Scheduled gateway scanning arrangement and methods thereof

• US 7,836,502 B1
• Filed: 07/03/2007
• Issued: 11/16/2010
• Est. Priority Date: 07/03/2007
• Status: Expired due to Fees

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Chang, Eric, Chen, Gang, Zhao, Xiaoming
• Primary Examiner(s): Song; Hosuk
• Application Number:
  US11/773,072
• Time in Patent Office: 1,232 Days
• Field of Search: 726 11- 12, 726 22- 30, 713187-188
• US Class Current: 726/22
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method for performing content analysis of a plurality of resources is provided. The method includes performing background content scanning on the plurality of resources based on a resource priority queue. The method also includes storing already scanned resources of the plurality of resources in a scan result database. The method further includes receiving a first access request asynchronously with the scanning and the storing. The method yet also includes, if the first access request pertains to a given resource not contemporaneously designated as a satisfactory scan result according to the scan result database, granting the given resource a higher priority in the resource priority queue than resources remaining to be scanned in the plurality of resources, thereby enabling the given resource to be scanned ahead of the resources remaining to be scanned.

Claims

1. A method for performing content analysis of a plurality of resources, said method comprising:

performing background content scanning on said plurality of resources based on a resource priority queue;

creating, using a scheduler in a computing device, said resource priority queue, said resource priority queue being an order list of said plurality of resources based on a priority queue determined by said scheduler;

employing said resource priority queue to determine priority for scanning said plurality of resources;

storing already scanned resources of said plurality of resources in a scan result database;

receiving a first access request asynchronously with said scanning and said storing; and

if said first access request pertains to a given resource not contemporaneously designated as a satisfactory scan result according to said scan result database, granting said given resource a higher priority in said resource priority queue than resources remaining to be scanned in said plurality of resources, thereby enabling said given resource to be scanned by said set of scanners ahead of said resources remaining to be scanned.

2. The method of claim 1 further comprising:

if said first access request pertains to a given resource contemporaneously designated as said satisfactory scan result according to said scan result database, providing a scan result associated with said given resource in response to said first access request without first performing content scanning of said given resource.

3. The method of claim 1 further comprising:

handling, using a request proxy, said first access request for said given resource.

4. The method of claim 1 further comprising scanning, using a set of scanners, each of said plurality of resources for content, said resource priority queue being employed by said set of scanners to determine said priority for scanning said plurality of resources.

5. The method of claim 1 further comprising adjusting, using said scheduler, said resource priority queue based on at least one of scanning time consumption, file size, resource access frequency rate, and real-time access request.

6. The method of claim 3 wherein said request proxy is configured to interact with said scheduler to retrieve said scan result for said given resource of said plurality of resources.

7. The method of claim 3 further comprising:

if said scan result indicates said given resource includes malicious content, sending an error message, using said request proxy, to a client that issues said first access request, and

if said scan result indicates said given resource does not include said malicious content, sending said first access request to a server to enable said server to retrieve said given resource and sending said given resource back to said client.

8. An arrangement for performing content analysis of a plurality of resources, said arrangement comprising:

a scheduled gateway scanning arrangement (SGSA), said SGSA including

a set of scanners, said set of scanners being configured for performing content scanning on said plurality of resources based on a resource priority queue,

a scan result database, said scan result database being configured for storing already scanned resources of said plurality of resources,

a request proxy, said request proxy being configured to receive a first access request asynchronously with said content scanning and said storing, and

a scheduler, said scheduler being configured for managing said resource Priority queue, said scheduler being further configured to create said resource priority queue, said resource priority queue being an order list of said plurality of resources based on a priority score determined by said scheduler, said resource priority queue being employed by said set of scanners to determine priority for scanning said plurality of resources; and

circuits for performing one or more tasks associated with said SGSA.

9. The arrangement of claim 8 wherein said scheduler is configured to use a scheduler algorithm to create said resource priority queue.

10. The arrangement of claim 9 wherein said scheduler is configured to adjust said resource priority queue based on at least one of scanning time consumption, file size, resource access frequency rate, and real-time access request.

11. The arrangement of claim 10 wherein said request proxy is configured to interact with said scheduler to retrieve a scan result for said first resource of said plurality of resources.

12. The arrangement of claim 11 wherein said scheduler is configured to access a database to retrieve said scan result, wherein

if said first access request pertains to a given resource contemporaneously designated as a satisfactory scan result according to said scan result database, providing a scan result associated with said given resource in response to said first access request without first performing content scanning of said given resource, and

if said first access request pertains to a given resource not contemporaneously designated as said satisfactory scan result according to said scan result database, granting said given resource a higher priority in said resource priority queue than resources remaining to be scanned in said plurality of resources, thereby enabling said given resource to be scanned ahead of said resources remaining to be scanned.

13. The arrangement of claim 12 wherein said request proxy is configured to manage said first access request after retrieving said scan result from said scheduler, comprising:

if said scan result indicates said first resource includes malicious content, sending an error message, using said request proxy, to a client that issues said first access request, and

if said scan result indicates said first resource does not include said malicious content, sending said first access request to a server to enable said server to retrieve said given resource and sending said given resource back to said client.

14. A method for performing content analysis of a plurality of resources, said method comprising:

performing background content scanning on said plurality of resources based on a resource priority queue;

storing already scanned resources of said plurality of resources in a scan result database;

receiving a first access request asynchronously with said scanning and said storing;

if said first access request pertains to a given resource not contemporaneously designated as a satisfactory scan result according to said scan result database, granting, using a computing device, said given resource a higher priority in said resource priority queue than resources remaining to be scanned in said plurality of resources, thereby enabling said given resource to be scanned ahead of said resources remaining to be scanned; and

if said first access request pertains to a given resource contemporaneously designated as said satisfactory scan result according to said scan result database, providing, using said computing device, a scan result associated with said given resource in response to said first access request without first performing content scanning of said given resource.

15. The method of claim 14 further comprising:

providing a request proxy configured to handle said first access request for said given resource,

providing a scheduler, said scheduler being configured to manage said resource priority queue, and

providing a set of scanners, said set of scanners being configured to scan each of said plurality of resources for content.

16. The method of claim 15 wherein said scheduler is configured to use a scheduler algorithm to create said resource priority queue, said resource priority queue being an order list of said plurality of resources based on a priority queue determined by said scheduler, said resource priority queue being employed by said set of scanners to determine priority for scanning said plurality of resources.

17. The method of claim 16 wherein said scheduler is configured to adjust said resource priority queue based on at least one of scanning time consumption, file size, resource access frequency rate, and real-time access request.

18. The method of claim 17 wherein said request proxy is configured to interact with said scheduler to retrieve said scan result for said given resource of said plurality of resources.

19. The method of claim 15 further comprising:

if said scan result indicates said given resource includes malicious content, sending an error message, using said request proxy, to a client that issues said first access request.

20. The method of claim 19 further comprising:

if said scan result indicates said given resource does not include said malicious content, sending said first access request to a server to enable said server to retrieve said given resource and sending said given resource back to said client.