Distributed computer virus detection and scanning

#The present invention relates to a method and apparatus for detecting computer viruses and more particularly to the detection of viruses in a computer network environment.

#Computer viruses are today a well recognised problem in the computer and software industry and amongst computer users in general. One common type of virus today is the so-called “macro-virus” which infects software macros. More traditional viruses also remain a problem in the computer world, these viruses including those which attach themselves to executable code, e.g. .exe, .com, .bat files.

#Whilst early approaches to virus detection relied upon providing an anti-virus program, capable of detecting previously identified viruses or suspect files, in each individual computer, the recent growth in network computing has led to the introduction of gateway based solutions. This involves supplementing, or replacing, the anti-virus programs running on individual computers connected to a network with an anti-virus program running on the or each gateway which connects the network to the outside world, as described for example in U.S. Pat. Nos. 5,623,600 and 5,832,208. Thus, an anti-virus program may be provided at a network Internet server, mail server etc. An antivirus program may also be provided at a database server of the network to screen data transfers to and from a central storage database. The advantage of this centralised approach is that the screening of data need be conducted only when data enters the network and repeated screening at individual client computers is avoided.

#FIG. 1 shows schematically a data network having a central virus scanning server; and

#FIG. 2 is a flow diagram illustrating a virus scanning operation of the network of FIG. 1.

#A computer data network (illustrated generally by reference numeral 1) is shown in FIG. 1 and comprises a number of users or clients 2. These users 2 include an administrator's workstation 2a, one or more notebook computers 2b, a number of computer workstations 2c, and a server 2d. The network comprises a physical wire network 3 to which each of the users 2 is connected via respective network cards (generally integrated into the user terminals and therefore not shown separately in FIG. 1). The network may be an Ethernet network, X.25 network, or the like, with TCP/IP protocol being used as the transport protocol. Although it is not considered here in detail, the wire network 3 of FIG. 1 may be replaced by a wireless network, e.g. using radio signals to transmit data.

#Also connected to the network (via respective network cards) are a number of so-called “protected systems” 4. These include a firewall 4a, a mail server 4b, a proxy server 4c, and a database server 4d. As will be known to the skilled person, the firewall 4a provides a secure gateway between the network 1 and the “outside world”, in this case the Internet 5. All data traffic coming from the Internet 5 to the network 1 passes through the firewall 4a where its access authority is checked. The firewall 4a may also control the access of users 2 to the Internet 5. The mail server 4b and the proxy server 4c provide transit nodes for electronic mail and WWW traffic respectively. Data is routed between the mail server 4b and the proxy server 4c, and the Internet 5, via the firewall 4a. The mail server 4b may also act as a router for internal network electronic mail.

#The protected systems 4 also include a database server 4d which acts as a gateway or transit node between the network 1 and a central data storage facility 6. This facility is a repository for data shared by the network users 2.