WO2007112282A2

WO2007112282A2 - Externally coupled malware alerting device and methods therefor

Info

Publication number: WO2007112282A2
Application number: PCT/US2007/064706
Authority: WO
Inventors: Chen Liang-Wei; Yueh Peng Yuan; Chu Chi-Hsi
Original assignee: Trend Micro Incorporated
Priority date: 2006-03-24
Filing date: 2007-03-22
Publication date: 2007-10-04
Also published as: WO2007112282A3; WO2007112282A9; WO2008014021A3; WO2007112282B1; WO2008014021A2

Abstract

A malware alerting device externally coupled to a computer. The malware alerting device is configured to generate audiovisual cues responsive to a malware alert generated by an anti-malware application executing on the computer. The malware alerting device has a pet-shape to mimic a pet and includes at least two parts mimicking a body part of the pet. The malware alerting device also includes driver logic configured for receiving a command from the computer, the command being generated responsive to the malware alert generated by the anti-malware application. The malware alerting device further includes a transducer for generating audiovisual cues from the command.

Description

EXTERNALLY COUPLED MALWARE ALERTING DEVICE AND

METHODS THEREFOR

B ACKGROUND OF THF INVENTION fOOO ) ] As computers become more sophisticated and more integrated into people^'s

Ih es and work, people nowadays spend more and more time on computers For example, computers nowadays a*e not only employed for work -related (asks but also for entertainment (e g , downloaded or sU earned movies or music), for communication (e g , email, instant messaging, etc ), etc it is also not unusual nowadays to find that some people turn on then computer in the morning, either at work or at home, and use their computer either continuously oi periodical!) Uuuughout the day, and do not turn their computer off until late in the evening During the time the computer is running, the computer typically executes a multiplicity of programs and performs a multitude of tasks, often simultaneously

10002] Given the importance of computers to people^'s lives, it becomes more important than ever to ensure that the computer stays Tree of malware MaI ware is defined herein as am unwanted program or message that can potentially damage or degrade the performance of the computer or an application The term malvvarc thus encompasses, tor example, computer viruses, spyware, adware. email spam, instant messaging spam, etc

[0003 ] The detection, prevention and removal of malware is typically performed b\ aiiti-malware appiications Generally speaking, anti -malware applications tend to execute in the background while the computer is running other applications and may perform tasks such as email scanning, virus scanning, spam detection, and malware leniova! Trendmicro. Inc. of Ouptettino, CA is one well known maker of such anti-malware applications

[0004] If malware is detected, the anti-malware application typically alerts the operator of the presence of the malware and may propose a specific action that, if taken fay the operator, would neutralize the maiw are threat By timely alerting the operator and timely responding to malwaje threats upon operator^'s command, potential damage to the softwaie and/oi hardw are components of the computer is often averted

[0005] As a default, the alert generated by the anti-malware application is typically presented as an on-screen warning to the operator { hifortunately. with the computer being nearly always on and the display screen nearly always bus\ w ith information from a multitude of programs, it has become a challenge to alert the operator in a way that would timely capture the operator^'s attention without being o\ crly annoying [0006] For example, if the operator happens to be involved on another task {e.g., reading a paper report or talking on the phone) that does not require viewing the computer display screen, an on-screen alert may not capture the attention of the operator until after some time has passed, especially if the on-screen alert is one of many different messages being simultaneously displayed on the display screen If a worker steps away from his cubicle (e.g., to talk to another cubicle occupant or to get a cup of coffee), the on-screen alert would be missed even if it is prominently displayed on the display screen.

[0007] Alerts that rely on an audible warning alarm may also be employed For example, while an extra loud alert tone from the computer^'s speaker would most likely capture the operator^'s attention, such approach may not be conducive to a pleasant and productive office environment where cubicles or desks belonging to different workers may be in dose proximity. In a home environment, a loud alert tone may be perceived as threatening or annoying especially to new or technically unsophisticated users, and may be a source of irritation to most users.

SUMMARY OF INVENTION

[0008] The invention relates, in an embodiment, to a malware alerting device coupled to a computer. The malware alerting device is configured to generate at least one of a human- perceptibSe visual cue and a hum an -perceptible audible cue responsive to a malware alert generated by art anύ-malware application executing on the computer. The malware alerting device has a pet-shape Io mimic a pet and includes at least two parts interconnected and individually movable against one another, each of the at least two parts mimicking a body part of the pet The malware alerting device also includes driver logic configured for receiving a command from the computer, the command being generated responsive to the malware alert generated by the anti-malware application. The malware alerting device further includes a transducer for generating one of the human-perceptible audible pet cue and the human-perceptible visual pet cue from the command, wherein the malware alerting device is external to the computer and couples to communication with the computer via one of a wired medium and a wireless medium

[0009] These and other features of the present invention will be described in more detail below in the detailed description of the invention and in conjunction with the foil owing figures. BRIEF DESCRIPTION OF THE DRAWINGS

[00 ! Oj The present invention is illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings and in which like reference numerals refer to similar elements and in which'

[001 1 ] Fig I shows, in accordance with an embodiment, a mahvare alert system, including a computer and a PSMAD dog.

[0012] Fig 2 shows, in accordance with an embodiment of the invention, a block diagram of an architecture of a malware alert system, including a computer and a PSMAD.

[0013] Fig. 3 shows, in accordance with an embodiment of the invention, the steps for providing a malwarε-related alert the user using the PSMAD arrangement

DETAILED DESCRIPTION OF EMBODIMENTS

[0014] The present invention will now be described in detail with reference to a few- embodiments thereof as illustrated in the accompanying drawings In the following description, numerous specific details are set forth in order to provide & thorough understanding of the present invention. It will be apparent, however, to one skilled in the art, that the present invention may be practiced without some or ali of these specific details In other instances, well known process steps and/or structures have not been described in detail in order to not unnecessarily obscure the present invention

[0015] Various embodiments are described herein below, including methods and techniques. H should be kept in mind that the invention might also cover articles of manufacture that includes a computer readable medium on which computer-readable instructions for carrying out embodiments of the inventive technique are stored. The computer readable medium may include, for exam pie, semiconductor, magnetic, opto- magnetic, optical, or other forms of computer readable medium for storing computer readable code. Further, the invention may also cover apparatuses for practicing embodiments of the invention. Such apparatus may include circuit:}, dedicated and/or programmable, to carry out tasks pertaining to embodiments of the invention. Examples of such apparatus include a general -purpose computer and/or a dedicated computing device when appropriately programmed and may include a combination of a computer/computing device and dedicated/programmable circuits adapted for the various tasks pertaining to embodiments of the invention.

[0016] ]n an embodiment, there is provided a pet-shaped mal ware alerting device

(PSMAD) that is configured to generate pet-specific audiovisual cues to alert the user of ma! ware. The PSMAD may be a plastic and/or metal device that resembles for example a dog, a cat, or a fish, or a bird. These familiar shapes are chosen since the inventors herein believe that their presence are non-threatening due to their user-fήendϊy shapes. By making the mal ware alerting devices more user-friendly and aesthetically pleasing, it is more likely that such devices will be prominently positioned in a work cubicle or a computer desk, making it more likely that the user's attention will be captured when an alert is necessary,

[0017] In an embodiment, the pet-shaped USB device (PSMAD) is configured to generate A/V pet cues, which may be visual and/or audible, to alert the user of malware. As the term is employed herein, an A/V pet cue may include a visual and/or audible manifestation that one typically expects from the animal which (lie PSMAD mimics. For example, if the PSMAD mimics a dog, an A/V pet cue for the PSMAD dog may be a bark, or head nodding, or tail wagging, if the PSMAD mimics a cat, the A/V pet cue for the PSMAD cat may be a cat meow, tail wagging, etc. The A/V pet cue may also include a visual or audible manifestation that is beyond what the real-life animal can duplicate. A PSMAD dog that talks, a PSMAD fish with eyes that can light up, or a I³SMAD fish that can make a musical sound are examples of such PSMADs,

[0018] Different A/V pet cues may represent different types of alert. The association between an A/V pet cue (e.g., barking) and a specific type of alert (e.g., detection of vims in email) may be pre-set or may be made programmable. In some cases, the associations may be provided as default setting, with the operator having an option redefine the associations as desired. Accordingly, a bark by a PSMAD dog belonging to a user may signify a different malware threat from a bark by another PSMAD dog belonging to another user. Such configuration may be performed either via the computer on which a PSMAD agent is installed to execute along with the an ti -mal ware application or via a configuration/customization button on the PSMAD.

[0019] in an embodiment, the PSMAD includes drivers and communication APIs

(Application Programming Interfaces) that enable the PSMAD to be integrated with an existing anti-malware application. In fact, the stimuli that result in the A/V pet cues are generated by anti-malware applications, with the PSMAD APIs and drivers converting the stimuli to the appropriate A/V pet cues.

[0020J hi an embodiment, a PSMAD may be capable of generating different A/V pet cues with us various parts, either simultaneously or at separate times. For example, a PSMAD dog may be able to bark and wag its tail, either simultaneously or at separate times.

[0021 ] The A/V pet cues may also be configurable by the user, either via the computer on which a FSMAD agent is installed to execute along with the anti-malware application or via a configuration/customization button on the PSMAD. For example, the user may be able to use a user interface associated with the PSMAD agent or the configuration/customization button on the PSMAD in order to change the barking sound of a PSMAD dog barks.

[0022] The features and advantages of embodiments of the invention may be better understood with reference to the figures and discussions that follow. Fig, 1 shows, in accordance with an embodiment, a malwarc alert system 100 including a computer 102 and a PSMAD dog 104. Computer system 102, for example, may represent any desktop or laptop computer on which an anti-malware application may be executing. PSMAD clog 104 represents, in the example of Fig. 1 , a mechanized dog-shape device that is coupled to the USB (Universal Serial Bus) port of computer 102 via USB cable 106. Although USB is used as the example protocol and has particular advantages with respect to auto-configuration and easy of installation, any suitable protocol may be employed to communicate between PSMAD dog 104 and computer 102. Alternatively, PSMAD dog 104 may communicate with computer 102 wirelessly if desired.

[0023] PSMAD dog 104 may include a plurality of PSMAD parts (such as nose 1 10, ear 1 12, head 114, legs 1 IS, etc.) One or more PSMAD parts may be individually moved by a motor disposed inside PSMAD dog 104, which motor is activated responsive to an alert generated by the anti-malware program in computer 102. The movement produced by the motors may be configurable by the user, in an embodiment. The PSMAD parts (e.g., nose, eye, etc.) may also be endowed with audio and/or visual transducers (e.g., speakers, lights, or LED displays or LCD displays) to generate an audible or visual cue responsive to an alert generated by the anti-maJ ware program.

[0024] Fig. 2 shows, in accordance with an embodiment of the invention, a block diagram of an architecture of a malware alert system 200, including a computer 202 and a PSMAD 204, Computer 202 represents a WINDOWS™ -based computer in the example of Fig. 2 although the exact operating system may vary in practice (e.g., an APPLE™ or LINUX™ computer may be employed as well). A maiware application 2 IO is shown in Fig. 2. PSMAD agent 212 represents the installed software that, is responsible for, among other tasks, receiving alerts from maiware application 210, for converting the aierts to the appropriate PSMAD commands, and for transmitting the PSMAD commands to PSMAD 204 so that the appropriate A/V pet cues may be generated

[0025] PSMAD agent 212 further performs configuration and customization tasks for

PSMAiS 204. For example, a user may employ an appropriate user interface (Ui) 216 to customize the association between a specific alert generated by maiware application 2 i0 and a specific A/V pet cue generated by PSMAD 204. As another example, a user may employ Ul 216 to customize the tone of the sound, the intensity of the light, or the other A/V pet cue characteristics associated with transducers in PSMAD 204,

[0026] The same customization capabilities also exist, in an embodiment, via

PSMAD 204. For example, the user may employ a customize button 220 in PSMAD 204 to perform any of the above-discussed customization without having to resort to Ul 216. The customization action by the user is sent to PSMAD agent 212 via USB input unit 222 and USB device driver 224.

[0027] PSMAD agent 212 and aπti-maiware application 210 communicate via

PSMAD communication API 226 and PSMAD communication API 228. PSMAD communication APi 226 represents the API that permits anti-maϊware application 210 to send aierts to and receive information (e.g., configuration or customization data) from PSMAD agent 212. Likewise PSMAD communication APi 228 represents the API that permits PSMAD agent 212 to receive alerts from and send information to aπti-malware application 210.

[0028] PSMAD 204 includes a plurality of transducer, shown as motors for tail 230, leg 232, ear 234, light 236, and speaker 238. These transducers are driven by alerts generated by anti -maiware application 210 (after being converted into appropriate commands via PSMAD agent 212). The commands are then received via USB control unit 224, Although this conversion function is shown disposed in computer 202 in the example of Fig. 2, the conversion function may be embedded within PSMAD 204 in an embodiment, In an embodiment, sensors may be provided with the transducers to allow PSMAD agent 212 and/or anti-malware application 2SO to ascertain the transducer status,

[0029] Fig. 3 shows, in accordance with an embodiment of the invention, the steps for providing a ma! ware-related alert the user using the PSMAD arrangement, In step 302, a ma! ware alert is generated. This malware alert may be generated because, for example, the anri-malware application has detected the presence of a virus or some specific content that the anti-ma! ware application has been scanning for. In step 304, the malware alert is sent via the PSMAD communication APi to the PSMAD agent. In step 306, the PSMAD agent converts the generated alert (e.g., virus detected in incoming email) to an appropriate PSMAD command (e.g., bark).

[0030] In step 308, the PSMAD command is transmitted from the PSMAD agent the

PSMAD In step 310, one or more PSMAD transducers are activated to signify that there is a malware alert. In an optional step 3 J 2, the user may employ the PSMAD to take a recommended action. For example, the user may push a button on a PSMAD dog's nose to delete the offending email that contains the virus.

[0031] When used to respond to an alert, different PSMAD buttons may be customized to perform different tasks. Alternatively or additional iy, the pushing of a button may, depending on the context, signify different actions for responding to different alerts. Pushing the nose button may signify deleting the offending email responsive to barking, but may signify placing an email to a specific spam email folder responsive to tail wagging (e.g., if tail waging indicates the detection of an incoming spam email).

[0032] As can be appreciated from the foregoing, the PSMAD arrangement, including the pet-shaped alert device, represents a user-friendly and aesthetically pleasing approach to providing unpleasant information (e.g.. a virus alert) to a computer user. By decoupling the PSMAD from the computer and implementing the PSMAD in a user-friendly, aesthetically pleasing manner, it is expected that users would be more likely to display the PSMAD prominently so that alerts may be more readily perceived. This is particularly true since the PSMAD is decoupled, as an information device, from the clutter displays of today's multitasking computers. The ability to configure both the A/^'V pet cues further improves user- friendliness. Additionally, since the user can readily reconfigure the association between an A/V pet cue and the type of malware alert generated by the anti-malware application, a. certain degree of privacy protection with respect to the type of malware encountered is furnished even though the PSMAD is intended to be publicly displayed and its A/V pet cues are intended to be readily perceptible to a human user.

[0033 J While this invention has been described in terms of several embodiments, there are alterations, permutations, and equivalents, which fall within the scope of this invention. It should also be noted that there are many alternative ways of implementing the methods and apparatuses of the present invention. It is therefore intended that the following appended claims be interpreted as including all such alterations, permutations, and equivalents as fall within the true spirit and scope of the present invention.

Claims

CLAIMS What is claimed is:

1. A mal ware alerting device coupled to a computer, said malware alerting device being configured to generate at least one of a human-perceptible visual cue and a human- perceptible audible cue responsive to a malware alert generated by an anti-mahvare application executing on said computer, said malware alerting device having a pet-shape to mimic a pet, comprising, at least two parts interconnected and individually movable against one another, each of said at least two parts mimicking a body part, of said pet; driver logic configured for receiving a command from said computer, said command being generated responsive to said inaJware alert generated by said auti-rnalware application, a transducer for generating one of said human-perceptible audible pet cue and said human-perceptible visual pet cue from said command, wherein said malware alerting device is external to said computer and couples to communication with said computer via one of a wired medium and a wireless medium,

2. The malware alerting device of claim ! wherein said malware alerting device communicates with said computer using the USB (universal serial bus) interface.

3. The malware alerting device of claim 1 further comprising: a customize button, said customize button being configured to permit an operator of said malware alerting device to customize said at least one of said human perceptible visual cue and said human perceptible audible cue.

4. The ma! ware alerting device of claim 1 further comprising: a customize button, said customize button being configured to permit an operator of said malware alerting device to customize an association between said at least one of said human perceptible visual cue and said human perceptible audible cue with a specific malware alert generated by said anti-malware application.

5. The malware alerting device of claim S wherein said anti-malware application is a virus scanning engine.

6. The malware alerting device of claim 1 wherein saitl anti-malware application is a spyvvare scanning engine.

7. The malware alerting device of claim \ wherein said pet represents a dog.

8. The malware alerting device of claim i wherein at least one of said at least two parts is coupled to a motor that is actuated responsive to said command,

9. A malware alerting system, comprising; a computer comprising, an anti-røahvare application configured to at least detect malware presence in said computer, a first communication application interface program executing cooperatively with said anti-malware application, a malware alerting device agent, and a second communication application interface program executing cooperatively with said alerting device agent, whereby said first communication application interface program and said second communication application interface program execute cooperatively with one another to facilitate communication between said anti-malware application and said malware alerting device agent; and a malware alerting device externally coupled to a computer, said malware alerting device being configured to generate at least one of a human-perceptible visual cue and a human-perceptible audible cue responsive to a malware alert generated when said malware presence is detected, said malware alerting device having a pet- shape to mimic a pet and includes: at least two parts interconnected and individually movable against one another, each of said at least two parts mi snicking a body part of said pet, driver logic configured for receiving a command from said malware alerting device agent said command being generated responsive to said malware alert generated by said anti-malware application, a transducer for generating one of said hum an -perceptible audible pet cue and said human-perceptible visual pet cue from said command..

10. The malware alerting system of claim 9 wherein said malware alerting device communicates with said computer using the USB (universal serial bus) interface.

11. The malware alerting system of claim 9 wherein said malware alerting device further comprising: a customize button, said customize button being configured to permit an operator of said malware alerting device to customize said at least one of said human perceptible visual cue and said human perceptible audible cue.

12. The malware alerting system of claim 9 wherein said maiware alerting device further comprising. a customize button, said customize button being configured to permit an operator of said malware alerting device to customize an association between said at least one of said human perceptible visual cue and said human perceptible audible cue with a specific maiware alert generated by said anti-malware application.

13. The maiware alerting system of claim 9 wherein said anti-maiware application is a virυs scanning engine.

14. The maiware alerting system of claim 9 wherein said anti-malware application is a spy ware scanning engine.

15. The maiware alerting system of claim 9 wherein said pet represents a dog.

16. The maiware alerting system of claim 9 wherein at least one of said at least two parts is coupled to a motor that is actuated responsive to said command.

17. A computer-implemented method, in a maiware alerting system having a maiware device externally coupled to a computer, for alerting a user of a maiware problem on said computer, said maiware alerting device being configured to generate at least one of a human- perceptible visual cue and a human-perceptible audible cue responsive to a maiware alert generated by an anti-malware application executing on said computer, said maiware alerting device having a pet-shape to mimic a pet and including at least two parts interconnected and individually movable against one another, each of said at least two parts mimicking a body part of said pet and a transducer for generating said at least one of said human-perceptible audible pet cue and said human-perceptible visual pet cue responsive to said maiware alert, comprising: generating said maiware alert using said anti-malware application upon detecting said maiware problem on said computer, communicating said maiware alert from said anti-malware application to a maiware alerting device agent executing on said computer; converting, using said maiware alerting device agent, said maiware alert into a command executable by software within said maiware alerting device; communicating said command from said maiware alerting device agent to said maiware alerting device, wherein said command is employed to generate, using said transducer, said at least one of said human-perceptible audible pet cue and said hum an - perceptible visual pet cue.

H

18. The computer-implementing method of claim 17 wherein said communicating said command from said malware alerting device agent to said ma! ware alerting device employs the USB (universal serial bus) interface.

19. The computer-implementing method of claim ϊ 7 further comprising, customizing, responsive to a request from a user via said malware alerting device, said at least one of said human perceptible visual cue and said human perceptible audible cue.

20. The computer-implementing method of claim 17 further comprising: customizing, responsive to a request from a user via said malware alerting device, an association between said at least one of said human perceptible visual cue and said human perceptible audible cue with a specific malware alert generated by said anti-malware application.

21. The computer-implementing method of claim i 7 wherein said anti-malware application is a virus scanning engine.

22. The computer-implementing method of claim 17 wherein said anti-malware application is a spyware scanning engine.

23. The computer-implementing method of claim 17 wherein said pet represents a dog.

24. The computer-implementing method of claim 17 wherein at least one of said at least two parts is coupled to a motor that is actuated responsive to said command,