05440723 is referenced by 508 patents and cites 12 patents.

A method includes the following component steps, or some functional subset of these steps: (A) periodic monitoring of a data processing system (10) for anomalous behavior that may indicate the presence of an undesirable software entity such as a computer virus, worm, or Trojan Horse; (B) automatic scanning for occurrences of known types of undesirable software entities and taking remedial action if they are discovered; (C) deploying decoy programs to capture samples of unknown types of computer viruses; (D) identifying machine code portions of the captured samples which are unlikely to vary from one instance of the virus to another; (E) extracting an identifying signature from the executable code portion and adding the signature to a signature database; (F) informing neighboring data processing systems on a network of an occurrence of the undesirable software entity; and (G) generating a distress signal, if appropriate, so as to call upon an expert to resolve difficult cases. A feature of this invention is the automatic execution of the foregoing steps in response to a detection of an undesired software entity, such as a virus or a worm, within a data processing system. The automatic extraction of the identifying signature, the addition of the signature to a signature data base, and the immediate use of the signature by a scanner provides protection from subsequent infections of the system, and also a network of systems, by the same or an altered form of the undesirable software entity.

Title
Automatic immune system for computers and computer networks
Application Number
8/4872
Publication Number
5440723
Application Date
January 19, 1993
Publication Date
August 8, 1995
Inventor
Steven R White
New York
NY, US
Jeffrey O Kephart
Yorktown Heights
NY, US
David M Chess
Mohegan Lake
NY, US
William C Arnold
Mahopac
NY, US
Agent
Perman & Green
Assignee
International Business Machines Corporation
NY, US
IPC
G06F 11/00
View Original Source