Efficient scanning of stream based data

• US 7,246,227 B2
• Filed: 02/10/2003
• Issued: 07/17/2007
• Est. Priority Date: 02/10/2003
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Kissel, Timo S.
• Primary Examiner(s): JUNG, DAVID YIUK
• Application Number:
  US10/364,252
• Publication Number:
  US 20040158732A1
• Time in Patent Office: 1,618 Days
• Field of Search: 713/23, 713/22, 713/26
• US Class Current: 726/13
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/562 Static detection

Abstract

Methods, systems, and computer readable media utilize a stream manager (101) to efficiently scan stream (105) based data (103). A stream manager (101) receives (801) data (103) from a stream (105). The stream manager (101) makes (807) received data (103) serially available to a plurality of modify scanners (109) in a specific order, and makes (809) received data (103) available in parallel to a plurality of read-only scanners (111). The stream manager (101), responsive to data (103) having been released by each modify scanner (109) of the plurality and by each read-only scanner (111) of the plurality, transmits (515) released data (103) to a destination (113).

Claims

1. A computer implemented method of efficiently scanning stream based data, the method comprising:

a stream manager receiving data from a stream;

the stream manager making received data serially available to a plurality of modify scanners in a specific order, such that data is made available to a next modify scanner after it has been released by a previous modify scanner;

the stream manager making received data available in parallel to a plurality of read-only scanners;

the stream manager, responsive to data having been released by each modify scanner of the plurality and by each read-only scanner of the plurality, transmitting released data to a destination.

2. The method of claim 1, wherein:

receiving data from a stream further comprises receiving a packet of data from a stream; and

making data available to a scanner further comprises making at least a portion of the packet of data available to the scanner.

3. The method of claim 1, further comprising:

the stream manager receiving an indication from a modify scanner that the modify scanner has released at least a portion of a packet of data; and

the stream manager making the released data available to a next modify-scanner.

4. The method of claim 1, further comprising:

the stream manager receiving, from each modify scanner of the plurality, an indication that the modify scanner has released at least a portion of a packet of data;

the stream manager making the data that has been released by each modify scanner of the plurality available in parallel to each of a plurality of read-only scanners;

the stream manager receiving, from each read-only scanner of the plurality, an indication that the read-only scanner has released at least a portion of a packet of data; and

the stream manager transmitting the data that has been released by each read-only scanner of the plurality to a destination.

5. The method of claim 1, further comprising:

the stream manager receiving, from each read-only scanner of the plurality, an indication that read-only scanner has released at least a portion of a packet of data;

the stream manager making the data that has been released by each read-only scanner of the plurality serially available to each of a plurality of modify scanners in a specific order, such that data is made available to a next modify scanner after it has been released by a previous modify scanner;

the stream manager receiving, from each modify scanner of the plurality, an indication that modify scanner has released at least a portion of a packet of data; and

the stream manager transmitting the data that has been released by each modify scanner of the plurality to a destination.

6. The method of claim 1, wherein making data available to a scanner further comprises:

passing an address of the data to the scanner.

7. The method of claim 1, wherein making data available to a scanner further comprises:

passing a copy of the data to the scanner.

8. The method of claim 1, further comprising:

the stream manager storing data in a cache as the data is received from the stream; and

the stream manager removing data from the cache as the data is transmitted to a destination.

9. The method of claim 8, wherein:

the cache is located in dynamic memory.

10. The method of claim 8, wherein:

the cache is located in static memory.

11. The method of claim 8, wherein:

the cache is located in dynamic memory; and

the method further comprises;

the stream manager monitoring the size of the cache; and

the stream manager transferring at least a portion of the cache to static memory responsive to the cache becoming greater than a specified size.

12. The method of claim 1, wherein:

receiving data from a stream further comprises receiving composed data from a stream; and

the method further comprises;

the stream manager making received data available to a decomposer;

the decomposer decomposing the composed data;

the decomposer making decomposed data serially available to a plurality of modify scanners in a specific order, such that data is made available to a next modify scanner after it has been released by a previous modify scanner; and

the decomposer making decomposed data available in parallel to a plurality of read-only scanners.

13. The method of claim 1, wherein:

receiving data from a stream further comprises receiving composed data from a stream; and

the method further comprises;

the stream manager making received data available to a decomposer;

the decomposer determining that the composed data cannot be decomposed; and

the decomposer releasing the composed data.

14. A computer implemented method of efficiently scanning stream based data, the method comprising:

a stream manager receiving data from a stream;

the stream manager making received data available in parallel to a single modify scanner, and to a plurality of read-only scanners;

the stream manager, responsive to data having been released by the modify scanner and each read-only scanner of the plurality, transmitting released data to a destination.

15. The method of claim 14, wherein:

receiving data from a stream further comprises receiving a packet of data from a stream; and

making data available to a scanner further comprises making at least a portion of the packet of data available to the scanner.

16. The method of claim 14, further comprising:

the stream manager receiving, from the modify scanner, and from each read-only scanner of the plurality, an indication that the read-only scanner has released at least a portion of a packet of data; and

the stream manager transmitting the data that has been released by the modify scanner and by each read-only scanner of the plurality to a destination.

17. The method of claim 14, further comprising:

the stream manager storing data in a cache as the data is received from the stream; and

the stream manager removing data from the cache as the data is transmitted to a destination.

18. The method of claim 17, wherein:

the cache is located in dynamic memory; and

the method further comprises;

the stream manager monitoring the size of the cache; and

the stream manager transferring at least a portion of the cache to static memory responsive to the cache becoming greater than a specified size.

19. A computer implemented method of efficiently scanning stream based data, the method comprising:

a stream manager receiving data from a stream;

the stream manager informing each of a plurality of modify scanners and each of a plurality of read-only scanners that received data is available for scanning;

the stream manager receiving requests from scanners to scan received data;

the stream manager making data serially available in a specific order to each modify scanner that requests to scan that data;

the stream manager making data available in parallel to each read-only scanner that requests to scan that data; and

the stream manager, responsive to data having been released by each modify scanner that requests to scan that data and by each read-only scanner that requests to scan that data, transmitting released data to a destination.

20. The method of claim 19, wherein:

receiving data from a stream further comprises receiving composed data from a stream; and

the method further comprises;

the stream manager making received data available to a decomposer;

the decomposer decomposing the composed data;

the decomposer informing each of a plurality of modify scanners and each of a plurality of read-only scanners that decomposed data is available for scanning;

the decomposer receiving requests from scanners to scan decomposed data;

the decomposer making decomposed data serially available in a specific order to each modify scanner that requests to scan that data; and

the decomposer making decomposed data available in parallel to each read-only scanner that requests to scan that data.

21. The method of claim 19, wherein:

receiving data from a stream further comprises receiving composed data from a stream; and

the method further comprises;

the stream manager making received data available to a decomposer;

the decomposer determining that the composed data cannot be decomposed; and

the decomposer releasing the composed data.

22. The method of claim 19, wherein:

receiving data from a stream further comprises receiving a packet of data from a stream; and

making data available to a scanner further comprises making at least a portion of the packet of data available to the scanner.

23. The method of claim 19, further comprising:

the stream manager receiving an indication from a modify scanner that the modify scanner has released at least a portion of a packet of data; and

the stream manager making the released data available to a next modify-scanner.

24. The method of claim 19, further comprising:

the stream manager receiving, from each modify scanner that requests to scan a packet of data, an indication that the modify scanner has released at least a portion of the packet of data;

the stream manager making the data that has been released by each modify scanner available in parallel to each read-only scanner that requests to scan that data;

the stream manager receiving, from each read-only scanner that requests to scan that data, an indication that the read-only scanner has released at least a portion of the packet of data; and

the stream manager transmitting the data that has been released by each read-only scanner to a destination.

25. The method of claim 19, further comprising:

the stream manager receiving, from each read-only scanner that requests to scan a packet of data, an indication that the read-only scanner has released at least a portion of the packet of data;

the stream manager making the data that has been released by each read-only scanner serially available in a specific order to each modify scanner that requests to scan that data;

the stream manager receiving, from each modify only scanner that requests to scan that data, an indication that the modify scanner has released at least a portion of the packet of data; and

the stream manager transmitting the data that has been released by each modify scanner to a destination.

26. The method of claim 19, further comprising:

the stream manager storing data in a cache as the data is received from the stream; and

the stream manager removing data from the cache as the data is transmitted to a destination.

27. The method of claim 26, wherein:

the cache is located in dynamic memory; and

the method further comprises;

the stream manager monitoring the size of the cache; and

the stream manager transferring at least a portion of the cache to static memory responsive to the cache becoming greater than a specified size.

28. A computer implemented method of efficiently scanning stream based data, the method comprising:

a stream manager receiving data from a stream;

the stream manager storing a copy of received data;

the stream manager informing each of a plurality of scanners that received data is available for scanning;

the stream manager receiving requests from scanners to scan received data;

the stream manager fulfilling received requests in parallel, by making a stored copy of received data available to each scanner that requests to scan that received data; and

the stream manager maintaining a record of fulfilled requests.

29. The method of claim 28, further comprising

the stream manager, responsive to data having been modified by a modify scanner, making an unmodified original version of that data available in a desired order to each scanner that requests to scan that data;

and

the stream manager, responsive to data having been released by each scanner that requests to scan that received data, transmitting released data to a destination.

30. The method of claim 28, further comprising

the stream manager, responsive to received data not having been modified by any modify scanner, and responsive to data having been released by each scanner that requests to scan that received data, transmitting released data to a destination.

31. A computer readable medium containing a computer program product for efficiently scanning stream based data, the computer program product comprising:

program code for receiving data from a stream;

program code for making received data serially available to a plurality of modify scanners in a specific order, such that data is made available to a next modify scanner after it has been released by a previous modify scanner;

program code for making received data available in parallel to a plurality of read-only scanners; and

program code for transmitting released data to a destination, responsive to data having been released by each modify scanner of the plurality, and by each read-only scanner of the plurality.

32. The computer program product of claim 31, further comprising:

program code for receiving a packet of data from a stream; and

program code for making at least a portion of the packet of data available to the scanner.

33. The computer program product of claim 31, further comprising:

program code for receiving an indication from a modify scanner that the modify scanner has released at least a portion of a packet of data; and

program code for making the released data available to a next modify-scanner.

34. The computer program product of claim 31, further comprising:

program code for receiving, from each modify scanner of the plurality, an indication that the modify scanner has released at least a portion of a packet of data;

program code for making the data that has been released by each modify scanner of the plurality available in parallel to each of a plurality of read-only scanners;

program code for receiving, from each read-only scanner of the plurality, an indication that the read-only scanner has released at least a portion of a packet of data; and

program code for transmitting the data that has been released by each read-only scanner of the plurality to a destination.

35. The computer program product of claim 31, further comprising:

program code for receiving, from each read-only scanner of the plurality, an indication that the read-only scanner has released at least a portion of a packet of data;

program code for making the data that has been released by each read-only scanner of the plurality serially available to each of a plurality of modify scanners in a specific order, such that data is made available to a next modify scanner after it has been released by a previous modify scanner;

program code for receiving, from each modify scanner of the plurality, an indication that the modify scanner has released at least a portion of a packet of data; and

program code for transmitting the data that has been released by each modify scanner of the plurality to a destination.

36. The computer program product of claim 31, further comprising:

program code for receiving composed data from a stream;

program code for making received data available to a decomposer;

program code for decomposing the composed data by the decomposer;

program code for making decomposed data serially available to a plurality of modify scanners in a specific order, such that data is made available to a next modify scanner after it has been released by a previous modify scanner; and

program code for making decomposed data available in parallel to a plurality of read-only scanners.

37. The computer program product of claim 31, further comprising:

program code for receiving composed data from a stream;

program code for making received data available to a decomposer;

program code for determining, by the decomposer, that the composed data cannot be decomposed; and

program code for releasing the composed data by the decomposer.

38. A computer readable medium containing a computer program product for efficiently scanning stream based data, the computer program product comprising:

program code for receiving data from a stream;

program code for informing each of a plurality of modify scanners and each of a plurality of read-only scanners that received data is available for scanning;

program code for receiving requests from scanners to scan received data;

program code for making received data serially available in a specific order to each modify scanner that requests to scan that data;

program code for making received data available in parallel to each read-only scanner that requests to scan that data; and

program code for transmitting released data to a destination, responsive to data having been released by each modify scanner that requests to scan that data and by each read-only scanner that requests to scan that data.

39. The computer program product of claim 38, further comprising:

program code for receiving a packet of data from a stream; and

program code for making at least a portion of the packet of data available to the scanner.

40. The computer program product of claim 38, further comprising:

program code for receiving an indication from a modify scanner that the modify scanner has released at least a portion of a packet of data; and

program code for making the released data available to a next modify-scanner.

41. The computer program product of claim 38, further comprising:

program code for receiving, from each modify scanner that requests to scan a packet of data, an indication that the modify scanner has released at least a portion of the packet of data;

program code for making the data that has been released by each modify scanner available in parallel to each read-only scanner that requests to scan that data;

program code for receiving, from each read-only scanner that requests to scan that data, an indication that the read-only scanner has released at least a portion of the packet of data; and

program code for transmitting the data that has been released by each read-only scanner that requests to scan that data to a destination.

42. The computer program product of claim 38, further comprising:

program code for receiving, from each read-only scanner that requests to scan a packet of data, an indication that the read-only scanner has released at least a portion of the packet of data;

program code for making the data that has been released by each read-only scanner of the plurality serially available in a specific order to each modify scanner that requests to scan that data;

program code for receiving, from each modify scanner that requests to scan that data, an indication that the modify scanner has released at least a portion of the packet of data; and

program code for transmitting the data that has been released by each modify scanner that requests to scan that data to a destination.

43. A computer readable medium containing a computer program product for efficiently scanning stream based data, the computer program product comprising:

program code for receiving data from a stream;

program code for storing a copy of received data;

program code for informing each of a plurality of scanners that received data is available for scanning;

program code for receiving requests from scanners to scan received data;

program code for fulfilling received requests in parallel, by making a stored copy of received data available to each scanner that requests to scan that received data; and

program code for maintaining a record of fulfilled requests.

44. The computer program product of claim 43, further comprising

program code for, responsive to data having been modified by a modify scanner, making an unmodified original version of that data available in a desired order to each scanner that requests to scan that data;

and

program code for transmitting released data to a destination, responsive to data having been released by each scanner that requests to scan that received data.

45. The computer program product of claim 43, further comprising

program code for transmitting released data to a destination, responsive to received data not having been modified by any modify scanner, and responsive to data having been released by each scanner that requests to scan that received data.

46. A system for efficiently scanning stream based data, the system comprising:

a reception module, for receiving data from a stream;

a data management module, for making received data serially available to a plurality of modify scanners in a specific order, such that data is made available to a next modify scanner after it has been released by a previous modify scanner, and for making received data available in parallel to a plurality of read-only scanners, the data management module being communicatively coupled to the reception module; and

a transmission module, for transmitting released data to a destination, responsive to data having been released by each modify scanner of the plurality and by each read-only scanner of the plurality, the transmission module being communicatively coupled to the data management module.

47. The system of claim 46, further comprising:

a decomposing module, for decomposing received composed data, the decomposing module being communicatively coupled to the data management module; and

a decomposed data management module, for making decomposed data serially available to a plurality of modify scanners in a specific order, such that data is made available to a next modify scanner after it has been released by a previous modify scanner, and for making decomposed data available in parallel to a plurality of read-only scanners, the decomposed data management module being communicatively coupled to the decomposing module.

48. A system for efficiently scanning stream based data, the system comprising:

a data reception module, for receiving data from a stream;

a scanner interface module, for informing each of a plurality of modify scanners and each of a plurality of read-only scanners that received data is available for scanning, and for receiving requests from scanners to scan received data, the scanner interface module being communicatively coupled to the data reception module;

a data management module, for making received data serially available in a specific order to each modify scanner that requests to scan that data, and for making received data available in parallel to each read-only scanner that requests to scan that data, the data management module being communicatively coupled to the scanner interface module; and

a data transmission module for transmitting released data to a destination, responsive to data having been released by each modify scanner and each read-only scanner that requests to scan that data, the data transmission module being communicatively coupled to the data management module.

49. A system for efficiently scanning stream based data, the system comprising:

a data reception module for receiving data from a stream;

a data storage module for storing a copy of received data, the data storage module being communicatively coupled to the data reception module;

a scanner interface module for informing each of a plurality of scanners that received data is available for scanning, and for receiving requests from scanners to scan received data, the scanner interface module being communicatively coupled to the data reception module;

a data management module for fulfilling received requests in parallel, by making a stored copy of received data available to each scanner that requests to scan that received data, the data management module being communicatively coupled to the scanner interface module; and

a record maintenance module, for maintaining a record of fulfilled requests, the record maintenance module being communicatively coupled to the data management module.

50. The system of claim 49, wherein:

the data management module is further for, responsive to data having been modified by a modify scanner, making an unmodified original version of that data available in a desired order to each scanner that requests to scan that data; and

the system further comprises

a transmission module, for transmitting released data to a destination, responsive to data having been released by each scanner that requests to scan that received data, the transmission module being communicatively coupled to the data management module.

51. The system of claim 49, further comprising

a transmission module, for transmitting released data to a destination, responsive to received data not having been modified by any modify scanner, and responsive to data having been released by each scanner that requests to scan that received data, the transmission module being communicatively coupled to the data management module.

52. A system for efficiently scanning stream based data, the method comprising:

means for a stream manager receiving data from a stream;

means for the stream manager making received data serially available to a plurality of modify scanners in a specific order, such that data is made available to a next modify scanner after it has been released by a previous modify scanner;

means for the stream manager making received data available in parallel to a plurality of read-only scanners; and

means for the stream manager transmitting released data to a destination, responsive to data having been released by each modify scanner of the plurality, and by each read-only scanner of the plurality.

53. The system of claim 52, further comprising:

means for the stream manager making received composed data available to a decomposer;

means for the decomposer decomposing the composed data;

means for the decomposer making decomposed data serially available to a plurality of modify scanners in a specific order, such that data is made available to a next modify scanner after it has been released by a previous modify scanner; and

means for the decomposer making decomposed data available in parallel to a plurality of read-only scanners.

54. A system for efficiently scanning stream based data, the method comprising:

means for a stream manager receiving data from a stream;

means for the stream manager informing each of a plurality of modify scanners and each of a plurality of read-only scanners that received data is available for scanning;

means for the stream manager receiving requests from scanners to scan received data;

means for the stream manager making received data serially available in a specific order to each modify scanner that requests to scan that data;

means for the stream manager making received data available in parallel to each read-only scanner that requests to scan that data; and

means for the stream manager transmitting released data to a destination, responsive to data having been released by each modify scanner that requests to scan that data, and by each read-only scanner that requests to scan that data.