JPH11167487A - Virus check network, virus check device, client terminal, and virus information management station - Google Patents

Abstract

(57) [Summary] [PROBLEMS] To provide a virus check network which prevents viruses on the network side and improves the anti-virus efficiency. SOLUTION: A virus pattern storage means 11 stores a virus pattern. Virus checking means 12
Performs a virus check on the network side to determine whether a packet is an infected packet Pa based on a virus pattern. When detecting the infected packet Pa, the packet transmitting means 13 sets a bit indicating the infection in the packet and transmits it as an infection indication packet Pb. The infected packet detecting means 21 detects the infected packet Pa. The file execution control unit 22 disables execution of the file corresponding to the infected packet. The virus pattern information distribution means 31 distributes the virus pattern information to the virus check devices 10a to 10n by multicast. The virus pattern information management means 32 centrally manages virus pattern information.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a virus check network, a virus check device, a client terminal, and a virus information management station. More particularly, the present invention relates to a virus check network for performing a virus check to prevent a virus from entering, and a virus check network for performing a virus check. The present invention relates to a virus check device that prevents intrusion, a client terminal that receives a virus-checked packet, and a virus information management station that manages virus information in a network.

[0002]

2. Description of the Related Art In recent years, information communication network technologies such as multimedia communication have rapidly advanced. Also, due to the trend of the Internet and the like, services provided by the network are widely used not only for companies but also for ordinary households.

On the other hand, the increase in computer viruses and the speed of infection are accelerating with the spread of networks, and it has been reported that many corporate users are suffering from virus damage.

Conventionally, in order to protect a network from virus infection, vaccine software has been introduced into clients, proxy servers, and the like. By using this vaccine software, the virus can be removed from the file infected with the virus and the file can be repaired.

[0005]

However, since the conventional virus countermeasures as described above are performed on the client side, in order to prevent infection, vaccine software must be individually introduced to all the clients. .

[0006] For this reason, there has been a problem that, for a new virus, upgraded vaccine software has to be introduced one by one from the beginning, and it takes much time and is inefficient.

[0007] In the conventional virus countermeasures on the client side, it is difficult to thoroughly monitor the virus because operation management such as updating of a pattern file when a new virus is found is left to each user. There was such a problem.

The present invention has been made in view of the above points, and an object of the present invention is to provide a virus check network in which a virus is prevented from occurring on the network side, and the anti-virus efficiency is improved.

It is another object of the present invention to provide a virus check apparatus which prevents viruses on the network side and improves the anti-virus efficiency. Still another object of the present invention is to provide a client terminal in which a file infected with a virus is deleted to improve anti-virus efficiency.

It is another object of the present invention to provide a virus information management station which manages virus information in a network and improves the anti-virus efficiency.

[0011]

According to the present invention, in order to solve the above-mentioned problems, a virus checking network 1 for performing virus checking and preventing virus intrusion as shown in FIG. When the infected packet Pa is detected, a pattern storage unit 11, a virus check unit 12 that performs a virus check on the network side to determine whether or not the received packet is an infected packet Pa infected with a virus based on a virus pattern. A plurality of virus checking devices 10a to 10n, each of which comprises setting a bit in a packet indicating an infection and transmitting the same as an infection indication packet Pb, and an infection detecting the infected packet Pa based on the bits. Packet detection means 21 and infected packet Pa A file execution control unit 22 for disabling a corresponding file; a client terminal 20a to 20m; a virus pattern information distribution unit 31 for distributing virus pattern information to the virus check devices 10a to 10n by multicast; A virus information management station 30 composed of a virus pattern information management means 32 for centrally managing pattern information;
The virus check network 1 characterized by having the following.

Here, the virus pattern storage means 11
Stores a virus pattern. The virus check unit 12 performs a virus check on the network side to determine whether or not the received packet is an infected packet Pa infected with a virus based on the virus pattern. When detecting the infected packet Pa, the packet transmitting means 13 sets a bit in the packet indicating the infection and transmits it as the infection indication packet Pb. Infected packet detection means 21
Detects the infected packet Pa based on the bit. The file execution control unit 22 disables execution of the file corresponding to the infected packet. The virus pattern information distribution means 31 distributes the virus pattern information to the virus check devices 10a to 10n by multicast.
The virus pattern information management means 32 centrally manages virus pattern information.

[0013]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a principle diagram of the virus check network of the present invention.

The virus check network 1 includes virus check devices 10a to 10n, client terminals 20a to 20m, and a virus information management station 30. The virus check network 1 performs a virus check to prevent virus invasion.

The virus pattern storage means 11 stores a virus pattern. Virus checking means 12
The received packet is compared with the stored virus pattern, and a virus check is performed on the network side to determine whether the packet is an infected packet Pa infected with a virus.

The packet transmitting means 13 transmits the infected packet P
If a is detected, a bit indicating a preset infection in the infected packet Pa is set and transmitted as an infection indication packet Pb.

The infected packet detecting means 21 detects an infected packet Pa based on the bit of the infected indication packet Pb. The file execution control unit 22 disables execution of the file corresponding to the infected packet Pa.

The virus pattern information distribution means 31 distributes the latest virus pattern information to the virus check devices 10a to 10n by multicast. The distributed virus pattern is stored in the virus pattern storage unit 11.

The virus pattern information management means 32 centrally manages new setting and updating of virus pattern information. Next, the virus check network 1 of the present invention
Will be described below when applied to a network on the Internet composed of routers. The virus check devices 10a to 10n of the present invention are arranged in some routers, and a virus check is performed on the network side.

Note that a router in which a virus check device is arranged is hereinafter referred to as a virus check router. FIG.
FIG. 1 is a diagram showing an outline of a network in which a virus check router is arranged. Network 1 includes routers R1 to R
8, client terminals 20 a to 20 m, and a virus information management station 30.

In the figure, routers R1, R2, R3 and R4 are virus check routers, and the others have only normal router functions. The virus information management station 30 connects to the virus check router R2, and the virus check router R4
Are connected to the client terminals 20a to 20m.

The virus check routers R1 to R4 are responsible for determining which part of the virus (the head, the middle, and the end) is to be checked, and are arranged so as to pass each charge at least once.

Each of the virus check routers R1 to R4
A virus pattern VP distributed by multicast from the virus information management station 30 is received, and the latest virus information is always held.

For the received packet, the virus check routers R1 to R4 transmit the stored virus pattern V
Compare with P. If infected, set a bit in the packet.

At this time, a warning packet Pw1 is returned to the transmission source at the same time, and each virus check router R1 to R4
, The alert information packet Pw2 is distributed by multicast.

Each of the virus check routers R1 to R4 that has received the alert information packet Pw2 detects the virus preferentially or cuts off the communication with the infection source. The client terminals 20a to 20m constantly monitor the packet, and when the bit indicating the infection is set or when the packet is the warning packet Pw1, a message is displayed to the user to urge the deletion of the received file.

Next, the virus pattern VP will be described. The virus pattern VP is periodically distributed on a multicast. When a new type of virus is found, the virus information management station 30 sends the newly created virus pattern VP to each of the virus check routers 10a to 10n by multicasting. Update.

FIG. 3 is a diagram showing a format of the virus pattern VP. The virus pattern VP is the header V
P-1 has Ether Hedder and IP Hedder (Multicast). Then, the code VP-
2, a serial number VP-3 indicating the type of virus,
It has that version (revision number) VP-4.

After these, the leading part (the virus pattern of the first area) VP-
6. Middle part (virus pattern of second area) VP-
7. Terminating part (virus pattern in third area) VP-7
Is extracted for each fixed-length byte.

The extracted part is the virus information management station 30
And updates the version VP-4 by changing it periodically. In addition, the virus information management station 30 determines the threat level VP-5 according to the degree of risk of the virus. This makes it possible to respond according to the degree of danger.

The virus check routers 10a to 10n add their own virus pattern VP to a search table described later based on the received data. At this time, each of the virus check routers 10a to 10n is determined which area is to be assigned, and receives only its own pattern from the received packet.

Next, the storage format of the virus pattern VP will be described. FIG. 4 is a diagram showing the storage format of the virus pattern storage means 11. Virus pattern storage means 1
1 is a search table 11a for a virus pattern VP,
And the serial number holding information 11b.

The search table 11a has a hierarchical tree structure. Each of them is referred to as a primary hierarchy, a secondary hierarchy, a tertiary hierarchy,... According to the depth of the tree. Also, each branch portion is associated with a serial number.

The serial number holding information 11b holds the serial number, the version and the threat level which the user currently has, and when a multicast packet of the virus pattern VP comes, whether or not it needs to be changed by comparing with this. Judge.

Next, a process for newly adding a virus packet VP to the search table 11a will be described.
Each of the virus check routers 10a to 10n stores the serial number and the version number of the virus pattern VP held by itself in the serial number holding information 11b separately from the search table 11a.

Upon receiving its own charge from the new virus pattern VP by multicast, the virus pattern VP search table 11a is updated based on the serial number holding information 11b recording the virus pattern VP information.

First, the serial number and version are checked to determine whether a change is necessary. When it is determined that a change is necessary, the search table 11a is compared with the first layer, the second layer,... To search for a portion that does not overlap, and a new branch is extended therefrom. Thereafter, the newly added branch is moved to the top, and the registration is completed.

FIG. 5 is a flowchart showing a processing procedure when newly registering a virus pattern VP in the virus pattern storage means 11. [S1] It is determined whether the serial number is stored in the virus check router. If it does, go to step S2; otherwise, go to step S4. [S2] It is determined whether the version is updated. If it is an update, the process proceeds to step S3. [S3] The branch of the target serial number is deleted. [S4] Compare with the first layer. Details of step S4 will be described with reference to FIG.

FIG. 6 is a flowchart showing a processing procedure for creating a new branch in comparison with the n-th hierarchical level. [S10] One character is taken from the virus pattern. [S11] A comparison is made with the n-th hierarchical level of the existing search table 11a. [S12] If hit, go to step S13, otherwise go to step S14. [S13] Compare with the next (n + 1) th layer. [S14] Branches are added. [S15] The branch priority is raised.

According to the processing procedure described above, a branch corresponding to a new type of virus pattern VP is created and stored. Next, the configuration of the virus check router 10 will be described. FIG. 7 shows a virus check router 10.
FIG. 3 is a diagram showing the configuration of FIG.

The normal packet shown in the figure is subjected to virus check by the virus check filter 12 corresponding to the virus check means 12 of the present invention. Here, the packet to be checked for viruses is T
The packet is a CP and any one of ftp, http, and smtp, and has not yet been checked.

However, other packets are passed through the virus check filter 12 without virus check in order to reduce the load. Also, a packet having an offset value equal to or more than a certain value, that is, a packet at the rear of the flow is passed. At this time, a virus checked bit is set.

On the other hand, the multicast packet is subjected to a virus pattern update process using the serial number holding information 11b, and is stored in the search table 11a in a hierarchical tree structure format.

After the route calculation unit 13a calculates the route, the packet generation / transmission unit 13b responds to the packet caught by the virus check by transmitting an infection indication packet Pb in which an optional field of an IP header described later has a bit set. Generate Bits are set for subsequent packets of the same flow.

Further, the packet generation and transmission unit 13 b
An alert packet Pw1 is generated toward the source of the packet. Thereafter, the infection display packet Pb and the warning packet Pw
Send 1

The alert mode setting means 14 for setting the alert mode to cut off communication with the infection source will be described later. On the other hand, the client terminal 20 monitors a bit indicating a virus infection in the IP header by software. Client terminal 20 that has received the infection display packet Pb and the warning packet Pw1 with the bit set
Displays a message to the user that a virus has been infected.

Next, the configuration of the IP header will be described.
FIG. 8 is a diagram showing the configuration of the IP header. The version is 4 bits and indicates the format of the Internet header. IH
L (Internet Header Length) is 4 bits, and the header length is indicated in 32-bit words. The service type is 8 bits and indicates service quality such as throughput. The total length is 16 bits and indicates the length measured in octets. Note that the total length includes a header and data.

The identification number is 16 bits, and is used when assembling a datagram fragment with a value assigned to identify the transmitting side. Flag is 3 bits and indicates control such as permission or continuation of fragment division. The fragment offset is 13 bits and indicates the position occupied by the fragment in the datagram.

Ttl is 8 bits and indicates the minimum value of the time that the datagram can stay in the Internet system. The protocol is 8 bits and indicates the transport layer protocol to which the data part of the datagram should be passed.
The header checksum is 16 bits and indicates a checksum for the header.

The start address is 32 bits, and the IP address of the start point is
Indicates an address. The destination address is 32 bits and the destination I
Indicates the P address. The options are of variable length and can be arbitrarily defined by the user. In the present invention, the infection display packet Pb, the warning packet Pw1, and the alert information packet Pw2 are generated using this optional area.

Next, the virus checking means 12 will be described. FIG. 9 is a flowchart showing the procedure of the virus check process. [S20] It is determined whether another virus check router has already performed the check. If the check has been completed, the process proceeds to step S30; otherwise, the process proceeds to step S21. [S21] It is determined whether the offset value is equal to or greater than a predetermined value. If it is not less than a certain value, go to step S30, otherwise go to step S22. [S22] TCP packet and http, ftp, s
It is determined whether the packet is any one of mtp. In that case, go to step S23; otherwise, go to step S3.
Go to 0. [S23] A virus check is performed. The details are shown in FIG.
0 will be described. [S24] It is determined whether the computer is infected. If infected, go to step S28, otherwise go to step S25. [S25] One byte of the next packet is taken. [S26] It is determined whether or not the processing is to be ended. If the processing has been completed, the process returns to step S27; [S27] The checked bit is set. [S28] A bit is set in the option field of the IP header. [S29] Warning packet Pw1 and alert information packet Pw
Issue 2. [S30] Route calculation is performed.

Next, the virus check routine in step S23 will be described. One byte in the packet is taken and compared with the first layer in the search table 11a. If they are the same, the next 1
The byte is taken and compared with the secondary hierarchy under the matched branch.

If no longer applicable, the next byte of the packet is taken out and the comparison is restarted from the beginning. If this is repeated until the end, this byte is determined to be infected with a virus, and a bit is set in an optional field of the IP header.

If the packet ends in the middle of the search, it is considered that the packet has not been infected, and instead, it is left to the virus check router in charge of another area.
FIG. 10 is a flowchart showing the procedure of the virus check routine. [S40] One byte is extracted from the packet. [S41] It is determined whether the packet is completed. If the packet has been completed, the process ends; otherwise, the process proceeds to step S42. [S42] The virus pattern is compared with the n-th layer. [S43] It is determined whether a hit has occurred. If hit, go to step S46, otherwise go to step S4
Go to 4. [S44] The hierarchy is returned to the primary level. [S45] The primary layer is checked. [S46] The hierarchy is set to n + 1. [S47] It is determined whether the virus check has been completed.
If it is completed, the process proceeds to step S49, otherwise, the process proceeds to step S48. [S48] The (n + 1) th layer is checked. [S49] Judge as virus infection.

Next, the bits set at the time of virus check will be described. When a virus check is performed by the virus check router, first, the IHL field is incremented by 1 to secure an optional area. Then, a bit is set in the secured option area.

FIG. 11 is a diagram showing a format of an IP packet of the infection indication packet Pb. First, the IHL field is incremented by one. Then, the option area was changed to The Co
piedflag = 0, The option Classes = 3 (area for future reservation), The option Number = 1 (infection display packet Pb:
Code indicating that virus check was performed), Length =
Set to 5.

As the Option Value, the first bit is assigned to a first area check not yet / completed, the second bit is assigned to a second area check not / completed, and the third bit is assigned to a third area checked / unfinished. That is, information indicating whether a virus check has been performed is described.

The fourth bit indicates virus uninfected / infected, and indicates 0 if uninfected and 1 if infected, indicating an infected display packet Pb. The fifth and subsequent bits are a serial number.

Next, the warning packet Pw1 will be described. When a virus is detected by the virus check router, a warning packet Pw1 is transmitted to the transmission source, and a warning information packet Pw2 is transmitted by multicast to surrounding virus check routers. This will help to detect viruses early and prevent their spread.

The warning packet Pw1 sets the bit of the option area of the IP header similarly to the packet at the time of virus detection, and is delivered to the transmission source in the following format. FIG. 12 is a diagram showing a format of the warning packet Pw1. First, the IHL field is incremented by one. Then, set the option area to The Copied flag = 0, The option Class
es = 3 (future reservation area), The option Number = 2 (code indicating the warning packet Pw1), and Length = 3. Then, the unchecked / unchecked option described with reference to FIG. 11 is added. The destination address is the address of the infection source.

Next, processing on the client side will be described. FIG. 13 is a diagram showing a configuration of the client terminal 20. The infected packet detecting means 21 of the present invention is provided for the LAN driver 21a, and the file execution controlling means 22 is provided for the TCP / IP.
It is included in the driver 22b.

The LAN driver 21a checks the virus check bit of each packet for each flow sent. Then, it is determined whether or not the bit is set, and the result is notified to the TCP / IP driver 22b.

When receiving the notification that the bit is set, the TCP / IP driver 22b disables the corresponding file and then deletes the file 20.
Displays -1.

Next, the flow of bit monitoring in the client terminal 20 will be described. FIGS. 14 and 15 are flowcharts showing the processing procedure of the bit monitoring of the client terminal 20. [S50] The packet is read. [S51] It is determined whether the flow is a new flow. If it is a new flow, go to step S52, otherwise go to step S53. [S52] Flow information is added. [S53] It is determined whether the flow is an end flow. If it is the end flow, go to step S54; otherwise, go to step S54.
Go to 55. [S54] The corresponding flow is deleted from the flow information. [S55] The bit is checked. [S56] It is determined whether a hit has occurred. If hit, go to step S58; otherwise, go to step S5
Go to 7. [S57] The process is passed to the TCP / IP driver 22b. [S58] It is determined whether the packet is a warning packet Pw1. If it is a warning packet, go to step S59, otherwise go to step S60. [S59] A warning message is displayed. [S60] The right to execute the file is removed. [S61] A warning message 20-1 is displayed.

Next, the alert information packet Pw2 will be described. When a virus is detected by the virus check router, a warning information packet Pw2 is output to each virus check router by multicast. Alert information packet Pw2
Has a serial number of a virus packet and a source IP address as information, and is distributed by multicast.

Each virus check router that has received the alert information packet Pw2 raises the search priority of the virus pattern VP of the received serial number. FIG. 16 is a diagram showing a format of the alert information packet Pw2. The alert information packet Pw2 includes Et in the header Pw2-1.
It has her Hedder and IP Hedder (Multicast).

Then, the code Pw2-2 indicating the alert information
And a serial number Pw2-3 indicating the type of virus;
It has the version (revision number) Pw2-4. Further, the threat level Pw2-5 according to the risk of the virus
Is attached to the IP address Pw2-6 of the virus infection source.

Next, a description will be given of a processing procedure of a search order when the alert information packet Pw2 is received. FIG. 17 is a diagram illustrating a processing procedure of a search order when the alert information packet Pw2 is received. [S70] The serial number is obtained from the alert information packet Pw2. [S71] The search order of the first hierarchy, the second hierarchy,..., The n-th hierarchy is raised to the highest rank.

Next, the alert mode setting means 14 for interrupting communication with the infection source will be described. If the threat level is higher than a certain level, the virus check router interrupts communication with the host for a certain time to prevent the spread.

Looking at the threat level in the alert information packet Pw2, if the threat level is higher than a certain level, the IP address is stored in a table and the mode shifts to the alert mode. In the alert mode, packets that come before normal processing are checked, and packets that come from the address in the table and packets that go to the address in the table are all discarded for a certain period of time.

The time for discarding is such that the retransmission request times out, and a counter is set together when the data is stored in the table. If no packet arrives within this time, it is deleted from the table and the alert mode is released. Conversely, when a packet comes, the time (count value of the counter) is extended.

FIG. 18 is a flowchart showing the procedure of the alert mode set by the alert mode setting means 14. [S80] It is determined whether the threat level is equal to or higher than a certain level.
If it is not less than a certain value, go to step S81, otherwise go to step S89. [S81] An IP address and a counter value for counting the time to keep in the alert mode are set in the alert IP address table holding the alert IP address. [S82] The packet is read. [S83] It is determined whether or not the start / end address matches the table. If they match, step S84
Otherwise, go to step S86. [S84] The packet is discarded. [S85] The counter value is extended. That is, the time for setting the alert mode is further increased. [S86] The counter value is decreased. That is, the time for the alert mode is reduced. [S87] It is determined whether to end the counter. If the processing has been completed, the process returns to step S88. If not, the process returns to step S82. [S88] The IP address and the counter value are deleted from the security IP address table. [S89] The normal mode is set.

Next, a description will be given of load balancing and checking accuracy improvement by cooperation of virus check routers. The binary data of the virus is small, and the binary may be divided across the packets. Therefore, the virus pattern VP assigned to each virus check router is shared and held differently.

Thus, even if the binary of the virus is cut off in the middle of a packet in one area, another area is checked in another packet.

Each assignment of the virus pattern to the virus check router can be set manually or automatically. However, when manually setting, the configuration is such that all areas are checked before the packet arrives at the destination, that is, the configuration is such that the packet passes at least once through the assigned virus check router. There is a need to.

Next, the case of setting automatically will be described. FIG. 19 is a diagram showing a format of the assigned area request packet. Automatically set using the format shown in the figure.

First, the new virus check router distributes the assigned area request packet 100 to all the virus check routers that can distribute itself. In this case ttl
It is necessary to set the area to be small and avoid applying extra load as much as possible.

Also, based on the routing information held by itself, a packet in which the destination address is inserted is issued to all the virus check routers connected to the router.
The option area is The Copied flag = 0, The option C
lasses = 3 (area for future reservation), The option Number = 3
(Code indicating the assigned area request packet 100), L
ength = 3, set to “empty”.

Each of the virus check routers that has received the assigned area request packet 100 returns its assigned area in the assigned area request response packet 101 as follows to the transmission source. FIG. 20 is a diagram showing the format of the assigned responsibility area request response packet 101.

If ttl still remains, broadcast is made to all virus check routers within the deliverable range other than the virus check router received by itself. The optional area of the assigned responsibility area request response packet 101 is Th
e Copied flag = 0, The option Classes = 3 (area for future reservation), The option Number = 4 (code indicating assigned responsibility area request response packet 101), Length = 3, and “assigned area”.

Further, the virus check router on the transmitting side totals the number of routers in charge of each area from the returned assigned area request packet 101, and determines the area with the fewest routers in charge. Area in charge.

As described above, the virus check network 1 according to the present invention can detect a virus on the network side by installing a virus check function in the virus check router, thereby preventing more clients from invading the virus. And more reliably.

Further, since the latest virus pattern information is always exchanged and notified between the virus check routers by multicast and the update method is only to issue multicast packets, it is easy and quick to respond to a new virus. Can be done. There is no need to update on the client side.

Further, each virus check router issues a warning for the detected virus at the same time, whereby early detection and spread prevention are achieved. Then, a virus infection can be notified to the transmission source by sending a warning packet.

Further, by sharing the virus check area with each virus check router, the load on each virus check router can be distributed. Even if a virus exists between frames, one of the virus check routers is assigned. Can be checked with a virus check router, which improves the virus check accuracy.

Further, by setting a bit in the IP header and notifying the receiving side without dropping the packet in which the virus is detected, unnecessary increase in traffic due to retransmission or the like can be prevented. Since the communication is cut off according to the virus threat level, the spread of infection can be prevented.

[0087]

As described above, the virus check network of the present invention has a configuration in which a plurality of virus check devices are provided and a virus check is performed on the network side. As a result, the virus can be prevented from occurring on the network side, so that the infection and spread of the virus can be prevented, and the efficiency of the virus check countermeasure can be improved.

[Brief description of the drawings]

FIG. 1 is a principle diagram of a virus check network of the present invention.

FIG. 2 is a diagram showing an outline of a network in which a virus check router is arranged.

FIG. 3 is a diagram showing a format of a virus pattern VP.

FIG. 4 is a diagram showing a storage format of a virus pattern VP storage unit.

FIG. 5 is a flowchart showing a processing procedure when a virus pattern VP is newly registered in the virus pattern storage means.

FIG. 6 is a flowchart illustrating a processing procedure when a new branch is created as compared with the n-th hierarchical layer.

FIG. 7 is a diagram showing a configuration of a virus check router.

FIG. 8 is a diagram showing a configuration of an IP header.

FIG. 9 is a flowchart illustrating a virus check processing procedure.

FIG. 10 is a flowchart illustrating a processing procedure of a virus check routine.

FIG. 11 is a diagram showing a format of an IP packet of an infection indication packet.

FIG. 12 is a diagram showing a format of a warning packet.

FIG. 13 is a diagram illustrating a configuration of a client terminal.

FIG. 14 is a flowchart illustrating a bit monitoring process performed by a client terminal;

FIG. 15 is a flowchart illustrating a bit monitoring process performed by a client terminal;

FIG. 16 is a diagram showing a format of an alert information packet.

FIG. 17 is a diagram illustrating a processing procedure of a search order when an alert information packet is received.

FIG. 18 is a flowchart illustrating a processing procedure in the alert mode.

FIG. 19 is a diagram showing a format of a charge sharing area request packet.

FIG. 20 is a diagram showing a format of a charge sharing area request response packet.

[Explanation of symbols]

 REFERENCE SIGNS LIST 1 virus check network 10 a-10 n virus check device 11 virus pattern storage means 12 virus check means 13 packet transmission means 20 a-20 m client terminal 21 infected packet detection means 22 file execution control means 30 virus information management station 31 virus pattern information distribution means 32 Virus pattern information management means Pa infection packet Pb infection indication packet

Claims (12)

[Claims] In a virus check network for performing a virus check to prevent virus intrusion, a virus pattern storage means for storing a virus pattern, and a virus infected with a virus based on a received packet based on the virus pattern. A virus checking means for performing the virus check on the network side for checking whether the packet is a packet, and a packet transmitting means for setting a bit in the packet indicating the infection and transmitting it as an infection indication packet when the infected packet is detected. A plurality of virus check devices, an infected packet detection unit for detecting the infected packet based on the bit, and a file execution control unit for disabling execution of a file corresponding to the infected packet. Terminal and will A virus pattern information distributing means for distributing the virus pattern information to the virus check device by multicast; and a virus information management station comprising: a virus pattern information managing means for centrally managing the virus pattern information. Virus check network. 2. The virus check network according to claim 1, wherein the virus check means selects the packet to be checked for the virus by looking at a header of the packet. 3. The virus check network according to claim 1, wherein the virus check device is arranged in a router. 4. The virus check network according to claim 1, wherein the virus check devices notify the virus pattern information to each other by the multicast. 5. The virus check device according to claim 1, wherein the virus check device further includes a security mode setting unit that sets a security mode according to a threat level of the virus, and interrupts communication with a host for a predetermined time. Virus check network. 6. The virus check network according to claim 1, wherein the virus check device is provided with a plurality of parts for performing the virus check, and shares a virus check area assigned to each of the virus check devices. 7. The virus check according to claim 6, wherein when the virus check device is newly placed on a network, the virus check device collects information on a responsible area for the virus check from another virus check device. network. 8. The packet transmitting means transmits a warning packet to a transmission source of the infected packet together with the transmission of the infected indication packet, and records information of the infected packet to be warned of another virus check device. 2. The virus check network according to claim 1, wherein said alert information packet is distributed by multicast. 9. The virus check according to claim 8, wherein said virus check means performs said virus check by increasing the priority of said virus pattern of said infected packet described in said alert information packet. network. 10. A virus checker for performing a virus check to prevent virus invasion, comprising: a virus pattern storage means for storing a virus pattern; and a virus infected device for transmitting a received packet based on the virus pattern. Virus checking means for performing the virus check on the network side as to whether the packet is a packet, and, in the case of the infected packet, packet transmitting means for setting a bit in the packet indicating infection and transmitting the bit as an infection indication packet. Characteristic virus check device. 11. A client terminal receiving a packet that has undergone a virus check, an infected packet detecting means for detecting, as an infected packet, a packet having a bit indicating that it is infected with a virus, and detecting the infected packet. And a file execution control unit for making the corresponding file unexecutable when the client terminal is executed. 12. A virus information management station for managing virus information in a network, comprising: virus pattern information distributing means for distributing virus pattern information by multicast to a virus check device arranged in the network and performing a virus check; A virus information management station, comprising: virus pattern information management means for centrally managing virus pattern information.