporting in light of local security tools
US8095967B2 (en) 2006-07-27 2012-01-10 White Sky, Inc. Secure web site authentication using web site characteristics, secure user credentials and private browser
WO2008050055A3 (en) * 2006-10-23 2008-07-17 France Telecom Method for managing access rights to a digital content in a peer network
US8756683B2 (en) * 2006-12-13 2014-06-17 Microsoft Corporation Distributed malicious software protection in file sharing environments
US7908660B2 (en) * 2007-02-06 2011-03-15 Microsoft Corporation Dynamic risk management
US8584240B1 (en) * 2007-10-03 2013-11-12 Trend Micro Incorporated Community scan for web threat protection
US8875259B2 (en) 2007-11-15 2014-10-28 Salesforce.Com, Inc. On-demand service security system and method for managing a risk of access as a condition of permitting access to the on-demand service
US8584212B1 (en) * 2007-11-15 2013-11-12 Salesforce.Com, Inc. On-demand service security system and method for managing a risk of access as a condition of permitting access to the on-demand service
US8171554B2 (en) * 2008-02-04 2012-05-01 Yuval Elovici System that provides early detection, alert, and response to electronic threats
US8560732B2 (en) * 2008-02-19 2013-10-15 Red Hat, Inc. Peer-to-peer object distribution
US9389839B2 (en) * 2008-06-26 2016-07-12 Microsoft Technology Licensing, Llc Safe code for signature updates in an intrusion prevention system
US20100058474A1 (en) * 2008-08-29 2010-03-04 Avg Technologies Cz, S.R.O. System and method for the detection of malware
US8484726B1 (en) * 2008-10-14 2013-07-09 Zscaler, Inc. Key security indicators
US8838683B2 (en) 2008-11-24 2014-09-16 Samsung Electronics Co., Ltd. Method and apparatus for receiving data by using peer-to-peer portal server
KR101647633B1 (en) 2008-11-24 2016-08-11 삼성전자주식회사 Method and apparatus for transmitting and receiving personal broadcasting data based on peer to peer communication
US8578484B2 (en) * 2008-12-31 2013-11-05 Sonicwall, Inc. Identification of content
US8578485B2 (en) 2008-12-31 2013-11-05 Sonicwall, Inc. Identification of content by metadata
US9275231B1 (en) * 2009-03-10 2016-03-01 Symantec Corporation Method and apparatus for securing a computer using an optimal configuration for security software based on user behavior
US20100250704A1 (en) * 2009-03-26 2010-09-30 Verizon Patent And Licensing Inc. Peer-to-peer content distribution with digital rights management
US7640589B1 (en) * 2009-06-19 2009-12-29 Kaspersky Lab, Zao Detection and minimization of false positives in anti-malware processing
US20100332593A1 (en) * 2009-06-29 2010-12-30 Igor Barash Systems and methods for operating an anti-malware network on a cloud computing platform
US8701192B1 (en) * 2009-06-30 2014-04-15 Symantec Corporation Behavior based signatures
CN101610226A (en) * 2009-07-17 2009-12-23 阿里巴巴集团控股有限公司 Method and system for downloading plug-in component
US8607340B2 (en) * 2009-07-21 2013-12-10 Sophos Limited Host intrusion prevention system using software and user behavior analysis
US8776218B2 (en) 2009-07-21 2014-07-08 Sophos Limited Behavioral-based host intrusion prevention system
US8443449B1 (en) * 2009-11-09 2013-05-14 Trend Micro, Inc. Silent detection of malware and feedback over a network
US8356354B2 (en) * 2009-11-23 2013-01-15 Kaspersky Lab, Zao Silent-mode signature testing in anti-malware processing
US8800044B2 (en) 2011-03-23 2014-08-05 Architelos, Inc. Storing and accessing threat information for use in predictive modeling in a network security service
US8943131B2 (en) * 2011-06-29 2015-01-27 International Business Machines Corporation Predictive collaboration management
US20130124633A1 (en) * 2011-11-10 2013-05-16 Bing Liu Engine, system and method of providing location-based social services
WO2013130867A1 (en) * 2012-02-29 2013-09-06 Sourcefire, Inc. Method and apparatus for retroactively detecting malicious or otherwise undesirable software
EP2677715A1 (en) * 2012-06-22 2013-12-25 Alcatel Lucent A method and a server for evaluating a request for access to content from a server in a computer network
CN103023999B (en) * 2012-11-30 2015-12-02 北京奇虎科技有限公司 Issued one kind of browser component method, and corresponding system server
US9253207B2 (en) 2013-02-08 2016-02-02 PhishMe, Inc. Collaborative phishing attack detection
US9356948B2 (en) * 2013-02-08 2016-05-31 PhishMe, Inc. Collaborative phishing attack detection
US8966637B2 (en) 2013-02-08 2015-02-24 PhishMe, Inc. Performance benchmarking for simulated phishing attacks
US9398038B2 (en) 2013-02-08 2016-07-19 PhishMe, Inc. Collaborative phishing attack detection
US9262629B2 (en) 2014-01-21 2016-02-16 PhishMe, Inc. Methods and systems for preventing malicious use of phishing simulation records
US9223971B1 (en) * 2014-01-28 2015-12-29 Exelis Inc. User reporting and automatic threat processing of suspicious email
US9325726B2 (en) 2014-02-03 2016-04-26 Intuit Inc. Method and system for virtual asset assisted extrusion and intrusion detection in a cloud computing environment
US9342690B2 (en) * 2014-05-30 2016-05-17 Intuit Inc. Method and apparatus for a scoring service for security threat management
US9768270B2 (en) * 2014-06-25 2017-09-19 Sandisk Technologies Llc Method of selectively depositing floating gate material in a memory device
US20160085970A1 (en) * 2014-09-22 2016-03-24 Mcafee, Inc. Pre-launch process vulnerability assessment
KR20160095856A (en) * 2015-02-04 2016-08-12 한국전자통신연구원 System and method for detecting intrusion intelligently based on automatic detection of new attack type and update of attack type
US9654496B1 (en) * 2015-03-31 2017-05-16 Juniper Networks, Inc. Obtaining suspect objects based on detecting suspicious activity
US20170006061A1 (en) * 2015-07-02 2017-01-05 Reliaquest Holdings, Llc Threat intelligence system and method
US9734337B1 (en) * 2017-01-24 2017-08-15 Malwarebytes Inc. Behavior-based ransomware detection

Family Cites Families (94)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR2706652B1 (en) * 1993-06-09 1995-08-18 Alsthom Cge Alcatel Device for detecting intrusion and suspect users for data processing system and security system comprising such a device.
US5590199A (en) 1993-10-12 1996-12-31 The Mitre Corporation Electronic information network user authentication and authorization system
US5590201A (en) 1994-11-10 1996-12-31 Advanced Micro Devices Inc. Programmable source address locking mechanism for secure networks
US5815571A (en) * 1996-10-28 1998-09-29 Finley; Phillip Scott Computer system with secured data paths and method of protection
US6073178A (en) 1996-12-09 2000-06-06 Sun Microsystems, Inc. Method and apparatus for assignment of IP addresses
US5848233A (en) 1996-12-09 1998-12-08 Sun Microsystems, Inc. Method and apparatus for dynamic packet filter assignment
DE19651882A1 (en) 1996-12-13 1998-06-18 Asea Brown Boveri A method for frequency support in operation of a power plant
JP3381055B2 (en) * 1997-01-27 2003-02-24 裕典 若山 Intrusion prevention method of viral, and viral intrusion prevention mechanism
US5956481A (en) * 1997-02-06 1999-09-21 Microsoft Corporation Method and apparatus for protecting data files on a computer from virus infection
US6061341A (en) 1997-12-16 2000-05-09 Telefonaktiebolaget Lm Ericsson (Publ) Use of transmission control protocol proxy within packet data service transmissions in a mobile network
US6202070B1 (en) * 1997-12-31 2001-03-13 Compaq Computer Corporation Computer manufacturing system architecture with enhanced software distribution functions
US7240368B1 (en) 1999-04-14 2007-07-03 Verizon Corporate Services Group Inc. Intrusion and misuse deterrence system employing a virtual network
US6834350B1 (en) 1999-07-06 2004-12-21 Watchguard Technologies, Inc. Secure and differentiated delivery of network security information
US7296274B2 (en) * 1999-11-15 2007-11-13 Sandia National Laboratories Method and apparatus providing deception and/or altered execution of logic in an information system
US6701440B1 (en) * 2000-01-06 2004-03-02 Networks Associates Technology, Inc. Method and system for protecting a computer using a remote e-mail scanning device
US6742043B1 (en) * 2000-01-14 2004-05-25 Webtv Networks, Inc. Reformatting with modular proxy server
WO2001084285A3 (en) 2000-04-28 2002-06-13 Internet Security Systems Inc Method and system for managing computer security information
US6898715B1 (en) * 2000-09-12 2005-05-24 Networks Associates Technology, Inc. Response to a computer virus outbreak
US7036146B1 (en) 2000-10-03 2006-04-25 Sandia Corporation System and method for secure group transactions
EP1215907A3 (en) * 2000-12-07 2006-04-26 Sony United Kingdom Limited Watermarking material and transferring watermarked material
US6978093B2 (en) 2001-03-09 2005-12-20 Lightpointe Communications, Inc. Free space optical communication network
WO2002073834A1 (en) 2001-03-09 2002-09-19 Lightpointe Communications, Inc. Multi-tenant unit optical network
WO2002093334A3 (en) * 2001-04-06 2003-11-13 Symantec Corp Temporal access control for computer virus outbreaks
US20020178373A1 (en) * 2001-04-16 2002-11-28 Randice-Lisa Altschul Computer virus rejection system and method
US20030056116A1 (en) 2001-05-18 2003-03-20 Bunker Nelson Waldo Reporter
US7458094B2 (en) 2001-06-06 2008-11-25 Science Applications International Corporation Intrusion prevention system
US20020199116A1 (en) * 2001-06-25 2002-12-26 Keith Hoene System and method for computer network virus exclusion
US6976167B2 (en) 2001-06-26 2005-12-13 Intel Corporation Cryptography-based tamper-resistant software design mechanism
US7310817B2 (en) * 2001-07-26 2007-12-18 Mcafee, Inc. Centrally managed malware scanning
US7379993B2 (en) 2001-09-13 2008-05-27 Sri International Prioritizing Bayes network alerts
US20030084349A1 (en) * 2001-10-12 2003-05-01 Oliver Friedrichs Early warning system for network attacks
US20030084331A1 (en) 2001-10-26 2003-05-01 Microsoft Corporation Method for providing user authentication/authorization and distributed firewall utilizing same
US20030084318A1 (en) 2001-10-31 2003-05-01 Schertz Richard L. System and method of graphically correlating data for an intrusion protection system
US20040162066A1 (en) 2001-11-02 2004-08-19 Ravi Kuchibhotla Isolation and remediation of a communication device
US20030110395A1 (en) 2001-12-10 2003-06-12 Presotto David Leo Controlled network partitioning using firedoors
CA2414789A1 (en) 2002-01-09 2003-07-09 Peel Wireless Inc. Wireless networks security system
US7243148B2 (en) 2002-01-15 2007-07-10 Mcafee, Inc. System and method for network vulnerability detection and reporting
US7664845B2 (en) 2002-01-15 2010-02-16 Mcafee, Inc. System and method for network vulnerability detection and reporting
US7257630B2 (en) 2002-01-15 2007-08-14 Mcafee, Inc. System and method for network vulnerability detection and reporting
JP4088082B2 (en) * 2002-02-15 2008-05-21 株式会社東芝 Apparatus and a program to prevent infection of unknown computer viruses
US7206862B2 (en) 2002-04-24 2007-04-17 Microsoft Corporation Method and apparatus for efficiently matching responses to requests previously passed by a network node
US7590855B2 (en) 2002-04-30 2009-09-15 Tippingpoint Technologies, Inc. Steganographically authenticated packet traffic
US7359962B2 (en) 2002-04-30 2008-04-15 3Com Corporation Network security system integration
US20030219019A1 (en) 2002-05-24 2003-11-27 Wilson Tyler James Method of inverse multiplexing/demultiplexing dynamically fluctuating ATM cell streams
US6654882B1 (en) 2002-05-24 2003-11-25 Rackspace, Ltd Network security system protecting against disclosure of information to unauthorized agents
US7529929B2 (en) * 2002-05-30 2009-05-05 Nokia Corporation System and method for dynamically enforcing digital rights management rules
US20030236995A1 (en) 2002-06-21 2003-12-25 Fretwell Lyman Jefferson Method and apparatus for facilitating detection of network intrusion
US7965842B2 (en) 2002-06-28 2011-06-21 Wavelink Corporation System and method for detecting unauthorized wireless access points
US6742128B1 (en) 2002-08-28 2004-05-25 Networks Associates Technology Threat assessment orchestrator system and method
US7170999B1 (en) * 2002-08-28 2007-01-30 Napster, Inc. Method of and apparatus for encrypting and transferring files
US7748039B2 (en) * 2002-08-30 2010-06-29 Symantec Corporation Method and apparatus for detecting malicious code in an information handling system
US7331062B2 (en) * 2002-08-30 2008-02-12 Symantec Corporation Method, computer software, and system for providing end to end security protection of an online transaction
US7832011B2 (en) * 2002-08-30 2010-11-09 Symantec Corporation Method and apparatus for detecting malicious code in an information handling system
US7509679B2 (en) * 2002-08-30 2009-03-24 Symantec Corporation Method, system and computer program product for security in a global computer network transaction
US7437760B2 (en) * 2002-10-10 2008-10-14 International Business Machines Corporation Antiviral network system
US20040078592A1 (en) * 2002-10-16 2004-04-22 At & T Corp. System and method for deploying honeypot systems in a network
CN1706159A (en) 2002-10-18 2005-12-07 松下电器产业株式会社 Method and device for roaming-connection in global network
EP1416603B1 (en) 2002-11-01 2015-01-21 ABB Research Ltd. Protection of an electric power transmission network
US7454499B2 (en) 2002-11-07 2008-11-18 Tippingpoint Technologies, Inc. Active network defense system and method
US20040093514A1 (en) * 2002-11-08 2004-05-13 International Business Machines Corporation Method for automatically isolating worm and hacker attacks within a local area network
US7549166B2 (en) * 2002-12-05 2009-06-16 International Business Machines Corporation Defense mechanism for server farm
EP1586054A4 (en) * 2002-12-13 2010-12-08 Symantec Corp Method, system, and computer program product for security within a global computer network
US20040123117A1 (en) * 2002-12-18 2004-06-24 Symantec Corporation Validation for behavior-blocking system
US7383578B2 (en) * 2002-12-31 2008-06-03 International Business Machines Corporation Method and system for morphing honeypot
US7295119B2 (en) 2003-01-22 2007-11-13 Wireless Valley Communications, Inc. System and method for indicating the presence or physical location of persons or devices in a site specific representation of a physical environment
US20040158741A1 (en) * 2003-02-07 2004-08-12 Peter Schneider System and method for remote virus scanning in wireless networks
CA2422334C (en) 2003-03-17 2009-06-09 British Telecommunications Public Limited Company Authentication of network users
WO2004097584A3 (en) * 2003-04-28 2005-04-07 P G I Solutions Llc Method and system for remote network security management
US20050008004A1 (en) 2003-05-16 2005-01-13 Telconcept Usa Holdings, Inc. System for transmitting emergency and notification messages over a phone line
US7409712B1 (en) * 2003-07-16 2008-08-05 Cisco Technology, Inc. Methods and apparatus for network message traffic redirection
US8127356B2 (en) * 2003-08-27 2012-02-28 International Business Machines Corporation System, method and program product for detecting unknown computer attacks
US7644365B2 (en) 2003-09-12 2010-01-05 Cisco Technology, Inc. Method and system for displaying network security incidents
US20050086102A1 (en) 2003-10-15 2005-04-21 International Business Machines Corporation Method and system for validation of service consumers
US7140046B2 (en) * 2004-02-09 2006-11-28 Tosh B. Ono Glove adapted for use in firearms loading, shooting and unloading
US7716726B2 (en) 2004-02-13 2010-05-11 Microsoft Corporation System and method for protecting a computing device from computer exploits delivered over a networked environment in a secured communication
US20050182967A1 (en) 2004-02-13 2005-08-18 Microsoft Corporation Network security device and method for protecting a computing device in a networked environment
US7814543B2 (en) 2004-02-13 2010-10-12 Microsoft Corporation System and method for securing a computer system connected to a network from attacks
WO2005091636B1 (en) * 2004-03-04 2005-12-01 Cloakx Llc A method and system for digital rights management and digital content distribution
US7539862B2 (en) 2004-04-08 2009-05-26 Ipass Inc. Method and system for verifying and updating the configuration of an access device during authentication
US8230480B2 (en) 2004-04-26 2012-07-24 Avaya Inc. Method and apparatus for network security based on device security status
US20050262208A1 (en) * 2004-05-21 2005-11-24 Eyal Haviv System and method for managing emails in an enterprise
US7748038B2 (en) * 2004-06-16 2010-06-29 Ironport Systems, Inc. Method and apparatus for managing computer virus outbreaks
US7694150B1 (en) * 2004-06-22 2010-04-06 Cisco Technology, Inc System and methods for integration of behavioral and signature based security
US7343624B1 (en) * 2004-07-13 2008-03-11 Sonicwall, Inc. Managing infectious messages as identified by an attachment
DE112005001761T5 (en) 2004-07-23 2007-05-24 Wireless Valley Communications, Inc., Austin System, method and apparatus for determining and using a position of wireless devices or infrastructure in order to improve a wireless network
US7571460B2 (en) 2004-08-06 2009-08-04 Time Warner Cable, Inc. System and method for affecting the behavior of a network device in a cable network
US20060041497A1 (en) 2004-08-18 2006-02-23 Pjm Interconnection, Llc. Systems and methods for maintaining system performance
US7596690B2 (en) * 2004-09-09 2009-09-29 International Business Machines Corporation Peer-to-peer communications
US20060075103A1 (en) 2004-10-05 2006-04-06 International Business Machines Corporation Systems, methods, and media for providing access to clients on a network
US7555778B2 (en) 2004-10-19 2009-06-30 George Mason Intellectual Properties, Inc. Minimum-cost network hardening
US7516114B2 (en) 2004-10-22 2009-04-07 International Business Machines Corporation Visual structuring of multivariable data
US7716727B2 (en) 2004-10-29 2010-05-11 Microsoft Corporation Network security device and method for protecting a computing device in a networked environment
US7930346B2 (en) * 2005-08-24 2011-04-19 Microsoft Corporation Security in peer to peer synchronization applications
US8738750B2 (en) * 2005-12-21 2014-05-27 Imran Chaudhri System and method for efficient replication of and access to application specific environments and data

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See references of EP1854019A4 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8484742B2 (en) 2007-01-19 2013-07-09 Microsoft Corporation Rendered image collection of potentially malicious web pages
US9426175B2 (en) 2007-01-19 2016-08-23 Microsoft Technology Licensing, Llc Rendered image collection of potentially malicious web pages
CN102982280A (en) * 2012-11-07 2013-03-20 北京奇虎科技有限公司 Methods and device of avoiding computer aided design (CAD) virus infection

Also Published As

Publication number Publication date Type
EP1854019A2 (en) 2007-11-14 application
US20060075504A1 (en) 2006-04-06 application
WO2006039208A3 (en) 2007-08-02 application
WO2006036763A2 (en) 2006-04-06 application
US20060075083A1 (en) 2006-04-06 application
WO2006036763A3 (en) 2007-06-14 application
EP1854019A4 (en) 2010-12-22 application
US7836506B2 (en) 2010-11-16 grant
US20110078795A1 (en) 2011-03-31 application

Similar Documents

Publication Publication Date Title
Kendall A database of computer attacks for the evaluation of intrusion detection systems
US8321936B1 (en) System and method for malicious software detection in multiple protocols
US8627476B1 (en) Altering application behavior based on content provider reputation
US7343624B1 (en) Managing infectious messages as identified by an attachment
US8516593B2 (en) Systems and methods for computer worm defense
US8832829B2 (en) Network-based binary file extraction and analysis for malware detection
US8881282B1 (en) Systems and methods for malware attack detection and identification
US8539582B1 (en) Malware containment and security analysis on connection
US7574740B1 (en) Method and system for intrusion detection in a computer network
US8001606B1 (en) Malware detection using a white list
US7080408B1 (en) Delayed-delivery quarantining of network communications having suspicious contents
US6944772B2 (en) System and method of enforcing executable code identity verification over the network
US20090328221A1 (en) Malware detention for suspected malware
US20040111632A1 (en) System and method of virus containment in computer networks
US20100235915A1 (en) Using host symptoms, host roles, and/or host reputation for detection of host infection
US8793787B2 (en) Detecting malicious network content using virtual environment components
US20080301051A1 (en) Internet fraud prevention
US20060130139A1 (en) Client compliancy with self-policing clients
US20120331553A1 (en) Dynamic signature creation and enforcement
US20090158430A1 (en) Method, system and computer program product for detecting at least one of security threats and undesirable computer files
US20110185423A1 (en) Method and system for detection of malware that connect to network destinations through cloud scanning and web reputation
US20130227691A1 (en) Detecting Malicious Network Content
US7533131B2 (en) System and method for pestware detection and removal
Stinson et al. Characterizing bots’ remote control behavior
US20040205419A1 (en) Multilevel virus outbreak alert based on collaborative behavior

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A2

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KM KP KR KZ LC LK LR LS LT LU LV LY MA MD MG MK MN MW MX MZ NA NG NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SM SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW

AL Designated countries for regional patents

Kind code of ref document: A2

Designated state(s): BW GH GM KE LS MW MZ NA SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LT LU LV MC NL PL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
NENP Non-entry into the national phase in:

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2005821356

Country of ref document: EP

WWP Wipo information: published in national office

Ref document number: 2005821356

Country of ref document: EP