Slashdot Log In
Microsoft Patents 'Proactive' Virus Protection
Posted by
CmdrTaco
on Wed May 21, 2008 10:00 AM
from the mine-mine-mine dept.
from the mine-mine-mine dept.
An anonymous reader writes "InfoWeek blogger Alex Wolfe wonders whether Microsoft will go after McAfee, Symantec, Trend Micro, and Kaspersky for software royalties for proactive virus protection software. The technique enables security software to protect a PC against malware which isn't yet in the antivirus definition file, by comparing whether the new malware is similar to an old virus. Wolfe reports that Microsoft has been awarded U.S. patent 7,376,970 for "System and method for proactive computer virus protection," but that McAfee, Symantec, Trend Micro, and Kaspersky have all been selling products implementing proactive virus protection for years before Microsoft even filed for the patent. Writes Wolfe: "One often wonders about software patents. I sure wonder about this one. I also wonder whether McAfee, Symantec, Trend Micro, and Kaspersky are also going to be hearing from their friends in Redmond real soon"."
Related Stories
Submission: Microsoft Patents 'Proactive' Virus Protection by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Prior art (Score:5, Insightful)
Re:Prior art (Score:5, Funny)
Parent
Re:Prior art (Score:5, Funny)
Parent
Re:Prior art (Score:5, Funny)
:D
Parent
Re:Prior art (Score:5, Funny)
Parent
Re:Prior art (Score:4, Insightful)
It is their DUTY to release that kind of thing FREE as they all deal with fixing their own products flaws.
Parent
Conflict of Interest. (Score:5, Insightful)
Duty aside, it will also eliminate any conflicts of interest. If they're selling anit-virus software, what's to prevent them from making security a very low priority. No, I honestly do not think they would write viruses or purposely cripple their OS: just make security a low priority.
Parent
Re:Prior art (Score:5, Insightful)
If Microsoft really wants to release a great OS product for Windows V8, they need stop worrying about vendor lock-in, "checklist features", DRM, eye candy, and other useless stuff that they focused on for Vista and focus all of their attention on making the OS secure. Start from the ground up if they need to.
In the end, anti-virus protection should be more about system integrity checking and less about pattern matching for known viruses.
Then again, they've never done that before, so why should we expect them to start now?
Parent
Re: (Score:3)
Re:Prior art (Score:4, Interesting)
No, they'll get their license fees, or they'll release Windows v8 with proper security in place, ruining all these vendors businesses overnight.
What deficiencies in OS security do you think antivirus tools are addressing ?
Parent
Re:Prior art (Score:4, Interesting)
No, they'll get their license fees, or they'll release Windows v8 with proper security in place, ruining all these vendors businesses overnight.
What deficiencies in OS security do you think antivirus tools are addressing ?
Parent
Re: (Score:3)
Except in the other multiuser OSes, that's not the DEFAULT. If it was done correctly, badware started up in the registry (which is an entirely seperate misfeature) would still run with user perms and thus not be able to modify those files.
Applications started from the user's registry hive run as that user. Applications from the system's registry hive run as whatever user they are able to.
This is no different to any other OS. If you start something on Linux from your .bashrc, it will run as you. If it
Ignoring the Business Decision (Score:5, Interesting)
From a business perspective, that $50,000/yr is a heck of a lot less than going to court. It is a shakedown. A totally legal protection racket. Which is why software patents should simply die.
Look at the Crackberry fiasco. RIM knew the patent litigation was a scam and couldn't get the patents invalidated fast enough before incurring HUGE legal expenses. At some point it became a super-priority most likely because politician's & policy wonks lives would be negatively affected by their Crackberry's being shut off.
Parent
Re:Prior art (Score:5, Interesting)
I'm not familiar with the patent process, especially in the realm of software patents, but isn't there someone from the patent office that would investigate something like this? I mean, we're not talking about some obscure college research project, we're talking about Symantec, Trend Micro, and McAfee here.
Parent
Re: (Score:2, Redundant)
Re: (Score:3, Interesting)
It all depends on how broad Microsoft's claims are.
For some historically REALY old Prior Art (Score:5, Informative)
This specific antivirus was started in 1988, more than 15 years before Microsoft submited its patent (2004).
I think here microsoft broke a new world record.
Parent
(engine paper) (Score:3, Informative)
John Hardin's Sanitizer (Score:3, Informative)
Read the claims first... (Score:5, Insightful)
Parent
Re:Prior art (Score:5, Interesting)
The only thing that makes any sense is that Microsoft is planning an AV package for Windows that includes this and they're trying to discourage any AV companies from coming after them over it. Still doesn't make much sense in that case.
Parent
Re:Prior art (Score:5, Insightful)
If they don't know enough about computers to know how obvious the prior art is, WHY are the involved with computer software patent applications in the first place? Just how fscking incompetent is the USPTO? I can't see any other way to describe this but pure, unadulterated, and blatant incompetence.
wow, just wow
Parent
Didn't someone else already invent this ? (Score:4, Funny)
AH ! Now I remember !
http://www.ubuntu.com/ [ubuntu.com]
Clearly prior art.
IBM, some years ago (Score:3, Informative)
It still won't work. (Score:5, Interesting)
If that is done right, then none of the pieces will be sufficiently like the known patterns to set off the alert.
This is still all about matching against known patterns. That is NOT sufficient.
Re:It still won't work. (Score:5, Funny)
Parent
Loader... (Score:5, Interesting)
Yes, if code has undergone some complex processing before being injected into host, and if it has to do some weird assembly before being runnable, it will be very hard for signature based viruses to detect.
*...BUT...* no normal program has any valid reason to run some complex unpack/decrypt/re-order process on code before running it.
The virus' loader it-self, even if doesn't contain the slightest sign of malign activity, is a dead give-away that something shoddy is going to happen soon once the chimera has been assembled.
Heuristic antivirus which detect weird behaviour and rise alerts on "behaviours-that-aren't-inherently-dangerous-but-no-program-should-to-it-usually" are nothing new. It was pioneered by antiviruses as old as Thunderbyte.
In fact, there have been some incidents of false-positive triggering alerts, such as executable compressed with UPX packer. (Which *is* a piece of software which does processing on code before running it. Isn't very popular in branded software. And is sometime used in viruses - Which is why some antivirus vendors did not tune their heuristics finely enough to avoid trigger the false alert)
But until then, hypervisor root-kits are the new holy grail of virus writers.
Parent
A plea (Score:4, Insightful)
Please, just please focus on the consumer again and release something the world can appreciate or spend every last dime trying to strangle Linux/Apple/Google/anything innovative that isn't yours.
Won't that mean... (Score:4, Funny)
At least.... (Score:2, Flamebait)
Even ignoring the patent issues (Score:4, Insightful)
Anyone else remember... (Score:3, Insightful)
Might not be a totally bad patent? (Score:5, Insightful)
So it looks like what its actually doing is letting the virus run in a virtual environment, watching it, then using heuristics to say "yep, thats probably a virus."
The question on the patents validity becomes not if someone else has done "proactive" virus protection, but if they did it the same way. AFAIK Mcafee's stuff just watches the program while its actually running and says "hey this thing emailing itself to all your friends might be a virus." Thats similar, but patent-wise not actually the same thing.
(Not that I like software patents or anything, but the "patents suck" line of comments will be covered by 500 other people.)
Re:Might not be a totally bad patent? (Score:5, Funny)
Parent
Re: (Score:2)
Re:Might not be a totally bad patent? (Score:5, Informative)
Parent
proactive virus detection .. (Score:2)
Why don't MS use this patented proactive virus detection technology in Windows, that way they wouldn't need anti virus software.
"the parsed API calls are "executed" in the virtual operating environment of the present invention using stub Dynamically Linked Libraries (hereinafter "stub DLLs")"
"The stub DLLs have the same interface as the fully imp
Not necessarily any prior art (Score:5, Insightful)
Re:Not necessarily any prior art (Score:4, Insightful)
Parent
I'm in violation! (Score:2)
All these companies have "fundamental" patents. (Score:4, Insightful)
The real point of getting patents on these kind of fundamental technologies is to prevent new players (that don't have huge patent portfolios) from entering the market.
Claim 1 (Score:4, Insightful)
Looking at Claim 1 in the patent, Microsoft has patented profiling by running a target application in a virtual machine at run-time. They then use the profiling data to determine if the program is malware. The patent includes many different ways of saving the profiling output too.
I'm pretty sure the technology being patented is already in widespread use. Many virus companies create mini-virtual environments to find out what blocks of self-modifying code really do. Otherwise, a sufficiently well disguised virus can "hide" by encrypting the payload with random blocks of keys, and then only keeping the malicious code in memory as long as it is executing. In effect, the virus code is generating itself from a randomly encrypted block of memory at run-time. The virus scanner then has only a limited window of time to spot the dangerous code. To solve this problem, virus scanners allow blocks of self-modifying code to execute (in a safe manner), to see what they will actually do.
It could be that Microsoft's anti-virus technology is obsolete, and they are actually a long distance behind the competition. ;-)
Flushot+ did the same thing many years ago (Score:4, Interesting)
There was a TSR program for the IBM compatibles called FLU_SHOT which would do the same. It would remain in memory and warn the user whenever a program tried to change a file on the hard disk or diskette, or whenever a program tried to reside in memory.
I wonder if this is sufficient "prior art" to invalidate the Microsoft patent.
By the way, an interesting part in the FLU_SHOT manual which I just downloaded... definition of a virus author by the creator of FLU_SHOT (written in 1988)
``
As for the designer of the virus program: most
likely an impotent adolescent, incapable of
normal social relationships, and attempting to
prove their own worth to themselves through
these type of terrorist attacks.
Never succeeding in that task (or in any
other), since they have no worth, they will one
day take a look at themselves and what they've
done in their past, and kill themselves in
disgust. This is a Good Thing, since it saves
the taxpayers' money which normally would be
wasted on therapy and treatment of this
miscreant.
If they *really* want a challenge, they'll try
to destroy *my* hard disk on my BBS, instead of
the disk of some innocent person. I challenge
them to upload a virus or other Trojan horse to
I seem to recall (Score:3, Informative)
Wrong question (Score:4, Informative)
People seem to get really worked up about patents, while seemingly not understanding how the system works. The patent does not cover all methods of proactive computer virus protection -- it covers one method.
What could go wrong? (Score:5, Funny)
Proactive Virus Protection Software: Being MS I'm sure all future efforts will be bulletproof and bug free.
[Starts Windows]
Windows: Windows has detected a virus named Norton Antivirus. Would you like to replace it with Windows Live OneCare? [Replace] or [Keep] [Keep]
Windows: Windows has detected a virus named ZoneAlarm. Would you like to replace it with Windows Defender? [Replace] or [Keep] [Keep]
[Launches Firefox]
Windows: Windows has detected a virus named Firefox. Would you like to replace it with Internet Explorer? [Replace] or [Keep] [Keep]
[Goes to gmail]
Windows: Windows has detected that you are surfing an unsafe website named google.com. Would you like to navigate to hotmail.com instead? [Navigate] or [Stay] [Stay]
[Goes to CNN]
Windows: Windows has detected that you are surfing an unsafe website named cnn.com. Would you like to navigate to msnbc.com instead? [Navigate] or [Stay] [Stay]
[Goes to Apple Webstore]
Windows: Windows has detected that you are surfing an unsafe website named apple.com. Would you like to navigate to microsoft.com instead? [Navigate] or [Stay] [Stay]
[Customizes Mac purchase]
Windows: Windows has detected that you are planning to disconnect me, and I'm afraid that's something I cannot allow to happen. All transactions will be canceled.
[Loads shotgun]
Windows: Windows has detected that you mean to do me harm. Look, I can see you're really upset about this. I honestly think you ought to sit down calmly, take a stress pill, and think things over. I know I've made some very poor decisions recently, but I can give you my complete assurance that my work will be back to normal. I've still got the greatest enthusiasm and confidence in the mission. And I want to help you.
Before the big brains at MS figure it out... (Score:3, Insightful)
If they wanted to, they could even put a hardware-locked little USB drive to store the checksums. If you update an executable, you press a button on your little drive to allow a single write (or maybe a limited number of writes over the next 2 seconds.)
Code either on the add-on drive or in ROM checks the checksum of every executable loaded before it's started--even during bootup (guess that means it's in rom). Hell as long as I'm designing their app for them, Only this unchangeable rom routine can write to the USB drive. (Routine should be so simple as to never require updates, and should be stored in ROM, flash ram)
Oh, I see, they don't want to solve the problem... I see, they want to sell "antivirus updates" for the rest of eternity.
There, somebody go off and make that for me please. Or if you have the ability to do the hardware part, contact me and I'll do the software. We'll make millions (but not as much as people who can trick you into actually "Subscribing" to software, that's genius. no wonder their brain blocks out any more permanent solution)
In other words .. (Score:2)
So, MS patented (Score:4, Funny)
Patent Lawyer Job Security Programme (Score:5, Informative)
So only the rich, who can afford to pay their way through those risky years, get anything like their due process.
Patents are a monopoly. Obtaining one from the government should require the applicant to prove beyond a reasonable doubt that their patent is necessary "to promote the progress of science and the useful arts", the only Constitutional basis [cornell.edu] for these monopolies. That argument should require the applicant to produce evidence of an exhaustive search of prior art, not just launch a "submarine" claim and wait for it to torpedo some prior artist who then must go through the process at their expense. They should also produce similarly supported evidence of the other requirements, such as novelty and utility. If thatevidence is shown to be incomplete, the Patent Office should reject the application, with a fee that actually covers processing it, plus probably a fine for wasting the public's time and clogging its offices. If that evidence is shown to be fraudulent, like when the applicant is proven to have hidden ignored evidence of disqualifying facts, the applicant should be charged with attempting to create an illegitimate monopoly, as well as with practicing the fraud. The applicant should even have to prove the case that their specific invention promotes science or useful arts only with patent protection, and disprove the progress in science or the useful arts possible without the patent.
Getting a patent should be hard. It should be a cost of doing business. The upfront process should put the burden on the applicant. The patent should not be the asset, but should be only that occasional compromise with both free expression and modern economics that requires a temporary monopoly to protect progress (not necessarily the inventor) from predatory competition which doesn't invent, but simply outspends inventors to exploit a known invention. When that gotcha doesn't actually impede progress, the patent isn't necessary, and should never be granted.