1. A method for monitoring an enterprise information system (EIS) server by a client comprising:
connecting to the EIS server in a first phase; wherein in the first phase, the client establishes a policy, heartbeat intervals and user exits to handle degraded conditions of the EIS server, the client sends a connection request to the EIS server with a heartbeat interval the EIS server processes the connection request and provides initial degraded status information, the EIS server initiates an internal monitor for identified processing resources;
processing requests from a web service in a second phase; wherein in the second phase, the client receives the degraded status information and takes action based on the policy and user exits and requests status for missing heartbeat intervals and reaching timeout threshold; the EIS server monitors identified processing services; sends an availability message with degraded status information to the client and processes the status requests from the client; and
disconnecting the client from the EIS server in a third phase, wherein in the third phase the EIS server monitors the processing resources without sending a status message.
2. The method of claim 1 wherein the heartbeat interval identifies how often the EIS server needs to send availability information with a degraded status to the client.
3. The method of claim 1 wherein the heartbeat interval comprises a plurality of heartbeat intervals, the plurality of heartbeat levels includes a primary interval when the EIS server is healthy and a secondary interval when the EIS server is degraded.
4. The method of claim 1 wherein the EIS server maintains an availability level which represents the ability of the EIS server to process work.
5. The method of claim 4 wherein the availability levels comprise first, second and third levels, wherein the first level indicates that the EIS server is unavailable for work, the second level indicates that the EIS server is degraded but can still accept work and the third level indicates that the EIS server is available for work.
6. The method of claim 1 wherein the availability message includes an overall availability status, a bit map for unavailability resources, a bit map for degraded resources, and the EIS server name to identify the source of the message.
7. The method of claim 1 wherein the overall ability status comprises a 2-byte status code.
8. A system for monitoring an enterprise information system (EIS) server by a client comprising:
means for connecting to the EIS server in a first phase; wherein in the first phase, the client establishes a policy, heartbeat intervals and user exits to handle degraded conditions of the EIS server, the client sends a connection request to the EIS server with a heartbeat interval, the EIS server processes the connection request and provides initial degraded status information, the EIS server initiates an internal monitor for identified processing resources;
means for processing requests from a web service in a second phase; wherein in the second phase the client receives the degraded status information and takes action based on the policy and user exits and requests status for missing heartbeat intervals and reaching timeout threshold; the EIS server monitors identified processing services; sends an availability message with degraded status information to the client and processes the status requests from the client; and
means for disconnecting the client from the EIS server in a third phase, wherein in the third phase the EIS server monitors the processing resources without sending a status message.
9. The system of claim 1 wherein the heartbeat interval identifies how often the EIS server needs to send availability information with a degraded status to the client.
10. The system of claim 1 wherein the heartbeat interval comprises a plurality of heartbeat intervals, the plurality of heartbeat levels includes a primary interval when the EIS server is healthy and a secondary interval when the EIS server is degraded.
11. The system of claim 1 wherein the EIS server maintains an availability level which represents the ability of the EIS server to process work.
12. The system of claim 4 wherein the availability levels comprise first second and third levels, wherein the first level indicates that the EIS server is unavailable for work, the second level indicates that the EIS server is degraded but can still accept work and the third level indicates that the EIS server is available for work.
13. The system of claim 1 wherein the availability message includes an overall availability status, a bit map for unavailability resources, a bit map for degraded resources and the EIS server name to identify the source of the message.
14. The system of claim 1 wherein the overall ability status comprises a 2-byte status code.
15. A method for monitoring an enterprise information system (EIS) server by a client comprising:
connecting to the EIS server in a first phase; wherein in the first phase, the client establishes a policy, heartbeat intervals and user exits to handle degraded conditions of the EIS server the client sends a connection request to the EIS server with a heartbeat interval wherein the heartbeat interval identifies how often the EIS server needs to send availability information with a degraded status to the client, the EIS server processes the connection request and provides initial degraded status information, the EIS server initiates an internal monitor for identified processing resources;
processing requests from a web service in a second phase; wherein in the second phase, the client receives the degraded status information and takes action based on the policy and user exits and requests status for missing heartbeat intervals and reaching timeout threshold; the EIS server monitors identified processing services; sends an availability message with degraded status information to the client and processes the status requests from the client; wherein the availability level wherein the EIS server maintains an availability level which represents the ability of the processor to process work, comprise first, second and third levels, wherein the first level indicates that the EIS server is unavailable for work, the second level indicates that the EIS server is degraded but can still accept work and the third level indicates that the EIS server is available for work, wherein the availability message includes an overall availability status, a bit map for unavailability resources and a bit map for degraded resources; and
disconnecting the client from the EIS server in a third phase, wherein in the third phase the EIS server monitors the processing resources without sending a status message.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A non-transitory computer-readable medium embodying a program executable in a first computing device, comprising code that configures one or more processors to:
access, by the first computing device, a source code of an application sent from a second computing device in response to an attempted installation of the application on the second computing device, the source code being obtained by unpacking a package file of the application to identify the source code;
generate a fingerprint of the source code, the fingerprint being generated by segmenting the source code into two or more segments and hashing each of the two or more segments;
compare the fingerprint of the source code to a plurality of fingerprint records in a fingerprint database to determine whether the fingerprint exists in the fingerprint database;
determine whether the application comprises malware in response to the fingerprint matching one or more of the plurality of fingerprint records in the fingerprint database, the determination made by comparing the source code to records in a malware database; and
in response to the application not comprising malware, sending a response to the second computing device that permits an installation of the application on the second computing device.
2. The non-transitory computer-readable medium of claim 1, wherein comparing the fingerprint of the source code to the plurality of fingerprint records in the fingerprint database further comprises determining whether the fingerprint has a degree of similarity to a respective fingerprint in the fingerprint database according to a predefined threshold.
3. The non-transitory computer-readable medium of claim 1, wherein the source code is accessed by the first computing device from the second computing device in response to an attempted execution of the application on the second computing device.
4. A system, comprising:
a first computing device in communication with a second computing device over a network; and
a malware detection service executable in the first computing device, the malware detection service comprising logic configured to:
access a source code of an application sent from the second computing device in response to an attempted installation of the application on the second computing device, the source code being obtained by unpacking the application to parse the source code from the application;
determine whether the source code exists in a source code database;
if the source code does not exist in the source code database, make a determination whether the application comprises malware by comparing the source code to a plurality of records in a malware database; and
generate a response to be transmitted to the second computing device indicating whether an installation is to be permitted on the second computing device.
5. The system of claim 4, wherein determining whether the source code exists in the source code database further comprises determining whether the source code has a degree of similarity to a respective source code in the source code database according to a predefined threshold.
6. The system of claim 4, wherein the source code is received by the first computing device from the second computing device in response to an attempted execution of the application on the second computing device.
7. The system of claim 4, wherein the comparison of the source code of the application to the malware database further comprises logic that periodically determines whether the application comprises malware by comparing the source code to the plurality of records in the malware database.
8. The system of claim 4, wherein determining whether the source code exists in the source code database further comprises:
logic configured to hash the source code to generate a fingerprint of the source code, wherein the fingerprint is a unique identifier of the source code; and
logic configured to compare the fingerprint of the source code to a plurality of fingerprint records in a fingerprint database to determine whether the fingerprint of the source code exists in the fingerprint database.
9. The system of claim 4, wherein the source code of the application is obtained by unpacking a package file of the application.
10. The system of claim 4, further comprising logic configured to add the application to an approved application database if the determination is made that the source code of the application does not comprise malware.
11. The system of claim 4, further comprising logic configured to add the application to a denied application database if the determination is made that the source code of the application comprises malware.
12. The system of claim 4, further comprising logic configured to initiate an event in response to the determination that the application comprises malware.
13. The system of claim 4, further comprising logic configured to generate a notification associated with the response to be transmitted to the second computing device.
14. A method, comprising:
identifying, by a first computing device, an attempted installation of an application on the first computing device;
comparing, by the first computing device, a source code of the application to a unique identifier stored locally on the first computing device to determine whether the source code differs from the unique identifier, sending, by the first computing device;
if the source code differs from the unique identifier, sending, by the first computing device, the source code of the application to a second computing device for inspection;
receiving a response from the second computing device indicating whether the application comprises malware; and
if the response indicates the application does not comprise malware, initiating, by the first computing device, an installation of the application on the first computing device.
15. The method of claim 14, further comprising initiating, by the first computing device, an execution of the application on the first computing device if the response indicates the application does not comprise malware.
16. The method of claim 14, wherein comparing, by the first computing device, the source code of the application to the unique identifier stored locally on the first computing device further comprises:
generating, by the first computing device, a fingerprint of the source code using a hash; and
comparing, by the first computing device, the fingerprint to a plurality of fingerprint records in a fingerprint database stored locally on the first computing device.
17. The method of claim 14, wherein comparing the source code of the application to the unique identifier stored locally on the first computing device further comprises determining whether the source code has a degree of similarity to the unique identifier according to a predefined threshold.
18. The method of claim 14, further comprising initiating, by the first computing device, a quarantine of the application on the first computing device if the response indicates the application comprises malware.
19. The method of claim 14, further comprising initiating, by the first computing device, an uninstallation of the application on the first computing device if the response indicates the application comprises malware.
20. The method of claim 14, further comprising overriding, by the first computing device, an indication of the response to perform an action on the first computing device based at least in part on a user configuration.