WO2008014021A2

WO2008014021A2 - Externally coupled malware alerting device and methods therefor

Info

Publication number: WO2008014021A2
Application number: PCT/US2007/064692
Authority: WO
Inventors: Chen Liang-Wei; Yueh Peng Yuan; Chu Chi-Hsi
Original assignee: Trend Micro Incorporated
Priority date: 2006-03-24
Filing date: 2007-03-22
Publication date: 2008-01-31
Also published as: WO2007112282A3; WO2007112282A2; WO2007112282A9; WO2008014021A3; WO2007112282B1

Abstract

A malware alerting device externally coupled to a computer (100, 106). The malware alerting device is configured to generate audiovisual cues responsive to a malware alert generated by an anti-malware application executing on the computer (102). The malware alerting device has a pet-shape to mimic a pet and includes at least two parts mimicking a body part of a pet (104,112, 11 The malware alerting device also includes driver logic configured for receiving a command from the computer, the command being generated responsive to the malware alert generated by the anti-malware application (102). The malware alerting device further includes a transducer for generating audiovisual cues from the command ( 104).

Description

EXTERNALLY COUPLED MALWARE ALERTING DEVICE AND

METHODS THEREFOR

BACKGROUND OF THE INVENTION

[0001] As computers become more sophisticated and more integrated into people's lives and work, people nowadays spend more and more time on computers. For example, computers nowadays are not only employed for work-related tasks but also for entertainment (e.g., downloaded or streamed movies or music), for communication (e.g., email, instant messaging, etc.), etc. It is also not unusual nowadays to find that some people turn on their computer in the morning, either at work or at home, and use their computer either continuously or periodically throughout the day, and do not turn their computer off until late in the evening. During the time the computer is running, the computer typically executes a multiplicity of programs and performs a multitude of tasks, often simultaneously.

[0002] Given the importance of computers to people's lives, it becomes more important than ever to ensure that the computer stays free of malware. Malware is defined herein as any unwanted program or message that can potentially damage or degrade the performance of the computer or an application. The term malware thus encompasses, for example, computer viruses, spyware, adware, email spam, instant messaging spam, etc.

[0003] The detection, prevention and removal of malware is typically performed by anti-malware applications. Generally speaking, anti-malware applications tend to execute in the background while the computer is running other applications and may perform tasks such as email scanning, virus scanning, spam detection, and malware removal. Trendmicro, Inc. of Cuptertino, CA is one well known maker of such anti-malware applications.

[0004] If malware is detected, the anti-malware application typically alerts the operator of the presence of the malware and may propose a specific action that, if taken by the operator, would neutralize the malware threat. By timely alerting the operator and timely responding to malware threats upon operator's command, potential damage to the software and/or hardware components of the computer is often averted.

[0005] As a default, the alert generated by the anti-malware application is typically presented as an on-screen warning to the operator. Unfortunately, with the computer being nearly always on and the display screen nearly always busy with information from a multitude of programs, it has become a challenge to alert the operator in a way that would timely capture the operator's attention without being overly annoying. [0006] For example, if the operator happens to be involved on another task (e.g., reading a paper report or talking on the phone) that does not require viewing the computer display screen, an on-screen alert may not capture the attention of the operator until after some time has passed, especially if the on-screen alert is one of many different messages being simultaneously displayed on the display screen. If a worker steps away from his cubicle (e.g., to talk to another cubicle occupant or to get a cup of coffee), the on-screen alert would be missed even if it is prominently displayed on the display screen.

[0007] Alerts that rely on an audible warning alarm may also be employed. For example, while an extra loud alert tone from the computer's speaker would most likely capture the operator's attention, such approach may not be conducive to a pleasant and productive office environment where cubicles or desks belonging to different workers may be in close proximity. In a home environment, a loud alert tone may be perceived as threatening or annoying especially to new or technically unsophisticated users, and may be a source of irritation to most users.

SUMMARY OF INVENTION

[0008] The invention relates, in an embodiment, to a malware alerting device coupled to a computer. The malware alerting device is configured to generate at least one of a human- perceptible visual cue and a human-perceptible audible cue responsive to a malware alert generated by an anti-malware application executing on the computer. The malware alerting device has a pet-shape to mimic a pet and includes at least two parts interconnected and individually movable against one another, each of the at least two parts mimicking a body part of the pet. The malware alerting device also includes driver logic configured for receiving a command from the computer, the command being generated responsive to the malware alert generated by the anti-malware application. The malware alerting device further includes a transducer for generating one of the human-perceptible audible pet cue and the human-perceptible visual pet cue from the command, wherein the malware alerting device is external to the computer and couples to communication with the computer via one of a wired medium and a wireless medium.

[0009] These and other features of the present invention will be described in more detail below in the detailed description of the invention and in conjunction with the following figures. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The present invention is illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings and in which like reference numerals refer to similar elements and in which:

[0011] Fig. 1 shows, in accordance with an embodiment, a malware alert system, including a computer and a PSMAD dog.

[0012] Fig. 2 shows, in accordance with an embodiment of the invention, a block diagram of an architecture of a malware alert system, including a computer and a PSMAD.

[0013] Fig. 3 shows, in accordance with an embodiment of the invention, the steps for providing a malware-related alert the user using the PSMAD arrangement.

DETAILED DESCRIPTION OF EMBODIMENTS

[0014] The present invention will now be described in detail with reference to a few embodiments thereof as illustrated in the accompanying drawings. In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, to one skilled in the art, that the present invention may be practiced without some or all of these specific details. In other instances, well known process steps and/or structures have not been described in detail in order to not unnecessarily obscure the present invention.

[0015] Various embodiments are described herein below, including methods and techniques. It should be kept in mind that the invention might also cover articles of manufacture that includes a computer readable medium on which computer-readable instructions for carrying out embodiments of the inventive technique are stored. The computer readable medium may include, for example, semiconductor, magnetic, opto- magnetic, optical, or other forms of computer readable medium for storing computer readable code. Further, the invention may also cover apparatuses for practicing embodiments of the invention. Such apparatus may include circuits, dedicated and/or programmable, to carry out tasks pertaining to embodiments of the invention. Examples of such apparatus include a general-purpose computer and/or a dedicated computing device when appropriately programmed and may include a combination of a computer/computing device and dedicated/programmable circuits adapted for the various tasks pertaining to embodiments of the invention.

[0016] In an embodiment, there is provided a pet-shaped malware alerting device

(PSMAD) that is configured to generate pet-specific audiovisual cues to alert the user of malware. The PSMAD may be a plastic and/or metal device that resembles for example a dog, a cat, or a fish, or a bird. These familiar shapes are chosen since the inventors herein believe that their presence are non-threatening due to their user-friendly shapes. By making the malware alerting devices more user-friendly and aesthetically pleasing, it is more likely that such devices will be prominently positioned in a work cubicle or a computer desk, making it more likely that the user's attention will be captured when an alert is necessary.

[0017] In an embodiment, the pet-shaped USB device (PSMAD) is configured to generate A/V pet cues, which may be visual and/or audible, to alert the user of malware. As the term is employed herein, an A/V pet cue may include a visual and/or audible manifestation that one typically expects from the animal which the PSMAD mimics. For example, if the PSMAD mimics a dog, an A/V pet cue for the PSMAD dog may be a bark, or head nodding, or tail wagging. If the PSMAD mimics a cat, the A/V pet cue for the PSMAD cat may be a cat meow, tail wagging, etc. The A/V pet cue may also include a visual or audible manifestation that is beyond what the real-life animal can duplicate. A PSMAD dog that talks, a PSMAD fish with eyes that can light up, or a PSMAD fish that can make a musical sound are examples of such PSMADs.

[0018] Different A/V pet cues may represent different types of alert. The association between an A/V pet cue (e.g., barking) and a specific type of alert (e.g., detection of virus in email) may be pre-set or may be made programmable. In some cases, the associations may be provided as default setting, with the operator having an option redefine the associations as desired. Accordingly, a bark by a PSMAD dog belonging to a user may signify a different malware threat from a bark by another PSMAD dog belonging to another user. Such configuration may be performed either via the computer on which a PSMAD agent is installed to execute along with the anti-malware application or via a configuration/customization button on the PSMAD.

[0019] In an embodiment, the PSMAD includes drivers and communication APIs

(Application Programming Interfaces) that enable the PSMAD to be integrated with an existing anti-malware application. In fact, the stimuli that result in the A/V pet cues are generated by anti-malware applications, with the PSMAD APIs and drivers converting the stimuli to the appropriate A/V pet cues.

[0020] In an embodiment, a PSMAD may be capable of generating different A/V pet cues with its various parts, either simultaneously or at separate times. For example, a PSMAD dog may be able to bark and wag its tail, either simultaneously or at separate times.

[0021] The A/V pet cues may also be configurable by the user, either via the computer on which a PSMAD agent is installed to execute along with the anti-malware application or via a configuration/customization button on the PSMAD. For example, the user may be able to use a user interface associated with the PSMAD agent or the configuration/customization button on the PSMAD in order to change the barking sound of a PSMAD dog barks.

[0022] The features and advantages of embodiments of the invention may be better understood with reference to the figures and discussions that follow. Fig. 1 shows, in accordance with an embodiment, a malware alert system 100 including a computer 102 and a PSMAD dog 104. Computer system 102, for example, may represent any desktop or laptop computer on which an anti-malware application may be executing. PSMAD dog 104 represents, in the example of Fig. 1, a mechanized dog-shape device that is coupled to the USB (Universal Serial Bus) port of computer 102 via USB cable 106. Although USB is used as the example protocol and has particular advantages with respect to auto-configuration and easy of installation, any suitable protocol may be employed to communicate between PSMAD dog 104 and computer 102. Alternatively, PSMAD dog 104 may communicate with computer 102 wirelessly if desired.

[0023] PSMAD dog 104 may include a plurality of PSMAD parts (such as nose 110, ear 112, head 114, legs 118, etc.) One or more PSMAD parts may be individually moved by a motor disposed inside PSMAD dog 104, which motor is activated responsive to an alert generated by the anti-malware program in computer 102. The movement produced by the motors may be configurable by the user, in an embodiment. The PSMAD parts (e.g., nose, eye, etc.) may also be endowed with audio and/or visual transducers (e.g., speakers, lights, or LED displays or LCD displays) to generate an audible or visual cue responsive to an alert generated by the anti-malware program.

[0024] Fig. 2 shows, in accordance with an embodiment of the invention, a block diagram of an architecture of a malware alert system 200, including a computer 202 and a PSMAD 204. Computer 202 represents a WINDOWS™-based computer in the example of Fig. 2 although the exact operating system may vary in practice (e.g., an APPLE™ or LINUX™ computer may be employed as well). A malware application 210 is shown in Fig. 2. PSMAD agent 212 represents the installed software that is responsible for, among other tasks, receiving alerts from malware application 210, for converting the alerts to the appropriate PSMAD commands, and for transmitting the PSMAD commands to PSMAD 204 so that the appropriate A/V pet cues may be generated.

[0025] PSMAD agent 212 further performs configuration and customization tasks for

PSMAD 204. For example, a user may employ an appropriate user interface (UI) 216 to customize the association between a specific alert generated by malware application 210 and a specific A/V pet cue generated by PSMAD 204. As another example, a user may employ UI 216 to customize the tone of the sound, the intensity of the light, or the other A/V pet cue characteristics associated with transducers in PSMAD 204.

[0026] The same customization capabilities also exist, in an embodiment, via

PSMAD 204. For example, the user may employ a customize button 220 in PSMAD 204 to perform any of the above-discussed customization without having to resort to UI 216. The customization action by the user is sent to PSMAD agent 212 via USB input unit 222 and USB device driver 224.

[0027] PSMAD agent 212 and anti-malware application 210 communicate via

PSMAD communication API 226 and PSMAD communication API 228. PSMAD communication API 226 represents the API that permits anti-malware application 210 to send alerts to and receive information (e.g., configuration or customization data) from PSMAD agent 212. Likewise PSMAD communication API 228 represents the API that permits PSMAD agent 212 to receive alerts from and send information to anti-malware application 210.

[0028] PSMAD 204 includes a plurality of transducer, shown as motors for tail 230, leg 232, ear 234, light 236, and speaker 238. These transducers are driven by alerts generated by anti-malware application 210 (after being converted into appropriate commands via PSMAD agent 212). The commands are then received via USB control unit 224. Although this conversion function is shown disposed in computer 202 in the example of Fig. 2, the conversion function may be embedded within PSMAD 204 in an embodiment. In an embodiment, sensors may be provided with the transducers to allow PSMAD agent 212 and/or anti-malware application 210 to ascertain the transducer status.

[0029] Fig. 3 shows, in accordance with an embodiment of the invention, the steps for providing a malware-related alert the user using the PSMAD arrangement. In step 302, a malware alert is generated. This malware alert may be generated because, for example, the anti-malware application has detected the presence of a virus or some specific content that the anti-malware application has been scanning for. In step 304, the malware alert is sent via the PSMAD communication API to the PSMAD agent. In step 306, the PSMAD agent converts the generated alert (e.g., virus detected in incoming email) to an appropriate PSMAD command (e.g., bark).

[0030] In step 308, the PSMAD command is transmitted from the PSMAD agent the

PSMAD. In step 310, one or more PSMAD transducers are activated to signify that there is a malware alert. In an optional step 312, the user may employ the PSMAD to take a recommended action. For example, the user may push a button on a PSMAD dog's nose to delete the offending email that contains the virus.

[0031] When used to respond to an alert, different PSMAD buttons may be customized to perform different tasks. Alternatively or additionally, the pushing of a button may, depending on the context, signify different actions for responding to different alerts. Pushing the nose button may signify deleting the offending email responsive to barking, but may signify placing an email to a specific spam email folder responsive to tail wagging (e.g., if tail waging indicates the detection of an incoming spam email).

[0032] As can be appreciated from the foregoing, the PSMAD arrangement, including the pet-shaped alert device, represents a user-friendly and aesthetically pleasing approach to providing unpleasant information (e.g., a virus alert) to a computer user. By decoupling the PSMAD from the computer and implementing the PSMAD in a user-friendly, aesthetically pleasing manner, it is expected that users would be more likely to display the PSMAD prominently so that alerts may be more readily perceived. This is particularly true since the PSMAD is decoupled, as an information device, from the clutter displays of today's multitasking computers. The ability to configure both the A/V pet cues further improves user- friendliness. Additionally, since the user can readily reconfigure the association between an A/V pet cue and the type of malware alert generated by the anti-malware application, a certain degree of privacy protection with respect to the type of malware encountered is furnished even though the PSMAD is intended to be publicly displayed and its A/V pet cues are intended to be readily perceptible to a human user.

[0033] While this invention has been described in terms of several embodiments, there are alterations, permutations, and equivalents, which fall within the scope of this invention. It should also be noted that there are many alternative ways of implementing the methods and apparatuses of the present invention. It is therefore intended that the following appended claims be interpreted as including all such alterations, permutations, and equivalents as fall within the true spirit and scope of the present invention.

Claims

CLAIMSWhat is claimed is:

1. A malware alerting device coupled to a computer, said malware alerting device being configured to generate at least one of a human-perceptible visual cue and a human- perceptible audible cue responsive to a malware alert generated by an anti-malware application executing on said computer, said malware alerting device having a pet-shape to mimic a pet, comprising; at least two parts interconnected and individually movable against one another, each of said at least two parts mimicking a body part of said pet; driver logic configured for receiving a command from said computer, said command being generated responsive to said malware alert generated by said anti-malware application, a transducer for generating one of said human-perceptible audible pet cue and said human-perceptible visual pet cue from said command, wherein said malware alerting device is external to said computer and couples to communication with said computer via one of a wired medium and a wireless medium.

2. The malware alerting device of claim 1 wherein said malware alerting device communicates with said computer using the USB (universal serial bus) interface.

3. The malware alerting device of claim 1 further comprising: a customize button, said customize button being configured to permit an operator of said malware alerting device to customize said at least one of said human perceptible visual cue and said human perceptible audible cue.

4. The malware alerting device of claim 1 further comprising: a customize button, said customize button being configured to permit an operator of said malware alerting device to customize an association between said at least one of said human perceptible visual cue and said human perceptible audible cue with a specific malware alert generated by said anti-malware application.

5. The malware alerting device of claim 1 wherein said anti-malware application is a virus scanning engine.

6. The malware alerting device of claim 1 wherein said anti-malware application is a spyware scanning engine.

7. The malware alerting device of claim 1 wherein said pet represents a dog.

8. The malware alerting device of claim 1 wherein at least one of said at least two parts is coupled to a motor that is actuated responsive to said command,

9. A malware alerting system, comprising; a computer comprising: an anti-malware application configured to at least detect malware presence in said computer, a first communication application interface program executing cooperatively with said anti-malware application, a malware alerting device agent, and a second communication application interface program executing cooperatively with said alerting device agent, whereby said first communication application interface program and said second communication application interface program execute cooperatively with one another to facilitate communication between said anti-malware application and said malware alerting device agent; and a malware alerting device externally coupled to a computer, said malware alerting device being configured to generate at least one of a human-perceptible visual cue and a human-perceptible audible cue responsive to a malware alert generated when said malware presence is detected, said malware alerting device having a pet- shape to mimic a pet and includes: at least two parts interconnected and individually movable against one another, each of said at least two parts mimicking a body part of said pet, driver logic configured for receiving a command from said malware alerting device agent, said command being generated responsive to said malware alert generated by said anti-malware application, a transducer for generating one of said human-perceptible audible pet cue and said human-perceptible visual pet cue from said command..

10. The malware alerting system of claim 9 wherein said malware alerting device communicates with said computer using the USB (universal serial bus) interface.

11. The malware alerting system of claim 9 wherein said malware alerting device further comprising: a customize button, said customize button being configured to permit an operator of said malware alerting device to customize said at least one of said human perceptible visual cue and said human perceptible audible cue.

12. The malware alerting system of claim 9 wherein said malware alerting device further comprising: a customize button, said customize button being configured to permit an operator of said malware alerting device to customize an association between said at least one of said human perceptible visual cue and said human perceptible audible cue with a specific malware alert generated by said anti-malware application.

13. The malware alerting system of claim 9 wherein said anti-malware application is a virus scanning engine.

14. The malware alerting system of claim 9 wherein said anti-malware application is a spyware scanning engine.

15. The malware alerting system of claim 9 wherein said pet represents a dog.

16. The malware alerting system of claim 9 wherein at least one of said at least two parts is coupled to a motor that is actuated responsive to said command.

17. A computer-implemented method, in a malware alerting system having a malware device externally coupled to a computer, for alerting a user of a malware problem on said computer, said malware alerting device being configured to generate at least one of a human- perceptible visual cue and a human-perceptible audible cue responsive to a malware alert generated by an anti-malware application executing on said computer, said malware alerting device having a pet-shape to mimic a pet and including at least two parts interconnected and individually movable against one another, each of said at least two parts mimicking a body part of said pet and a transducer for generating said at least one of said human-perceptible audible pet cue and said human-perceptible visual pet cue responsive to said malware alert, comprising: generating said malware alert using said anti-malware application upon detecting said malware problem on said computer; communicating said malware alert from said anti-malware application to a malware alerting device agent executing on said computer; converting, using said malware alerting device agent, said malware alert into a command executable by software within said malware alerting device; communicating said command from said malware alerting device agent to said malware alerting device, wherein said command is employed to generate, using said transducer, said at least one of said human-perceptible audible pet cue and said human- perceptible visual pet cue.

18. The computer-implementing method of claim 17 wherein said communicating said command from said malware alerting device agent to said malware alerting device employs the USB (universal serial bus) interface.

19. The computer-implementing method of claim 17 further comprising: customizing, responsive to a request from a user via said malware alerting device, said at least one of said human perceptible visual cue and said human perceptible audible cue.

20. The computer-implementing method of claim 17 further comprising: customizing, responsive to a request from a user via said malware alerting device, an association between said at least one of said human perceptible visual cue and said human perceptible audible cue with a specific malware alert generated by said anti-malware application.

21. The computer-implementing method of claim 17 wherein said anti-malware application is a virus scanning engine.

22. The computer-implementing method of claim 17 wherein said anti-malware application is a spyware scanning engine.

23. The computer-implementing method of claim 17 wherein said pet represents a dog.

24. The computer-implementing method of claim 17 wherein at least one of said at least two parts is coupled to a motor that is actuated responsive to said command,