# US 7,069,316 B1 · Automated Internet Relay Chat malware monitoring and interception

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 7,069,316 B1
- Document ID: US7069316B1
- Status: Granted
- Kind: B1
- Application number: 10/076,441
- Filed: 2002-02-19
- Granted: 2006-06-27
- Earliest claimed: 2002-02-19
- Assignees: McAfee, Inc.
- Inventors: Dmitry Gryaznov
- Web page: https://patentgrep.com/patent/US7069316B1

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 12/1813: {for computer conferences, e.g. chat rooms (instant messaging H04L51/04; protocols for multimedia communication H04L65/1101; arrangements for multi-party communication H04L65/403; telephonic conference arrangements H04M3/56; television conference systems H04N7/15)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method, system, and computer program product for providing monitoring and interception of malwares in Internet Relay Chat (IRC), which is secure, does not require significant system resources, and is capable of monitoring multiple IRC networks and servers. A method of detecting a computer malware comprises the steps of joining an Internet Relay Chat server, retrieving a list of channels of the Internet Relay Chat server, monitoring at least one channel in the list of retrieved channels, accepting data received from the monitored channel, and storing and logging the data received from the monitored channel.

## Claims

### Claim 1

A method of detecting a computer malware comprising the steps of:
joining an Internet Relay Chat server;
retrieving a list of channels of the Internet Relay Chat server;
monitoring at least one channel in the list of retrieved channels, by:
joining a channel,
waiting a time delay,
leaving the channel, and
simulating user activities by transmitting a message to the channel;
accepting data received from the monitored channel;
storing and logging the data received from the monitored channel; and
scanning the received data to detect a computer malware;
wherein an Internet Relay Chat client is utilized in the joining, the retrieving, and the monitoring;
wherein the Internet Relay Chat client scans the received data to detect the computer malware and collects statistics including a receipt time of the data and a sender of the data.

### Claim 2 (depends on 1)

The method of claim 1, wherein the computer malware comprises at least one of a computer virus, a computer worm, or a computer Trojan horse program.

### Claim 3 (depends on 1)

The method of claim 1, further comprising the step of:
analyzing the stored and logged data to detect the computer malware.

### Claim 4 (depends on 3)

The method of claim 3, wherein the computer malware comprises at least one of a computer virus, a computer worm, or a computer Trojan horse program.

### Claim 5

A system for detecting a computer malware comprising:
a processor operable to execute computer program instructions;
a memory operable to store computer program instructions executable by the processor; and
computer program instructions stored in the memory and executable to perform the steps of:
joining an Internet Relay Chat server;
retrieving a list of channels of the Internet Relay Chat server;
monitoring at least one channel in the list of retrieved channels, by:
joining a channel,
waiting a time delay,
leaving the channel, and
simulating user activities by transmitting a message to the channel,
accepting data received from the monitored channel;
storing and logging the data received from the monitored channel; and
scanning the received data to detect a computer malware;
wherein an Internet Relay Chat client is utilized in the joining, the retrieving, and the monitoring;
wherein the Internet Relay Chat client scans the received data to detect the computer malware and collects statistics including a receipt time of the data and a sender of the data.

### Claim 6 (depends on 5)

The system of claim 5, wherein the computer malware comprises at least one of a computer virus, a computer worm, or a computer Trojan horse program.

### Claim 7 (depends on 5)

The system of claim 5, further comprising the step of:
analyzing the stored and logged data to detect the computer malware.

### Claim 8 (depends on 7)

The system of claim 7, wherein the computer malware comprises at least one of a computer virus, a computer worm, or a computer Trojan horse program.

### Claim 9

A computer program product embodied on a computer readable medium for detecting a computer malware comprising:
computer program instructions, recorded on the computer readable medium, executable by a processor, for performing the steps of:
joining an Internet Relay Chat server;
retrieving a list of channels of the Internet Relay Chat server;
monitoring at least one channel in the list of retrieved channels, by:
joining a channel,
waiting a time delay,
leaving the channel, and
simulating user activities by transmitting a message to the channel;
accepting data received from the monitored channel;
storing and logging the data received from the monitored channel; and
scanning the received data to detect a computer malware;
wherein an Internet Relay Chat client is utilized in the joining, the retrieving, and the monitoring;
wherein the Internet Relay Chat client scans the received data to detect the computer malware and collects statistics including a receipt time of the data and a sender of the data.

### Claim 10 (depends on 9)

The computer program product of claim 9, wherein the computer malware comprises at least one of a computer virus, a computer worm, or a computer Trojan horse program.

### Claim 11 (depends on 9)

The computer program product of claim 9, further comprising the step of:
analyzing the stored and logged data to detect the computer malware.

### Claim 12 (depends on 11)

The computer program product of claim 11, wherein the computer malware comprises at least one of a computer virus, a computer worm, or a computer Trojan horse program.

### Claim 13 (depends on 1)

The method of claim 1, wherein transmitting the message to the channel is utilized for triggering the computer malware in the channel to be sent.

### Claim 14 (depends on 1)

The method of claim 1, wherein the storing and logging includes storing and logging the receipt time of the data and the sender of the data.

### Claim 15 (depends on 1)

The method of claim 1, wherein the Internet Relay Chat client automatically accepts and stores the data received from the monitored channel.

### Claim 16 (depends on 1)

The method of claim 1, wherein the Internet Relay Chat client notifies an administrator of the computer malware.

### Claim 17 (depends on 1)

The method of claim 1, wherein the received data includes direct client-to-client DCC send requests.

### Claim 18 (depends on 3)

The method of claim 3, wherein the analyzing is automatically performed.

### Claim 19 (depends on 3)

The method of claim 3, wherein the analyzing is performed manually.

### Claim 20 (depends on 1)

The method of claim 1, wherein the monitoring is performed utilizing a restricted and secure scripting language.

### Claim 21 (depends on 1)

The method of claim 1, wherein a plurality of Internet Relay Chat clients running on a single computer are each utilized in the joining, the retrieving, and the monitoring.