Scanner API for executing multiple scanning engines

• US 20030051154A1
• Filed: 07/26/2001
• Published: 03/13/2003
• Est. Priority Date: 07/26/2001
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Tarbotton, Lee Codel Lawson, Barton, Chris A., Lucas, Martin J.
• Granted Patent: US 6,944,775 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/562 Static detection

Abstract

A system, method and computer program product are provided for scanning data utilizing multiple scanning engines. Initially, a request for data to be scanned for viruses is generated utilizing a scanning interface. Thereafter, such request to scan data is sent to a plurality of scanning engines utilizing an engine interface application control module coupled between the scanning interface and the scanning engines. The request is adapted for prompting the scanning engines to scan the data and respond with events upon locating a virus. Such events are then received utilizing an event processor module coupled to the scanning engines and the engine interface application control module for processing the events. The processed events are then sent to the engine interface application control module for being monitored by the scanning interface.

Claims

1. A method for scanning data utilizing multiple scanning engines, comprising:

(a) generating a request for data to be scanned for viruses utilizing a scanning interface;

(b) sending the request to scan data to a plurality of scanning engines utilizing an engine interface application control module coupled between the scanning interface and the scanning engines, the request being adapted for prompting the scanning engines to scan the data and respond with events upon locating a virus;

(c) receiving the events utilizing an event processor module coupled to the scanning engines and the engine interface application control module for processing the events; and

(d) transmitting the processed events to the engine interface application control module for being monitored by the scanning interface.

2. The method as recited in claim 1, wherein the engine interface application control module and the event processor module reside on a gateway.

3. The method as recited in claim 2, wherein the scanning interface automatically generates the request in response to the receipt of data at the gateway.

4. The method as recited in claim 1, wherein the scanning interface includes a graphical user interface for allowing a user to manually generate the request.

5. The method as recited in claim 1, wherein the engine interface application control module translates the requests for each of the scanning engines.

6. The method as recited in claim 1, wherein the event processor module translates the events from each of the scanning engines into a single format.

7. The method as recited in claim 6, wherein the translated events are transmitted to the scanning interface for outputting the event.

8. The method as recited in claim 1, wherein the scanning engines are proprietary scanning engines.

9. The method as recited in claim 1, wherein the scanning engines are incompatible scanning engines.

10. A computer program product for scanning data utilizing multiple scanning engines, comprising:

(a) computer code for generating a request for data to be scanned for viruses utilizing a scanning interface;

(b) computer code for sending the request to scan data to a plurality of scanning engines utilizing an engine interface application control module coupled between the scanning interface and the scanning engines, the request being adapted for prompting the scanning engines to scan the data and respond with events upon locating a virus;

(c) computer code for receiving the events utilizing an event processor module coupled to the scanning engines and the engine interface application control module for processing the events; and

(d) computer code for transmitting the processed events to the engine interface application control module for being monitored by the scanning interface.

11. The computer program product as recited in claim 10, wherein the engine interface application control module and the event processor module reside on a gateway.

12. The computer program product as recited in claim 11, wherein the scanning interface automatically generates the request in response to the receipt of data at the gateway.

13. The computer program product as recited in claim 10, wherein the scanning interface includes a graphical user interface for allowing a user to manually generate the request.

14. The computer program product as recited in claim 10, wherein the engine interface application control module translates the requests for each of the scanning engines.

15. The computer program product as recited in claim 10, wherein the event processor module translates the events from each of the scanning engines into a single format.

16. The computer program product as recited in claim 15, wherein the translated events are transmitted to the scanning interface for outputting the event.

17. The computer program product as recited in claim 10, wherein the scanning engines are proprietary scanning engines.

18. The computer program product as recited in claim 10, wherein the scanning engines are incompatible scanning engines.

19. The computer program product as recited in claim 10, wherein the events include the identification of at least one of unwanted content, viruses and malicious code.

20. A system for scanning data utilizing multiple scanning engines, comprising:

(a) a scanning interface for generating a request for data to be scanned for viruses;

(b) an engine interface application control module coupled between the scanning interface and a plurality of scanning engines for sending the request to scan data to the scanning engines, the request being adapted for prompting the scanning engines to scan the data and respond with events upon locating a virus; and

(c) an event processor module coupled to the scanning engines and the engine interface application control module for receiving the events and processing the events;

(d) wherein the processed events are outputted by the scanning interface.

21. A method for scanning data utilizing multiple scanning engines, comprising:

(a) means for generating a request for data to be scanned for viruses;

(b) means for sending the request to scan data to the scanning engines, the requests being adapted for prompting the scanning engines to scan the data and respond with events upon locating a virus; and

(c) means for receiving the events and processing the events.

22. A method for scanning data utilizing multiple scanning engines, comprising:

(a) receiving data at a gateway;

(b) generating a request for the data to be scanned for viruses in response to the receipt of data at the gateway utilizing a scanning interface;

(c) translating the request utilizing an engine interface application control module coupled between the scanning interface and a plurality of scanning engines;

(d) sending the translated request to the scanning engines utilizing the engine interface application control module, the request being adapted for prompting the scanning engines to scan the data and respond with events upon locating a virus;

(e) receiving the events utilizing an event processor module coupled to the scanning engines and the engine interface application control module;

(f) checking an integrity of the events received utilizing the event processor module;

(g) translating the events into a common format utilizing the event processor module if the events pass the integrity check;

(h) transmitting the translated events to the engine interface application control module; and

(i) outputting the translated events utilizing the scanning interface.