Network traffic management by a virus/worm monitor in a distributed network

Abstract

A network level virus monitoring system capable of monitoring a flow of network traffic in any of a number of inspection modes depending upon the particular needs of a system administrator. The system includes a network virus sensor self registration module coupled to a network virus / worm sensor arranged to automatically self register the associated network virus / worm sensor. The monitoring provides an early warning of a virus attack thereby facilitating quarantine procedures directed at containing a virus outbreak. By providing such an early warning, the network virus monitor reduces the number of computers ultimately affected by the virus attack resulting in a concomitant reduction in both the cost of repair to the system and the amount of downtime. In this way, the inventive network virus monitor provides a great improvement in system uptime and reduction in system losses.

Description

CROSS REFERENCE TO RELATED APPLICATIONS [0001] This application takes priority under 35 U.S.C. §119(e) of U.S. patent application Ser. No. 60 / 481,313 filed Aug. 29, 2003 (Attorney Docket No.: TRNDP009P) naming Liang et al. as inventor(s) entitled “VIRUS MONITOR AND METHODS OF USE THEREOF” which is also incorporated herein by reference for all purposes. This application is also related to the following co-pending U.S. patent applications, which are filed concurrently with this application and each of which are herein incorporated by reference, (i) U.S. patent application Ser. No. ______ (Attorney Docket No.: TRNDP009), entitled “VIRUS MONITOR AND METHODS OF USE THEREOF” naming Liang et al as inventors; (ii) U.S. patent application Ser. No. ______ (Attorney Docket No.: TRNDP101), entitled “AUTOMATIC REGISTRATION OF A VIRUS / WORM MONITOR IN A DISTRIBUTED NETWORK” naming Liang et al as inventors; (iii) U.S. patent application Ser. No. ______, (Attorney Docket No.: TRNDP014), entitled “NE...

AI Technical Summary

Problems solved by technology

However, there exists a class of executable code that, if downloaded and executed at host computers, may wreak havoc with the operating system, the hardware, and / or other software of the host computers.

A computer virus is a piece of programming code usually disguised as something else that causes some unexpected and usually undesirable event (for the victim).

Some viruses can be quite harmful, causing a hard disk to require reformatting or clogging networks with unnecessary traffic.

Therefore, it is common for worms to be noticed only when their uncontrolled replication consumes system resources, slowing or halting other tasks.

Even in the case of corporate networks that are closely guarded by an anti-virus firewall and various other virus protection software and protocols, some viruses still manage to penetrate and infect the network resulting in substantial harm since conventional anti-virus technology generally relies on already identified viruses.

In particular, conventional anti-virus protection is usually effective against known computer viruses, but may be ineffective in blocking unknown viruses.

Therefore, terminal devices such as computers connected to a local area network (LAN) or wide area network (WAN) are generally unable to include effective anti-virus protection against unknown viruses using conventional anti-virus software.

If the alert level is set too low, it may invite an erroneous determination of a computer virus such that benign applications are deemed viral by mistake.

Images