Symantec Patents Multiple File Area Virus Scanning

DigitumDei writes "Symantec announced on Wednesday that it has aquired a new patent (United States Patent - 6,851,057) titled "Data driven detection of viruses". Symantec has declined to comment on whether it will pursue litigation. Symantec's director of intellectual property Michael Schallop stated : 'We don't generally discuss how we will leverage this patent against competitors or others,'." From the article: "[The patent] could refer to any technology that allows antivirus researchers or antivirus products to use scripting to determine, dynamically, where in a file to scan and detect threats. It could also include the use of Javascript or other common scripting languages to direct antivirus scanning..."

Comments

Please...

[Foobar of Borg]

before anyone starts frothing at the mouth and gives the usual /. response of "What? Someone got a patent? Kill! Kill! Kill!", please read claims 1, 8 and 14 (the independent claims).

Claim by Claim analysis?

[SuperficialRhyme]

I'm not an antivirus software developer so I really don't know what exactly these claims are referring to. The background of the patent helps a bit, but it seems to me that the patent refers to a program which uses an emulator to catch the point where a program's code being passed off to viral code.

Could someone give better summary claim by claim?

I'll provide the claims here to give a starting point. Let's try to actually see what's getting patented here and whether or not it really is novel.

I claim:

1. A virus detection system for detecting if a computer file is infected by a virus, the file having a plurality of potential virus entry points, the system comprising:

an engine for controlling operation of the virus detection system responsive to instructions stored in an intermediate language, the instructions adapted to examine the plurality of potential virus entry points and post for emulating ones of the plurality of potential virus entry points exhibiting characteristics indicating a possible virus;

an emulating module coupled to the engine for emulating the posted entry points of the file in a virtual memory responsive to the engine, wherein the virus may become apparent during the emulation of an entry points of the file infected by the virus; and

a scanning module coupled to the engine for scanning regions of the virtual memory for a signature of the virus responsive to the engine and the emulating module, wherein presence of the virus signature in a scanned region indicates that the file is infected by the virus.

2. The virus detection system of claim 1, further comprising:

a custom module coupled to the engine for executing custom virus-detection code responsive to invocation by the engine.

3. The virus detection system of claim 1, wherein the intermediate language is P-code and the engine comprises:

a P-code interpreter for interpreting the P-code and controlling the operation of the virus detection system responsive thereto.

4. The virus detection system of claim 3, wherein the engine further comprises:

primitives for performing operations with respect to the file and the virtual memory responsive to invocations of the primitives by the P-code.

5. The virus detection system of claim 1, further comprising:

a virus definition file coupled to the scanning module for holding virus signatures for use by the scanning module.

6. The virus detection system of claim 1, wherein the instructions stored in the intermediate language post regions of the file for scanning by the scanning module.

7. The virus detection system of claim 6, wherein postings identifying overlapping regions are merged into a single posting identifying the regions of the merged postings.

8. A method for detecting a virus in a computer file, the file having a plurality of potential virus entry points, the method comprising the steps of:

executing instructions stored in an intermediate language representation, the instructions performing the steps of:

examining regions of the file for possible infection by viruses and posting for scanning any regions exhibiting characteristics indicating a possible virus infection;

examining the plurality of potential virus entry points of the file for possible infections by viruses and posting for emulating ones of the plurality of potential virus entry points exhibiting characteristics indicating a possible virus infection; and

examining the posted regions of the file to algorithmically determine whether the file is infected with a virus.

9. The method of claim 8, wherein the instructions further perform the steps of:

merging overlapping regions posted for scanning.

10. The method of claim 8, wherein the instructions further perform the step of:

calling a custom executable program to determine when the file is infected with a virus.

11. The method of claim 8, further comprisi

Lots of prior art on this patent

[oldfogie]

FWIW, I am an (ex-)anti-virus author, and I actually looked at this patent.

First, the person who wrote the text should be shot... it's worded to be as confusing as possible, so that even an expert in the field can't readily tell what is being covered in the patent.

Next, from what I can tell, the patent seems to cover 3 main points (in various flavors, to come up with their 20 points):

1) We don't just scan for strings, we take into consieration what sort of virus it might be, and only scan in the appropriate place.

2) We have a "scripting language" that can direct the virus scan.

3) We can emulate a "virus target" and see if the virus goes for it.

All of these points were done years ago. The first two points were "state of the art" as of 1990. The product I worked on (name withheld for various reasons. Sorry about that...) was, at the time, unlike the other virus scanners out there. It used "precision scanning" in which the nature of the virus being scanned for was taken into account, and was scanned for ONLY AT THE LOCATION AT WHICH THE INFECTION WOULD OCCUR. This was a major differentiation from the "bulk scanners" (i.e. run the entire file through a string filter that contains all virus signatures, and see if there are any matches. As a trivia note, "bulk scanners" are why all anti-virus scanners use encrypted (in some trivial way) virus signatures -- so that a virus scanner would not be identified as an infected file by another virus scanner, or even by itself!) that all other major anti-virus vendors used.

Also, the virus scanner I wrote included a scripting language so that users could add their own virus scan and remove definitions.

As for emulating a virus target and seeing if the virus "bites", that is also old hat. While a commercial product was never introduced, a lab prototype was publically demonstrated in 1996, in which files under examination were interpreted in a virtual 80x86 environment, including OS and file system, both to see if they did anything suspicious, and to see if they "tagged along" on "provocative" system calls.

And, yes, I still have my old code sitting around. It would be a pity if someone suddenly showed it to Symantec or the patent office...