System and method for triggering and performing scans to protect virtual environments

Patent metadata

Field	Value
Publication number	US-10610787-B2
Application number	US-201816004558-A
Country	US
Kind code	B2
Filing date	Jun 11, 2018
Priority date	Aug 26, 2008
Publication date	Apr 7, 2020
Grant date	Apr 7, 2020

Abstract

A system and method in a virtual universe system for triggering scans of virtual items and inventories of virtual items and for scanning the virtual items and inventories wherein the scans may be triggered by an avatar moving or teleporting from one region to another, or by an avatar picking up, dropping off, or accepting or purchasing an item. The degree of scanning may depend upon factors such as location where these scan triggers occur. The signature of the item may be identified by the scan process. The item signature may be compared against signatures of known malicious items stored in an inventory item signatures database and a summary of the signature comparison may be sent to a resident and stored in the resident's inventory.

First claim

We claim:

1. A method comprising:
detecting that an avatar with a virtual item in a virtual universe is entering or leaving a teleport action;
in response to the detecting, scanning the virtual item;
determining if the scanned virtual item has a geometry that differs from a normal virtual item, and if so:
triggering a virtual item alert and blocking the scanned virtual item,
checking attributes of the scanned virtual item against attributes of known malicious virtual items, and
updating an inventory virtual item safety summary accordingly.

2. The method as defined in claim 1 , further comprising determining if background monitoring is enabled.

3. The method as defined in claim 1 further comprising determining if the virtual item is being placed in or removed from an item inventory.

4. The method as defined in claim 1 further comprising determining if the virtual item is being picked up from or deposited in a region.

5. The method as defined in claim 1 further comprising:
determining if the virtual item is acting differently from a normal item; and
if it is determined that the virtual item is acting different from the normal item, triggering an item alert and blocking the virtual item.

6. The method as defined in claim 5 , further comprising:
if it is determined that the virtual item is acting differently from the normal item,
checking attributes of the virtual item against the attributes of known malicious virtual items, and
updating the inventory item safety summary accordingly.

7. The method as defined in claim 1 further comprising determining if the virtual item is being purchased.

8. A system comprising:
a memory medium comprising instructions;
a bus coupled to the memory medium; and
a processor coupled to the bus that when executing the instructions causes the system to:
detect that an avatar with a virtual item in a virtual universe is entering or leaving a teleport action;
in response to the detecting, scan, using a geometry scanner, the virtual item;
determine if the scanned virtual item has a geometry that differs from a normal virtual item, and if so:
trigger an item alert and block the scanned virtual item,
check attributes of the scanned virtual item against attributes of known malicious virtual items, and
update an inventory item safety summary accordingly.

9. The system of claim 8 , the memory medium further comprising instructions for causing the system to determine if background monitoring is enabled.

10. The system of claim 8 , the memory medium further comprising instructions for causing the system to determine if the virtual item is being placed in or removed from an item inventory.

11. The system of claim 8 , the memory medium further comprising instructions for causing the system to determine if the virtual item is being picked up from or deposited in a region.

12. The system of claim 8 , the memory medium further comprising instructions for causing the system to:
determine if the virtual item is acting differently than a normal item;
if so:
trigger an item alert and blocking the virtual item;
compare attributes of the item with attributes of known malicious items;
identify similarities and differences between the attributes of the virtual item with attributes of known malicious items;
determine maliciousness of the virtual item based upon the identified similarities and the differences; and
update the inventory item safety summary with the determined maliciousness of the virtual item.

13. The system of claim 8 , wherein the virtual item has a signature and a location and the virtual universe has an inventory virtual item signature database having signatures of known malicious virtual items, and wherein the memory medium further comprising instructions for causing the system to:
determine a location of the virtual item;
scan a signature of the virtual item based upon the location;
compare the signature of the virtual item with signatures of known malicious virtual items in an inventory virtual item signature database;
determine maliciousness of the virtual item based upon an extent of similarity of the match between the signature of the virtual item and the signatures of the known malicious virtual items in the inventory virtual item signature database; and
send, to a resident that owns the avatar, a notification of the maliciousness determination result.

14. A computer program product embodied in a computer readable storage device for operating in a system comprising at least one computer system having a network adapter for accessing a network, a processing unit, and a memory, for implementing a method, the method comprising:
detecting that an avatar with a virtual item in a virtual universe is entering or leaving a teleport action;
in response to the detecting, scanning the virtual item;
determining if the scanned virtual item has a geometry that differs from a normal virtual item, and if so:
triggering a virtual item alert and blocking the scanned virtual item,
checking attributes of the scanned virtual item against attributes of known malicious virtual items, and
updating an inventory virtual item safety summary accordingly.

15. The computer program product as defined in claim 14 wherein the method further comprises: determining if background monitoring is enabled.

16. The computer program product as defined in claim 14 wherein the method further comprises: determining if the virtual item is being placed in or removed from an item inventory.

17. The computer program product as defined in claim 14 wherein the method further comprises: determining if the virtual item is being picked up from or deposited in a region.

18. The computer program product as defined in claim 14 wherein the virtual item has a signature and a location and the virtual universe has an inventory virtual item signature database having signatures of known malicious virtual items and wherein the method further comprises:
determining a location of the virtual item;
scanning a signature of the virtual item based upon the location;
comparing the signature of the virtual item with signatures of known malicious virtual items in an inventory virtual item signature database;
determining the maliciousness of the virtual item based upon the extent of the similarity between the signature of the virtual item and the signatures of the known malicious virtual items in the inventory virtual item signature database; and
sending, to a resident that owns the avatar, a notification of the maliciousness determination result.

Assignees

• IBM

Inventors

• Hamilton Ii Rick A
• O'Connell Brian M
• Pickover Clifford A
• Walker Keith R

Classifications

• G06F21/564

  by virus signature recognition · CPC title

• G07F17/3241 Primary

  Security aspects of a gaming system, e.g. detecting cheating, device integrity, surveillance (computer security G06F21/00) · CPC title

• G06Q30/0643

  graphically representing goods, e.g. 3D product representation · CPC title

• A63F2300/5586

  for enforcing rights or rules, e.g. to prevent foul play · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title