SYSTEM AND METHOD OF WHITELISTING PARENT VIRTUAL IMAGES

• US 20120066762A1
• Filed: 09/13/2010
• Published: 03/15/2012
• Est. Priority Date: 09/13/2010
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Todorovic, Rade
• Granted Patent: US 8,407,804 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

In embodiments of the present invention improved capabilities are described for virtual machine scan optimization. In response to a change in the primary virtual machine, the virtual machine scan optimization may involve comparing the primary virtual machine to the related virtual machine and tracking changes of the primary virtual machine with respect to the related virtual machine wherein the changes are identified by location within the primary virtual machine; forming a tracked changes log; generating a relevant file map of the primary virtual machine wherein the relevant file map includes a plurality of relevant files and each of the plurality of relevant files'"'"' locations in the primary virtual machine; comparing the changed locations identified in the track changes log with the locations of the plurality of relevant files to determine if any one of the plurality of relevant files has been changed; and in the event that a relevant file has been changed, as indicated by the comparison of the relevant file map to the tracked changes log, causing the changed relevant file to be security scanned.

Claims

1. A computer program product embodied in a computer readable medium that, when executing on one or more computers, reduces scanning requirements of a primary virtual machine based on an understanding of a related virtual machine, by performing the steps of:

in response to a change in the primary virtual machine, comparing the primary virtual machine to the related virtual machine and tracking changes of the primary virtual machine with respect to the related virtual machine wherein the changes are identified by location within the primary virtual machine, forming a tracked changes log;

generating a relevant file map of the primary virtual machine wherein the relevant file map includes a plurality of relevant files and each of the plurality of relevant files'"'"' locations in the primary virtual machine;

comparing the changed locations identified in the track changes log with the locations of the plurality of relevant files to determine if any one of the plurality of relevant files has been changed; and

in the event that a relevant file has been changed, as indicated by the comparison of the relevant file map to the tracked changes log, causing the changed relevant file to be security scanned.

2. The computer program product of claim 1 wherein if a tracked change exists, but the map indicates that no relevant files reside in that location, then no security scan is done.

3. The computer program product of claim 1, wherein an alert is generated prior to the security scan.

4. The computer program product of claim 1, further comprising, allowing the security scan to be deferred by a user.

5. The computer program product of claim 1, further comprising, if a change in the related virtual machine is indicated in the tracked changes log, the user is given the option of performing additional tasks.

6. The computer program product of claim 5, wherein the additional task is updating a policy prior to a re-scan.

7. The computer program product of claim 5, wherein the additional task is deploying a remedial action.

8. The computer program product of claim 5, wherein the additional task is encrypting the data.