Systems and Methods for Sharing the Results of Computing Operations Among Related Computing Systems

• US 20110191341A1
• Filed: 01/29/2010
• Published: 08/04/2011
• Est. Priority Date: 01/29/2010
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Buches, David, Meyer, James, Sobel, William E., McCorkendale, Bruce
• Granted Patent: US 9,002,972 B2
• Time in Patent Office: Days
• US Class Current: 707/736
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/562 Static detection

Abstract

A computer-implemented for sharing the results of computing operations among related computing systems may include: 1) identifying a need to perform a computing operation on a file, 2) identifying a unique identifier associated with the file, 3) determining, by using the unique identifier to query a shared store that is shared by a group of related computing systems, that at least one computing system within the group of related computing systems has previously performed the computing operation on an instance of the file, and then 4) retrieving the results of the computing operation from the shared store instead of performing the computing operation. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for sharing the results of computing operations among related computing systems, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying a need to perform a computing operation on a file;

identifying a unique identifier associated with the file;

determining, by using the unique identifier to query a shared store that is shared by a group of related computing systems, that at least one computing system within the group of related computing systems has previously performed the computing operation on an instance of the file;

retrieving the results of the computing operation from the shared store instead of performing the computing operation.

2. The method of claim 1, wherein the computing operation comprises at least one of:

a malware analysis of the file;

a data-loss-prevention analysis of the file;

a community-based-reputation lookup for the file;

a file-type analysis of the file.

3. The method of claim 1, wherein identifying a unique identifier associated with the file comprises identifying a hash of the file.

4. The method of claim 3, wherein identifying a hash of the file comprises at least one of:

creating the hash;

retrieving the hash from a local store.

5. The method of claim 4, further comprising:

determining that the file has been modified;

clearing information associated with the file from the local store.

6. The method of claim 1, further comprising, prior to identifying a unique identifier associated with the file, at least one of:

determining that an additional instance of the file is likely to be located on at least one additional computing system within the group of related computing systems;

determining that the file is unlikely to change frequently.

7. The method of claim 6, wherein determining that an additional instance of the file is likely to be located on at least one additional computing system within the group of related computing systems comprises at least one of:

determining that the file is located in a location that is likely to contain non-user-generated files;

determining that the file is not located in a location that is likely to contain user-generated files.

8. The method of claim 6, wherein determining that the file is unlikely to change frequently comprises at least one of:

determining that the file is located in a location that is commonly associated with static files;

determining that the file has changed less than a predetermined number of times within a predetermined period of time;

determining that the file has remained static over a predetermined period of time.

9. The method of claim 1, wherein the shared store contains at least one of:

a hash of the file;

the results of at least one computing operation performed in connection with the file;

the date of at least one computing operation performed in connection with the file.

10. The method of claim 9, wherein the results of the computing operation comprise information that identifies at least one of:

a classification assigned to the file during a malware analysis;

at least one rationale for the classification assigned to the file during the malware analysis;

at least one virus definition set or heuristic used when performing the malware analysis.

11. The method of claim 1, wherein determining that at least one computing system within the group of related computing systems has previously performed the computing operation on an instance of the file comprises determining that at least one computing system within the group of related computing systems has previously performed a malware analysis on an instance of the file using:

an identical virus definition set or heuristic;

a similar virus definition set or heuristic;

a more-recent virus definition set or heuristic.

12. The method of claim 1, wherein the shared store comprises at least a portion of at least one of:

a network-attached storage device;

a storage area network;

a file server;

a cloud-based storage device;

a secured partition of a local storage device managed by a hypervisor.

13. The method of claim 1, wherein the shared store is indexed based on file hashes.

14. The method of claim 1, wherein the group of related computing systems comprises:

a plurality of virtual machines running on a common host computing device;

a plurality of physical machines connected to a common network.

15. The method of claim 1, further comprising:

identifying a need to perform an additional computing operation on the file;

determining, by using the unique identifier to query the shared store, that the additional computing operation has not been previously performed on an instance of the file;

performing the additional computing operation on the file;

updating the shared store with the results of the additional computing operation.

16. A system for sharing the results of computing operations among related computing systems, the system comprising:

an operation-identification module programmed to identify a need to perform a computing operation on a file;

a file-identification module programmed to identify a unique identifier associated with the file;

a query module programmed to;

determine, by using the unique identifier to query a shared store that is shared by a group of related computing systems, that at least one computing system within the group of related computing systems has previously performed the computing operation on an instance of the file;

retrieving the results of the computing operation from the shared store instead of performing the computing operation;

at least one processor configured to execute the operation-identification module, the file-identification module, and the query module.

17. The system of claim 16, wherein the file-identification module is further programmed to determine, prior to identifying a unique identifier associated with the file, at least one of:

that an additional instance of the file is likely to be located on at least one additional computing system within the group of related computing systems;

that the file is unlikely to change frequently.

18. The system of claim 16, wherein the shared store contains at least one of:

a hash of the file;

the results of at least one computing operation performed in connection with the file;

the date of at least one computing operation performed in connection with the file.

19. The system of claim 16, wherein the shared store comprises at least a portion of at least one of:

a network-attached storage device;

a storage area network;

a file server;

a cloud-based storage device;

a secured partition of a local storage device managed by a hypervisor.

20. A computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify a need to perform a computing operation on a file;

identify a unique identifier associated with the file;

determine, by using the unique identifier to query a shared store that is shared by a group of related computing systems, that at least one computing system within the group of related computing systems has previously performed the computing operation on an instance of the file;

retrieve the results of the computing operation from the shared store instead of performing the computing operation.