Server based malware screening
AssigneeEnpulz, LLC
InventorJames D. Bennett
Life of this patent
Estimating the term…
Abstract
An Internet infrastructure is provided to transfer a packet of data between a client device and source device. The infrastructure consists of a support server that screens the packet for malware codes on behalf of a registered client. In order to scan for malware, the support server contains hardware and/or software modules to perform malware detection and quarantine functions. The modules identify malware bit sequence in the packet(s), malware bit sequences or entire contaminated code is quarantined or repaired as appropriate. After identification of malware code (if any), the support server sends warning messages to affected parties, providing information regarding the malware codes that were detected.
Claims20
A method used by malware support server system in a network that includes a plurality of client devices and a plurality of host servers, the malware support server system having a network address, the method comprising:
- receiving a first portion of a plurality of data packets, each of the plurality of data packets having the network address as a destination address, and each of the plurality of data packets including both an intended destination address and a source address;
- determining, while engaged in receiving at least some of the plurality of data packets, that the first portion is malware-free;
- upon determining that the first portion is malware-free, swapping the network address with the intended destination address in the first portion to create a modified first portion of the plurality of data packets;
- sending the modified first portion;
- receiving a second portion of plurality of data packets;
- determining, while engaged in receiving at least some of the plurality of data packets, that the second portion is not malware-free;
- and
- at least assisting in terminating delivery of the plurality of data packets.
A malware support server system in a network that includes a plurality of client devices and a host server, the malware support server system comprising:
- a communication interface having a network address;
- a processing infrastructure, coupled to the communication interface, that is operable to:
- register each of the plurality of client device as member devices;
- receive via the communication interface a proxy request from a first client device of the plurality of client devices for a plurality of streamed data packets that are available from the host server;
- send via the communication interface a forwarded request for the plurality of streamed data packets to the host server, the forwarded request including the network address;
- analyze, while engaged in receiving at least some of the plurality of data packets, a first portion of the plurality of streamed data packets received via the communication interface from the host server, conclude that the first portion is malware-free, upon concluding that the first portion is malware-free, replacing the network address of the first portion with a destination address of the first device, and forward the first portion to the first device;
- and
- analyze, while engaged in receiving at least some of the plurality of data packets, a second portion of the plurality of streamed data packets received via the communication interface from the host server, determine that the second portion contains malware data, and at least assist in terminating delivery of the plurality of streamed data packets.
A malware support server system in a network that includes a plurality of client devices and a plurality of host servers, the malware support server system comprising:
- a communication interface having a network address;
- a processing infrastructure, coupled to the communication interface, that operates as a proxy device between a first host server of the plurality of host servers and a first device of the plurality of client devices to perform malware detection analysis of a real time stream of packets originating from at least one of the first host server and the first device;
- and
- the processing infrastructure delivering, via the communication interface, to at least one of the first host server and the first device mid-stream malware detection indications when malware is detected.
Dependencies are inferred from the claim text.