Trend Micro Inc.

Yung-Chang Liang

Yi-Fen Chen

Eva Y Chen

En-Yi Liao

Shuang Ji

Steven Yuen-Lam Lau

Said Kaki

Warren Tsai

A machine in the form of a computer is configured to run virtual machines. A virtual machine migrated from another computer is run in the computer. A security profile of the migrated virtual machine in the computer indicates a configuration setting of another network component in another computer network. A network profile in the computer indicates a configuration setting of a network component in the current computer network. The security profile of the migrated virtual machine is automatically updated to reflect the configuration setting of the network component in the current computer network to provide computer security function in the current computer network.

Migration of computer security modules in a virtual machine environment

In one embodiment, a network security appliance includes a logic circuit, a network processing unit, and a general purpose processor to protect a computer network from malicious codes, unauthorized data packets, and other network security threats. The logic circuit may include one or more programmable logic devices configured to scan incoming data packets at different layers of a multi-layer protocol, such as the OSI-seven layer model. The network processing unit may work in conjunction with the logic circuit to perform protocol parsing, to form higher layer data units from the data packets, and other network communications-related tasks. The general purpose processor may execute software for performing functions not available from the logic circuit or the network processing unit. For example, the general purpose processor may remove malicious code from infected data or perform malicious code scanning on data when the logic circuit is not configured to do so.

Method and apparatus for securing a computer network by multi-layer protocol scanning

In one embodiment, a technique for controlling traffic in a computer network includes modifying a packet generated by a first computer. The packet may be intended for a second computer, but is modified to be redirected to a third computer. The packet may be processed in the third computer prior to being forwarded from the third computer to the second computer. The packet may be scanned for viruses at the third computer, for example. Among other advantages, the technique allows for scanning of early generated packets, redirection of selected packets, and routing of packets from a computer in general.

Method and apparatus for controlling traffic in a computer network

The iterative detection and treatment of viruses using virus detection objects and virus treatment objects is disclosed. Pursuant to a request for a virus scan, a virus detection object is produced by a server and is transmitted to a client for execution. The client receives and executes the virus detection object, and the results are transmitted to the server. The server uses the results to produce an additional virus detection object which is also transmitted to the client and executed so that the results can be transmitted to the server. The iterative production and execution of virus detection objects is continued until a determination is made as to whether the targeted file or data includes a virus. Upon a determination that a targeted file or data includes a virus, a vaccine specifically tailored to the conditions presented at the client and the type of virus detected is produced, preferably in the form of a virus treatment object. The request for a virus scan can be directly made or indirectly by a triggering event. One virus detection server embodiment includes a virus information expert system that applies conditional data to predetermined knowledge about virus scanning to make determinations such as when to scan for viruses. A network diagnosis and treatment application includes a diagnostic data module, an expert system, and a maintenance requesting module. The expert system applies the diagnostic data to predetermined knowledge about the diagnosis and maintenance of a network to make determinations upon which maintenance requests are made. Preferably, the expert system includes a virus information expert system.

Event triggered iterative virus detection

The detection and elimination of viruses on a computer network is disclosed. An apparatus for detecting and eliminating viruses which may be introduced by messages sent through a postal node of a network electronic mail system includes polling and retrieval modules in communication with the postal node to determine the presence of unscanned messages and to download data associated with them to a node for treatment by a virus analysis and treatment module. A method for detecting and eliminating viruses introduced by an electronic mail system includes polling the postal node for unscanned messages, downloading the messages into a memory of a node, and performing virus detection and analysis at the node.

Growing community of inventors

Cupertino, CA, United States of America

Yung-Chang Liang