Back to results
US 9,003,534 B2Granted
System and method for server-based antivirus scan of data downloaded from a network
AssigneeKaspersky Lab ZAO
InventorsSergey A. Zubrilin, Alexander A. Stroykov, Sergey A. Vasilyev
Life of this patent
Estimating the term…
Abstract
Aspect of the invention are directed to antivirus scanning, by a proxy server, of data downloaded from the network onto a PC workstation. The antivirus scanning is optimized for each scan by selecting an algorithm for that scan based on a determined overall likelihood that the downloaded data contains malicious code. Determination of the overall likelihood is augmented by the strength, or confidence, of statistical data relating to malware screening of results of previous downloads having similar parameters to the instant download.
Claims16
A computer-implemented apparatus for facilitating data transfer over a network between a destination computer system and a data source, the apparatus comprising:
- an intermediate computer system including a processor circuit operatively coupled with a data storage circuit and network interface circuitry that is adapted to be communicatively coupled to a computer network, the data storage circuit containing instructions that, when executed on the processor circuit, cause the computer system to implement:
- a data reception module adapted to obtain, via the network interface circuitry, a data item to be received from the data source in response to a request by the destination computer system;
- a data transmission module adapted to conditionally transmit, via the network interface circuitry, the data item to the destination computer system, wherein transmission of the data item is conditioned on a result of a security evaluation;
- an antivirus module adapted to perform the security evaluation on the data item according to selectable ones of a plurality of malware detection techniques, wherein the plurality of malware detection techniques include at least one technique which is relatively computationally easy, and at least one technique which is relatively computationally difficult;
- a data analysis module adapted to:
- collect a plurality of parameters that represent various indicia of malware risk relating to the data item;
- collect statistical information relating to previous malware detection results for the data item and/or the data source;
- and
- calculate, based on the plurality of parameters and on the statistical information, an overall risk probability of whether the data item is infected with malware, wherein calculation of the overall risk probability is computationally easier than the at least one relatively computationally easy malware detection technique;
- wherein the antivirus module is further adapted to selectively apply at least one malware detection technique from among the plurality of malware detection techniques based on the overall risk probability such that the selectively applied at least one malware detection technique has a level of computational difficulty that corresponds to the overall risk probability;
- and
- wherein the data analysis module is further adapted to analyze the statistical information relating to the previous malware detection results for the data item and/or the data source and, if the statistical information meets predetermined confidence criteria, to invoke at least one priority rule that forces a certain malware detection technique notwithstanding the overall risk probability.
9 more elements
In a proxy server implemented as a computer system having hardware configured to operate under software control, a method for automatically screening a data item requested to be downloaded to a destination computer from a data source, the method comprising:
- performing, by the proxy server, a security evaluation on the data item according to selectable ones of a plurality of malware detection techniques, wherein the plurality of malware detection techniques include at least one technique which is relatively computationally easy, and at least one technique which is relatively computationally difficult;
- collecting, by the proxy server, a plurality of parameters that represent various indicia of malware risk relating to the data item;
- collecting, by the proxy server, statistical information relating to previous malware detection results for the data item and/or the data source;
- and
- calculating, by the proxy server, based on the plurality of parameters and on the statistical information, an overall risk probability of whether the data item is infected with malware, wherein calculation of the overall risk probability is generally computationally easier than the at least one relatively computationally easy malware detection technique;
- selectively applying, by the proxy server, at least one malware detection technique from among the plurality of malware detection techniques based on the overall risk probability, wherein the at least one malware detection technique has a level of computational difficulty that generally corresponds to the overall risk probability;
- and
- analyzing, by the proxy server, the statistical information relating to the previous malware detection results for the data item and/or the data source and, if the statistical information meets predetermined confidence criteria, invoking at least one priority rule that forces a certain malware detection technique notwithstanding the overall risk probability.
5 more elements
A computer-implemented apparatus for facilitating data transfer over a network between a destination computer system and a data source, the apparatus comprising:
- means for performing a security evaluation on the data item according to selectable ones of a plurality of malware detection techniques, wherein the plurality of malware detection techniques include at least one technique which is relatively computationally easy, and at least one technique which is relatively computationally difficult;
- means for collecting a plurality of parameters that represent various indicia of malware risk relating to the data item;
- means for collecting statistical information relating to previous malware detection results for the data item and/or the data source;
- and
- means for calculating based on the plurality of parameters and on the statistical information, an overall risk probability of whether the data item is infected with malware, wherein calculation of the overall risk probability is computationally easier than the at least one relatively computationally easy malware detection technique;
- means for selectively applying at least one malware detection technique from among the plurality of malware detection techniques based on the overall risk probability, wherein the at least one malware detection technique has a level of computational difficulty that corresponds to the overall risk probability;
- and
- means for analyzing the statistical information relating to the previous malware detection results for the data item and/or the data source and, if the statistical information meets predetermined confidence criteria, invoking at least one priority rule that forces a certain malware detection technique notwithstanding the overall risk probability.
5 more elements
Dependencies are inferred from the claim text.