Patent Application
20060010495
The present invention relates to the field of computer virus filtering. More particularly, the invention relates to a method for protecting a computer from a suspicious object.
The term “inspection” refers in the art to the activity of detecting viruses and other forms of maliciousness. A well known inspection method is looking for “virus signature”, a sequence of bytes that characterizes a virus infection, within an object. While virus signature is a method for detecting known viruses, sometimes more sophisticated methods are required for detecting unknown malicious objects. One of these methods is known in the art as emulation, i.e. executing the code of an executable under control.
Viruses and other malicious forms may harm a computer in a variety of ways, such as modifying operating system executables, the FAT (File Allocation Table) of a computer, changing the registry values, etc. Thus, when an executable cannot be indicated as malicious (e.g. by virus signature methods), but its code comprises invocation of functions that malicious forms use, the executable can be considered as suspicious.
While malicious objects are blocked and harmless objects are passed on toward their destination, there is a question of how to treat a suspicious object. In the prior art, it is common to send a suspicious object toward its destination, with a warning thereof. When a user tries to open the object, e.g. an email message, a warning is displayed and the user is given the opportunity to cancel processing the suspicious object. However, the majority of the users ignore warnings, especially due to the tremendous number of messages and warnings that a user gets while operating his computer, and consequently exposes their computer to malicious objects.
Therefore, there is an object of the present invention to protect a computer from suspicious objects.
Other objects and advantages of the invention will become apparent as the description proceeds.
In an inspection facility (e.g. at a gateway server, at a proxy server, at a firewall to a network, at an entrance to a local area network or even at the user's computer) connected to an anti-virus center for updates, a method for protecting a computer from suspicious objects (e.g. a file, an executable, a Web page, an email message, etc.), the method comprising the steps of: inspecting an object; upon determining the object as suspicious, holding the object in quarantine (e.g. preventing from the object to be forwarded to its destination) for a time period, thereby enabling the inspection facility to be updated during the time period by the anti-virus center; upon ending of the time period, re-inspecting the object, thereby inspecting the object by updated inspection tests; and upon determining the object as malicious by the re-inspection, blocking the object, otherwise forwarding the object toward its destination.
The method may further comprise: inspecting at said inspection facility the object during the time period by at least one new inspection method (i.e. that has not been used previously for inspecting the object); and upon determining the object as malicious, informing the anti-virus center with the findings of the inspection. The inspection method may be, for example, emulation of the object, controlled execution of the object by automatic means, controlled execution of the object by a human factor, etc. An object can be determined as suspicious also by a test, e.g. an unusual number of objects having the same CRC.
The scope of the present invention also includes a system, for protecting a computer, that comprises at least the inspection facility, and preferably also the anti-virus center.
The present invention may be better understood in conjunction with the following figures:
At the gateway server 30 a filtering facility 50 filters files that arrive to the gateway in their path to the destination, one or more of the computers 21. The filtering facility 50 is connected via the Internet to a server 40 of an anti-virus company. The connection enables the filtering facility 50 to be updated, i.e. by the latest virus signatures and other filtering tools.
At a gateway, an object that has been determined as malicious is typically “blocked”, i.e. not passed on toward its destination. However, as specified above, in addition to the situation where an object is classified as malicious or harmless, there is a situation where an object is suspicious.
There are a variety of inspection methods, like identifying virus signatures within an object, and emulation. A virus signature is a string of characters specific to a virus or a family of viruses (e.g. that have been composed by the same programmer with the same routines). Some of the inspection methods, such as emulation, analyze an object. An object may be of a human readable text (e.g. a script file), or compiled code (e.g. Windows EXE file). In a readable object, calls to a function can be recognized by scanning the text, however in order to process a compiled object, the object should disassembled (converted to Assembly computer language), and then be scanned.
On block 101, the object is inspected.
For example, if an inspection process of a Windows EXE file has detected usage of registry access functions, then further inspection analysis should be carried out in order to determine the purpose of those functions. However, if the inspection fails to determine what the registry functions intend to do with the registry, then the EXE file can be considered as suspicious.
An object may be determined as suspicious also by a dedicated test thereof. For example, the CRC (Cyclic Redundancy Checks) value of every object that passes through a gateway server can be calculated and stored in a database. When a certain CRC value appears more often than usually, it may indicate that objects having said CRC value are suspicious. The CRC may be calculated for the whole object, a part of it, a specific part of it (e.g. a function) and so forth.
Thus, an object may be indicated as suspicious because the tests for determining maliciousness failed to determine the object as malicious despite of the fact the object comprises common operations of malicious objects, such as amending the registry. However, an object may be determined as suspicious also by dedicated tests thereof, e.g. indication of an abnormal number of objects of the same kind (e.g. a specific program, specific CRC value of certain functions, etc.) that pass through a gateway, because this is what happens in a virus outbreak.
From block 102:
If the inspection determines that the object is harmless than the object is forwarded to its destination, as denoted by block 105.
If the inspection determines that the object is malicious, the object is blocked, as denoted by block 103.
However, if the inspection determines that the object is suspicious, the object is put into quarantine (i.e. delayed) for a time period (e.g. a few hours, a day, etc.), as denoted by block 104. Afterwards the object is re-inspected, as denoted by block 106.
In case there is a virus outbreak, if the inspection facility is connected to an anti-virus company (e.g. via the Internet), during the quarantine time the testing tables (e.g. virus signatures) upon which the object is inspected may be updated by the anti-virus company. Thus, after the quarantine time, when the delayed object is re-inspected (block 106), the inspection facility may be updated to recognize the new virus, and consequently new forms of maliciousness will be filtered.
At block 201, the suspicious object is sent to the anti-virus company for further inspection. The anti-virus company may inspect the object by human intervention, as denoted by block 202. This is useful especially for objects in which a malicious code is activated by a user interface operation, like clicking on a specific button. The object may be executed under a controlled platform, e.g. emulation, as denoted by block 203. Another test that the anti-virus company may perform is counting the number of instances of the same object that are sent from the clients, as denoted by block 204. For example, when a certain suspicious object is send from or to an unusual number of clients (e.g. more than 30), it may indicate a virus outbreak.
After all the tests are complete, and a new virus or malicious form has been detected, the anti-virus company may update its virus table (e.g. by adding the virus signature of a new discovered virus) as denoted by block 205, and propagate it to its users, other gateway servers, anti-virus companies, and so forth, as denoted by block 206.
At the client side, the suspicious object is re-inspected by the updated anti-virus tables, as denoted by block 106.
It should be noted that although the examples herein refer to virus signatures, other anti-virus tests may also be updated, such as providing new versions of a testing procedure, adding new procedures to the inspection program of the gateway server, and so forth.
It should be noted that although the present invention has been described as herein as implemented by a gateway server, the present invention can be implemented also by a firewall server, etc., and even by the end user's computer.
The following elements play a role with regard to the present invention:
Thus, when implementing the present invention on a gateway server, the following elements play a role with regard to the present invention:
When implementing the present invention on a user computer, the following elements play a role with regard to the present invention:
Those skilled in the art will appreciate that the invention can be embodied by other forms and ways, without losing the scope of the invention. The embodiments described herein should be considered as illustrative and not restrictive.
