Abstract:
A technique is disclosed for tracking a virus. For each of at least a subset of received network packets it is determined whether the packet comprises an open packet. Information usable to determine a sender of the packet in the event the a virus associated with a network transmission with which the packet is associated is determined to have been received is copied from each packet determined to be an open packet, but not from at least a subset of packets not determined to be open packets.

Description:
CROSS REFERENCE TO OTHER APPLICATIONS 
       [0001]    This application is a continuation of co-pending U.S. patent application Ser. No. 10/715,346 entitled TRACKING COMPUTER INFECTIONS filed Nov. 17, 2003, which is incorporated herein by reference for all purposes. 
     
    
     FIELD OF THE INVENTION 
       [0002]    The present invention relates generally to computer systems. More specifically, a technique for tracking computer infections is disclosed. 
       BACKGROUND OF THE INVENTION 
       [0003]    Computer viruses are a significant threat to network environments. System administrators of networks often find it challenging to rapidly respond to such a threat to the network. For example, although a single infected computer may be purged of the virus, a system administrator may find that the computer virus may infect various computers in the network for an extended period of time so long as there remains at least one infected computer in the network. In the meantime, the system administrator is often required to try to track down the virus to determine which computer in the network is repeatedly infecting and clogging up the network. This process is typically time consuming and expensive. 
         [0004]    What is needed is a technique for tracking computer infections. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0005]    Various embodiments of the invention are disclosed in the following detailed description and the accompanying drawings. 
           [0006]      FIG. 1  is a bock diagram of a technique for tracking a computer infection according to an embodiment of the present invention. 
           [0007]      FIG. 2  is a flow diagram of a technique according to an embodiment of the present invention for tracking a computer infection. 
           [0008]      FIG. 3  shows an example of an SMB open packet which can be used with some embodiments. 
           [0009]      FIG. 4  shows an example of an FTP open packet which can be used with some embodiments. 
       
    
    
     DETAILED DESCRIPTION 
       [0010]    The invention can be implemented in numerous ways, including as a process; an apparatus; a system; a composition of matter; a computer program product embodied on a computer readable storage medium; and/or a processor, such as a processor configured to execute instructions stored on and/or provided by a memory coupled to the processor. In this specification, these implementations, or any other form that the invention may take, may be referred to as techniques. In general, the order of the steps of disclosed processes may be altered within the scope of the invention. Unless stated otherwise, a component such as a processor or a memory described as being configured to perform a task may be implemented as a general component that is temporarily configured to perform the task at a given time or a specific component that is manufactured to perform the task. As used herein, the term ‘processor’ refers to one or more devices, circuits, and/or processing cores configured to process data, such as computer program instructions. 
         [0011]    A detailed description of one or more embodiments of the invention is provided below along with accompanying figures that illustrate the principles of the invention. The invention is described in connection with such embodiments, but the invention is not limited to any embodiment. The scope of the invention is limited only by the claims and the invention encompasses numerous alternatives, modifications and equivalents. Numerous specific details are set forth in the following description in order to provide a thorough understanding of the invention. These details are provided for the purpose of example and the invention may be practiced according to the claims without some or all of these specific details. For the purpose of clarity, technical material that is known in the technical fields related to the invention has not been described in detail so that the invention is not unnecessarily obscured. 
         [0012]      FIG. 1  is a block diagram of a technique for tracking a computer infection according to an embodiment of the present invention. A computer infection, as used herein, includes viruses, worms, and any combination or variant thereof, and any unwanted program that installs on the computer without the user&#39;s knowledge or permission. In this example, a computer  100  is shown to include an operating system  102 , file system drivers  104 , and anti-virus program  106 , network drivers  108 , a firewall  110 , a light weight proxy  112 , a program that can receive a file  114 , hard drives and other mass storage  118 , and network interface cards  120 . If network packets  130  containing a file arrive from another computer via network  132 , the proxy  112  observes a subset of network packets  130 , such as an open packet, and saves the information associated with the open packet. One example of information that can be saved includes the file name that is being received. Another example includes information regarding the computer that sent the file (source computer) such as the network address of the source computer. 
         [0013]    An open packet is generally included in most protocols that encapsulate file transfers. An open packet can include an “open file” or “create file” request. Although the subset of network packets  130  is often referred to herein as an open packet for ease of reference, the subset of network packets  130  can be a single packet or a plurality of packets, and an open packet can refer to a single packet or several packets that include instructions such as “open file”, “create file”, “read file”, “write file”, “delete file” or any request to modify or access a file. This open packet is generally the first packet or packets in a stream of network packets and it includes information such as a destination file name. Open packets vary depending on the protocol. Further details of how an open packet is used according to some embodiments are later discussed in conjunction with  FIGS. 3 and 4 . 
         [0014]    The network packets  130  may be received by a receiving program  114 . The file is reconstructed from the received packets  130  and written to disk. The reconstructed file is shown as document  116  in this example. The anti-virus  106  checks the received file  116  for virus. If a virus is found, then it can be determined which source computer sent the virus since the network address of the source computer that sent the virus has been saved. 
         [0015]      FIG. 2  is a flow diagram of a method according to an embodiment of the present invention for tracking a source computer of an infection in a network. In this example, as network packets are being received by the computer, it is determined whether this particular packet is an open packet ( 200 ). If it is not an open packet, the packet is allowed to pass ( 201 ). If, however, this packet is an open packet then information about the communication is copied ( 202 ). Examples of such information include destination, file name, network address of the source computer, username, user credentials, name of source computer such as a netbios name or a domain name service (DNS) name. Accordingly, a subset of the network transmission can be analyzed rather than the entire set of packets in the network transmission. The copied information is then saved ( 204 ). For example, the copied information can be saved in the memory of the receiving computer. Network traffic is allowed to flow past until the next open packet ( 206 ). If an anti-virus program catches a virus from the file associated with this particular open packet ( 208 ), then the saved information associated with the open packet is retrieved ( 210 ). An example of when the determination of whether a virus has been received can be performed when an attempt to access a file occurs, such as open, read, write, create, or delete a file request occurs. Once the saved information is retrieved, the infected source computer can be tracked down and dealt with appropriately. 
         [0016]    In one embodiment, once it is determined which computer the infected file came from, the information can be communicated with a firewall process residing on the same computer to block traffic from the infected source computer. In one embodiment, the protocol stream in subsequent transmissions from the infected computer can be modified by dropping packets that specify the “open” command. Because worms are rarely designed with much fault tolerance, this will likely cause the worm to hang and thus prevent it from infecting other computers. In one embodiment, a management process running on a remote computer can be notified in order to allow an administrator or the management process to take manual or automated action aimed at the infected computer. 
         [0017]    In one embodiment, the technique presented herein is implemented on file servers. In another embodiment, it is part of a firewall. In another embodiment, it is part of an anti-virus software. In another embodiment, it is part of a combined firewall/anti-virus software. In yet another embodiment, it is independent of the firewall and anti-virus software. In one embodiment it occurs in the receiving computer or server. 
         [0018]      FIG. 3  shows an example of a server message block (SMB) open packet which can be used with some embodiments. Such an open packet may be part of a network packet stream that is received by a computer. As previously mentioned, an open packet may be a single packet or several packets. In this example, the SMB open packet is shown to include approximately twenty bytes for an IP header which includes the network address of the sending computer. It is also shown to include a TCP header of approximately twenty bytes, an SMB header of approximately twenty bytes, and an SMB data of variable length. 
         [0019]    The following sequence is an example of a message flow from an SMB client to and SMB server when the client wants to write a file to a file share on the server: 
         [0020]    SMB_COM_NEGOTIATE
       Negotiate SMB dialect and message capabilities.       
 
         [0022]    SMB_COM_SESSION_SETUP_ANDX
       Specifies user name and password.       
 
         [0024]    SMB_COM_TREE_CONNECT_ANDX
       Specifies the root directory share that the client wants to access.       
 
         [0026]    SMB_COM_NT_CREATE_ANDX
       Specifies the file name and creation semantics.       
 
         [0028]    SMB_COM_WRITE
       Writes raw data to the file specified in the previous message.       
 
         [0030]    SMB_COM_CLOSE
       Closes the file.       
 
         [0032]    SMB_COM_TREE_DISCONNECT
       Ends the session.       
 
         [0034]    In one embodiment, the destination file name is found in the SYB_COM_NT_CREATE_ANDX message. This destination file name can be copied and stored for later use in case of an infection, as described in the example shown in  FIG. 2 . 
         [0035]      FIG. 4  shows an example of an FTP open packet which can be used with some embodiments. Such an open packet may be part of a network packet stream that is received by a computer. As previously mentioned, an open packet may be a single packet or several packets. In this example, the FTP open packet is shown to include an IP header of approximately twenty bytes, which includes the network address of the sending computer. Additionally, a TCP header is also shown to be included with approximately twenty bytes as well as the FTP data which is shown to be of variable length. In one embodiment, the destination file name is found in the FTP data. Such information can be copied and stored for later use in case of an infection, as described in the example shown in  FIG. 2 . 
         [0036]    The following sequence gives an example of a message flow from an FTP client to an FTP server when the client wants to write a file to a directory on the server: 
         [0037]    USER
       Specifies user name for session logon.       
 
         [0039]    PASS
       Specifies password for session logon.       
 
         [0041]    PORT
       Specifies the TCP port to use when transferring data to and from the client.       
 
         [0043]    STOR
       Specifies the name of the file to create on the server.       
 
         [0045]    The destination file name can be found in the STOR message which can be copied and stored for later use in case of an infection, as described in the example shown in  FIG. 2 . Although the foregoing embodiments have been described in some detail for purposes of clarity of understanding, the invention is not limited to the details provided. There are many alternative ways of implementing the invention. The disclosed embodiments are illustrative and not restrictive.