Selective virus scanning system and method

• US 20060236398A1
• Filed: 04/14/2005
• Published: 10/19/2006
• Est. Priority Date: 04/14/2005
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated (Kyndryl Holdings, Inc.), ServiceNow Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Pankaj, Pathak, Jangal, Amit K., Trakic, Adnan
• Granted Patent: US 8,590,044 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/562 Static detection

Abstract

A virus scanning system and method. A system is provide that includes: a full scanning system for performing a full scan of each file in a file system; a file inventory system for inventorying each file in the file system and generating a set of inventory records, wherein each inventory record includes a unique key associated with each file in the file system; an inventory compare system for comparing a current set of inventory records with an existing set of inventory records to identify files in the file system that were modified since the existing set of inventory records was generated; and a selective scanning system for selectively scanning only files in the file system that were identified as modified by the inventory compare system.

Claims

1. A virus scan system, comprising:

a full scanning system for performing a full scan of each file in a file system;

a file inventory system for inventorying each file in the file system and generating a set of inventory records, wherein each inventory record includes a unique key associated with each file in the file system;

an inventory compare system for comparing a current set of inventory records with an existing set of inventory records to identify files in the file system that were modified since the existing set of inventory records was generated; and

a selective scanning system for selectively scanning only files in the file system that were identified as modified by the inventory compare system.

2. The virus scan system of claim 1, wherein the unique key includes a size and timestamp of the associated file.

3. The virus scan system of claim 1, further comprising a system for forcing a full scan.

4. The virus scan system of claim 1, wherein the full scan system is implemented if the existing set of inventory records does not exist, and is not implemented if the existing set of inventory records exists.

5. The virus scan system of claim 1, wherein the selective scan system is implemented if the existing set of inventory records exists, and is not implemented if the existing set of inventory records does not exist.

6. The virus scan system of claim 1, further comprising a system for interfacing with a server to store and retrieve the existing set of inventory records.

7. A program product stored on a computer readable medium for performing a virus scan on a file system, the program product comprising:

program code configured for performing a full scan of each file in the file system;

program code configured for inventorying each file in the file system and generating a set of inventory records, wherein each inventory record includes a unique key associated with each file in the file system;

program code configured for comparing a current set of inventory records with an existing set of inventory records to identify files in the file system that were modified since the existing set of inventory records was generated; and

program code configured for selectively scanning only files in the file system that were identified as modified.

8. The program product of claim 7, wherein the unique key includes a size and timestamp of the associated file.

9. The program product of claim 7, further comprising means for forcing a full scan.

10. The program product of claim 7, wherein a full scan is run if the existing set of inventory records does not exist, and is not run if the existing set of inventory records exists.

11. The program product of claim 7, wherein a selective scan is run if the existing set of inventory records exists, and is not run if the existing set of inventory records does not exist.

12. The program product of claim 7, further comprising a system for interfacing with a server to store and retrieve the existing set of inventory records.

13. A method of performing a virus scan on a file system, comprising:

inventorying each file in the file system and generating a current set of inventory records, wherein each inventory record includes a unique key associated with each file in the file system;

if an existing set of inventory records is located, comparing the current set of inventory records with the existing set of inventory records to identify files in the file system that were modified since the existing set of inventory records were generated, and selectively scanning only files in the file system that were identified as modified; and

if the existing set of inventory records is not located, performing a full scan of each file in the file system.

14. The method of claim 13, wherein the unique key includes a size and timestamp of the associated file.

15. The method of claim 14, wherein the comparing step compares keys to determine if a file has been modified.

16. The method of claim 13, further comprising the step of forcing a full scan from a network server.

17. The method of claim 13, further comprising the step of interfacing with a server to retrieve the existing set of inventory records.

18. The method of claim 13, further comprising the step of updating the existing set of inventory records with the current set of inventory records after a scan is completed.

19. A method for deploying an application that scans a file system for viruses, comprising:

providing a computer infrastructure being operable to;

perform a full scan of each file in a file system;

inventory each file in the file system and generating a set of inventory records, wherein each inventory record includes a unique key associated with each file in the file system;

compare a current set of inventory records with an existing set of inventory records to identify files in the file system that were modified since the existing set of inventory records was generated; and

selectively scan only files in the file system that were identified as modified by the inventory compare system.

20. Computer software embodied in a propagated signal for scanning a file system for viruses, the computer software comprising instructions to cause a computer to perform the following functions:

inventory each file in the file system and generate a current set of inventory records, wherein each inventory record includes a unique key associated with each file in the file system;

if an existing set of inventory records is located, compare the current set of inventory records with the existing set of inventory records to identify files in the file system that were modified since the existing set of inventory records were generated, and selectively scan only files in the file system that were identified as modified; and

if the existing set of inventory records is not located, perform a full scan of each file in the file system.