Slashdot Mirror
Symantec Patents Multiple File Area Virus Scanning
DigitumDei writes "Symantec announced on Wednesday that it has aquired a new patent (United States Patent - 6,851,057) titled "Data driven detection of viruses". Symantec has declined to comment on whether it will pursue litigation. Symantec's director of intellectual property Michael Schallop stated : 'We don't generally discuss how we will leverage this patent against competitors or others,'." From the article: "[The patent] could refer to any technology that allows antivirus researchers or antivirus products to use scripting to determine, dynamically, where in a file to scan and detect threats. It could also include the use of Javascript or other common scripting languages to direct antivirus scanning..."
before anyone starts frothing at the mouth and gives the usual /. response of "What? Someone got a patent? Kill! Kill! Kill!", please read claims 1, 8 and 14 (the independent claims).
Similar to the upcoming US election results
Are you kidding?
Exactly what part of this is 'non-obvious to a skilled practitioner'? I only dabble-part time in AV research and am certainly not a highly recognized researcher in the field, and it is still pretty darn obvious to me. Heck, I've written my own scripting engines around multiple anti-virus engines to scan files. First, I'm quite sure somebody's done this before Symantec, and secondly, it shouldn't even matter since this fails the non-obvious test.
What will it take to shake the USPTO awake? It is NOT the courts place to decide (after expensive litigation) that patents are overly broad.
Um, despite /. hyperbole, a lot of patents do get completely rejected until the prosecution runs out. Even if they are granted, the claims tend to get whittled down a lot during prosecution.
As for small developers, it is possible to file under "small entity" status, which is cheaper. The most expensive part of getting a patent is the fees for the patent attorneys.
Similar to the upcoming US election results
Could someone give better summary claim by claim?
I'll provide the claims here to give a starting point. Let's try to actually see what's getting patented here and whether or not it really is novel.
Actually, I take my previous comment back. This ~is~ a reasonable patent for Symantec. Go and actually read it. In it's entirety, it probably is non-obvious, and is a reasonable patent, though nothing particularly stellar.
It's especially not a problem because working around it doesn't look hard at all. You can do everything they do in the patent, for example, ommitting any intermediary code (P-Code), and you apparently wouldn't be violating it.
For that matter; the patent's main application is for files with multiple entry points and scanning specifically for polymorphic viruses using a scripting engine capable of handling different pieces of code off to different analysis engines and passing things around.
Again, not exactly brilliant, but probably a reasonable patent; also because it's probably not hard to code around.
you mean something like clamAV?
You did fine. The days when "Norton" products were any good are long past by. They seem to have him stuffed in position with arms crossed for the photos alone these days.
I would reccomend Avast! antivirus - uses a fraction of the resources of NAV200x, and works quite better too, IMHO. The difference in performance after replacing NAV for A! on my mother's PC was ridiculous.
Not only that, registration is free for personal use.
If your closed-source program acts an awful lot like it infringed a patent you could be taken to court for patent violation (maybe after you refuse offer to license said patent) and forced to reveal source code.
Some patents are move obvious than others (e.g. dealing with file formats).
Patent owners might quietly reverse engineer a program and have a look to be sure their suit suceeds, but aren't going to admit it (and it would be hard for the defence to prove it).
First, the person who wrote the text should be shot... it's worded to be as confusing as possible, so that even an expert in the field can't readily tell what is being covered in the patent.
Next, from what I can tell, the patent seems to cover 3 main points (in various flavors, to come up with their 20 points): All of these points were done years ago. The first two points were "state of the art" as of 1990. The product I worked on (name withheld for various reasons. Sorry about that...) was, at the time, unlike the other virus scanners out there. It used "precision scanning" in which the nature of the virus being scanned for was taken into account, and was scanned for ONLY AT THE LOCATION AT WHICH THE INFECTION WOULD OCCUR. This was a major differentiation from the "bulk scanners" (i.e. run the entire file through a string filter that contains all virus signatures, and see if there are any matches. As a trivia note, "bulk scanners" are why all anti-virus scanners use encrypted (in some trivial way) virus signatures -- so that a virus scanner would not be identified as an infected file by another virus scanner, or even by itself!) that all other major anti-virus vendors used.
Also, the virus scanner I wrote included a scripting language so that users could add their own virus scan and remove definitions.
As for emulating a virus target and seeing if the virus "bites", that is also old hat. While a commercial product was never introduced, a lab prototype was publically demonstrated in 1996, in which files under examination were interpreted in a virtual 80x86 environment, including OS and file system, both to see if they did anything suspicious, and to see if they "tagged along" on "provocative" system calls.
And, yes, I still have my old code sitting around. It would be a pity if someone suddenly showed it to Symantec or the patent office...