WO2002042879A2

WO2002042879A2 - System and method for virus protection in real-time media

Info

Publication number: WO2002042879A2
Application number: PCT/US2001/045125
Authority: WO
Inventors: Don Pacholec; Sanjeev Kumar
Original assignee: Portal Player, Inc.
Priority date: 2000-10-27
Filing date: 2001-10-24
Publication date: 2002-05-30
Also published as: WO2002042879A3; AU2002241543A1

Abstract

A system (40) and method for real time virus protection of media (22) data.

Description

SYSTEM AND METHOD FOR VIRUS PROTECTION IN REAL-TIME MEDIA

The present invention relates to streaming media, and more specifically to a system and method for protecting against inadvertent transmission of viruses in such media.

BACKGROUND OF THE INVENTION

Internet streaming media has revolutionized the way information is transmitted and viewed. Traditionally, information had been transmitted as static text and graphics. With the advance of streaming media, information can now be transmitted as a multimedia experience populated by sound and moving pictures. Streaming media has become the de- facto global media broadcasting and distribution standard, incorporating all other media, including television, radio, and film.

Streaming information across the Internet can be accomplished, for example, by compressing a digital file, such as video or audio, and segmenting the compressed file into small packets, which are transmitted, one after another, over the Internet. When the packets reach their destination (a requesting user's computer), they are decompressed and reassembled into a form that can be recognized by the user's computer system. To maintain the illusion of seamless play, the transmitted packets are ordinarily "buffered" so that a certain number of packets are downloaded to the user's computer system prior to execution. Thus, while the downloading continues, the buffered packets may be played. As those buffered or preloaded packets are executed, more packets are downloaded and queued for execution accordingly.

Various protocols have been developed for streaming information across the Internet. For example, the User Datagram Protocol (UDP) allows data to be transmitted efficiently from a host server to a client system, and advanced encoding techniques allow compression of streamed files into extremely small packets of data. More recent protocols such as the RealTime Streaming Protocol (RTSP) are making the transmission of data even more efficient.

UDP and RTSP, for example, are ideal for audio and video broadcasting since they place a higher priority on continuous streaming than on absolute document integrity. Unlike TCP and HTTP transmission, when a UDP packet is dropped, the server continues sending information. TCP, in contrast, continues attempting to resend the lost packet before sending any further packets. Because streaming media generally requires a continuous transmission of information, protocols such as UDP and RTSP are ideal.

Regardless of the advances in UDP and RTSP transmission protocols, streaming media would not be possible without the rapid innovation in encoding algorithms or codecs that compress and decompress audio and video data. Unfortunately, standard modem connections, such as cable modems and xDSL modems, do not ordinarily have the capacity to deliver pure, uncompressed audio and/or video over the Internet. In order to stream information across the limited bandwidth of the Internet, as described above, the audio and/or video information needs to be compressed and optimized with various codecs (compression-decompression encoding algorithms).

Compression schemes can be classified as "lossy" or "lossless." Lossy compression schemes reduce file size by discarding some amount of data during the encoding process before it is transmitted over the Internet. Once the information is received on the client side, the codec attempts to reconstruct the information that was lost or discarded. The benefit to this sort of compression lies in the smaller file size that results from discarding the "lost" information. In contrast, lossless compression squeezes data into smaller packets of information without permanently discarding any of the data. Instead of permanently discarding information, for example, lossless compression discards it temporarily but provides a "map" with which the codec can reconstruct the original file. Both "lossy" and "lossless" compression may be used by various streaming protocols.

Due to the electronic nature of the Internet, data is often prone to attack from computer viruses. A computer virus is essentially a program or piece of code loaded onto a computer, usually subversively, which executes and corrupts various files on the computer. Unfortunately, most viruses can also replicate themselves by effectively causing their transmission to other computers, thereby resulting in a significant large-scale corruption of numerous computer systems. With the large amount of information being transmitted to client computers during a streaming data session, the chance that a virus may be transmitted to a client computer during a communications session is significantly increased.

Conventional virus protection software and or hardware solutions have been developed to help protect against the transmission of such viruses. Unfortunately, existing hardware and/or software solutions do not detect real-time audio or video stream virus infections that can cripple a computer system. The existing systems also do not detect viruses in streaming files that are downloaded and then later played, in fake MP3 files and in MP3 files that actually contain viruses. Thus, there is a need for a system and method that affords protection against real-time audio and/or video stream virus infections. It is to this end that the present invention is directed. SUMMARY OF THE INVENTION

The present invention affords a system and method for detecting real-time video and audio stream virus infections. The system may receive particular data format streams, such as MPEG1, MPEG2, MPEG4, or other such data streams, and scan the stream to detect virus infection therein. If a virus infection is detected by the system while scanning the stream, the system may clean the infected stream and consequently deliver the cleaned data stream to a destination site, such as computers, cellular telephones, VOIP devices, IP-based video applications, portable content devices, and the like.

BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 is a diagram illustrating a system for detecting real-time video and audio stream virus infection in accordance with the invention;

Fig. 2 is a block diagram depicting a preferred operation of the virus detection software application module shown in Fig. 1 for detecting real-time video stream virus infection in accordance with the invention; and Fig. 3 is a block diagram depicting a preferred operation of the virus detection software application module shown in Fig. 1 for detecting real-time audio stream virus infection in accordance with the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT Fig. 1 is a diagram illustrating a system for detecting real-time video and audio stream virus infection in accordance with the invention. As shown in Fig. 1, the system 10 may include a server 12 connected with one or more client computer systems 14 across a data network 16, such as a wide area network (WAN) 16, the Internet, or more particularly, the World Wide Web. It should be noted that while the invention is described as being provided over the World Wide Web, it may also be provided over a local area network, such as an intranet, and other network structures. Although the preferred embodiment is described with reference to streaming audio and video data, the invention may also be used to detect and clean viruses from streaming data that is downloaded and then later played by a user, from fake MP3 files and from MP3 files that contain a virus. The server 12 may include a software application 18 for streaming media files to the one or more client computer systems 14 in the network 16. The software application 18 may be executed by a CPU 20 resident in the server 12. The software application 18 will be described in more detail below. A database 22 may be associated with the server 12 for storing multimedia information, such as audio and video files.

The client computer systems 14 may include a display device 24, a CPU unit 26, one or more user input/output devices, such as a mouse 28 and a keyboard 30 and may be configured to communicate with the server 12 over the WAN 16. The CPU unit 26 may house a permanent storage system 32, such as a hard disk drive, optical disk drive, tape drive, or the like, which may store one or more software applications such as a web browser application. The computer system 14 may have a resident memory 34, such as DRAM, and the software application from the disk 32 may be transferred to the memory 34 to be executed by a CPU 36 in the computer system 14. A browser application may connect the computer system 14 to the server 12 over the WAN 16 and receive data and graphical information (such as web pages, reports, etc.) that may be displayed on the display device 24 of the computer system 14. The browser application may also permit the computer system 14 to interact with the server 12, such as for receiving audio and video streaming multimedia files from the server 12. The client computer system 14 may also include a software application 38 (which may or may not be integrated with the browser application) for decompressing, virus scanning, and executing streaming multimedia files transmitted from the server 12.

The software application 18 on the server 12 permits the transmission of streaming audio and/or video multimedia files to client computer systems 14. The software application 18 contains program code for causing the server 12 to compress a digital multimedia file, such as video or audio, and to segment the compressed file into small packets. The software application 18 program code also causes the server 12 to initiate a communications session with the client computer system 14 and to transmit the segmented data packets, one after another, thereto over the data network 16. When the data packets reach their destination (a requesting computer system 14), the software application 38 program code therein causes the computer system 14 to decompress and reassemble the data packets into a form that can be recognized and executed by the computer system 14. To maintain the illusion of seamless play, transmitted the packets are ordinarily "buffered" in the computer's memory 32 so that a certain number of data packets are downloaded to the computer system 14 prior to execution. As those buffered or preloaded packets are executed by the computer system 14, more packets are downloaded and queued for execution accordingly. As described above, the server 12 may include a software application 18 for streaming multimedia information to the client computer systems 14. The software application 18 may include an application module 40 for detecting in real-time audio and/or video stream virus infection in accordance with the invention. Fig. 2 is a block diagram depicting a preferred operation of the virus detection software module 40. As shown in Fig. 2, a video format stream, such as MPEG 1 , MPEG2, MPEG4, MPEG7, or other like video transmission protocol may be received from the database 22 by the server 12. When retrieved, the virus detection software application module 40 of the software application 18 may scan the retrieved video data stream for infection occurrences within the video data stream. Preferably, the module 40 may scan the video data stream in real-time. In accordance with the invention, the module 40 may, upon locating an infected data stream, automatically clean the infected data stream at the server 12 before transmission of the data stream to the client 14, and cause the server 12 to transmit a clean data stream to the client computer systems 14.

To detect the viruses, the server may store a virus signature file that may be periodically updated. When a file is downloaded from the server or streamed through the server, the file is checked against the virus signature file to detect any viruses. If a virus is detected, then the virus is cleaned from the file as it is being streamed or downloaded to the remote site. Thus, any file from the server is cleaned as it is being downloaded or streamed to the remote site. The software application module 40 described above may also enable virus infection detection for streaming audio as well as streaming video information. Fig. 3 is a block diagram depicting a preferred operation of the virus detection software module 40 as relating to streaming audio. As shown in Fig. 3, an audio format stream, such as MPEG1, MPEG2, MPEG4, or other like audio transmission protocol may be received from the database 22 by the server 12. When retrieved, the virus detection software application module 40 of the software application 18 may scan the retrieved audio data stream for infection occurrences within the audio data stream. Preferably, the module 40 may scan the audio data stream in real-time. In accordance with the invention, the module 40 may, upon locating an infected data stream, automatically clean the infected data stream at the server 12 before transmission of the data stream to the client 14, and cause the server 12 to transmit a clean data stream to the client computer systems 14. To detect the viruses, the server may store a virus signature file that may be periodically updated. When a file is downloaded from the server or streamed through the server, the file is checked against the virus signature file to detect any viruses. If a virus is detected, then the virus is cleaned from the file as it is being streamed or downloaded to the remote site. Thus, any file from the server is cleaned as it is being downloaded or streamed to the remote site.

Advantageously, the present invention provides bi-directional protection to the video and/or audio data streams by protecting the stream at both the input side (uploaded to server) and the output side (downloaded to a client computer system). Additionally, the present invention ensures very highly reliable delivery of audio and/or video content to all forms of consumer devices, such as cellular telephones, video over Internet Protocol devices, IP-based video applications, and portable content devices, etc.

While the foregoing has been described with reference to particular embodiments of the invention, such as a system and method for detecting real-time based audio/video virus infection, the invention is not limited to such embodiments and may be applicable to any system capable of performing the described advantages. It will be appreciated by those skilled in the art that changes in these embodiments may be made without departing from the principles and spirit of the invention.

Claims

CLAIMS:

1. A system for detecting and cleaning viruses in a file located on a server computer, comprising: a signature file resident at the server; means, at the server, for scanning a file, that is received by the server or downloaded from the server, using the signature file to detect a virus; means, at the server, for cleaning the detected virus from the file to be downloaded; and means for downloading the cleaned file to the client computer.

2. The system of Claim 1, wherein the file comprises an audio file being streamed from the server computer to the client computer.

3. The system of Claim 1, wherein the file comprises a video file being streamed from the server computer to the client computer.

4. The system of Claim 1, wherein the file comprises a fake MP3 file containing a virus.

5. The system of Claim 1, wherein the file comprises a MP3 file containing a virus.

6. A method for detecting and cleaning viruses in a file located on a server computer, comprising: scanning a file, that is received by the server or downloaded from the server, using a signature file to detect a virus; cleaning the detected virus at the server from the file to be downloaded; and downloading the cleaned file to the client computer.

7. The method of Claim 6, wherein the file comprises an audio file being streamed from the server computer to the client computer.

8. The method of Claim 6, wherein the file comprises a video file being streamed from the server computer to the client computer.

9. The method of Claim 6, wherein the file comprises a fake MP3 file containing a virus.

10. The method of Claim 6, wherein the file comprises a MP3 file containing a virus.