Efficient file scanning using input-output hints

• US 7,975,303 B1
• Filed: 06/27/2005
• Issued: 07/05/2011
• Est. Priority Date: 06/27/2005
• Status: Active Grant

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Millard, John
• Primary Examiner(s): Smithers; Matthew B
• Assistant Examiner(s): Fields; Courtney D
• Application Number:
  US11/167,501
• Time in Patent Office: 2,199 Days
• Field of Search: 726/24, 726/22, 726/26, 711/170
• US Class Current: 726/24
• CPC Class Codes: G06F 11/3089 Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents software debugging using additional hardware using a specific debug interface G06F11/3656; performance evaluation by tracing or monitoring G06F11/3466
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

A scanning optimization manager scans files for malicious code. The scanning optimization manager creates listings of the portions of scanned files accessed during the scanning. The scanning optimization manager proceeds to utilize these listings of accessed portions of files as I/O hints to optimize subsequent scans of the files for malicious code.

Claims

1. A computer implemented method for efficiently scanning files for malicious code, the method comprising:

using a computer to perform steps comprising;

scanning a file stored on a medium for malicious code identified by a malicious code signature;

creating a listing of portions of the file accessed during the scanning for the malicious code signature; and

utilizing the listing of accessed portions of the file to optimize a subsequent scan of the file by the computer for malicious code, wherein the utilizing comprises, prior to the subsequent scan of the file, relocating the accessed portions of the file to be contiguous on the medium.

2. The method of claim 1 wherein utilizing the listing of accessed portions of the file to optimize the subsequent scan of the file further comprises:

reading only relevant portions of the file into dynamic memory from the medium prior to the subsequent scan of the file, the relevant portions determined responsive to the listing of portions of the file accessed during the scan; and

scanning only the relevant portions of the file in dynamic memory.

3. The method of claim 1 wherein utilizing the listing of accessed portions of the file to optimize the subsequent scan of the file further comprises:

disabling operating system read-ahead during the subsequent scan of the file.

4. The method of claim 1 wherein utilizing the listing of accessed portions of the file to optimize the subsequent scan of the file further comprises:

disabling operating system input-output caching during the subsequent scan of the file.

5. The method of claim 1 further comprising:

a main thread launching at least one separate thread;

a separate thread performing an optimized scan of the file utilizing the listing of accessed portions; and

the main thread continuing to process other files for malicious code scanning.

6. The method of claim 1 further comprising:

responsive to a change of which portions of the file are accessed during the scanning step, updating the listing of accessed portions of the file.

7. The method of claim 1 wherein the accessed portions of the file are relocated to be contiguous with accessed portions of other files on the medium.

8. A non-transitory computer readable medium containing computer program code for efficiently scanning files for malicious code, the computer program code comprising:

program code for scanning a file on a medium for malicious code identified by a malicious code signature, the scanning comprising accessing portions of the file to examine the portions for the malicious code signature, the accessed portions of the file constituting less than all of the file;

program code for creating a listing of portions of the file accessed during the scanning for the malicious code signature; and

program code for utilizing the listing of accessed portions of the file to optimize a subsequent scan of the file by the computer for malicious code, wherein the utilizing comprises, prior to the subsequent scan of the file, relocating the accessed portions of the file to be contiguous on the medium.

9. The non-transitory computer readable medium of claim 8 wherein the program code for utilizing the listing of accessed portions of the file to optimize the subsequent scan of the file further comprises:

program code for reading only the listed portions of the file into dynamic memory from the medium prior to the subsequent scan of the file.

10. The non-transitory computer readable medium of claim 8 wherein the program code for utilizing the listing of accessed portions of the file to optimize the subsequent scan of the file further comprises:

program code for disabling operating system read-ahead during the subsequent scan of the file.

11. The non-transitory computer readable medium of claim 8 wherein the program code for utilizing the listing of accessed portions of the file to optimize the subsequent scan of the file further comprises:

program code for disabling operating system input-output caching during the subsequent scan of the file.

12. The non-transitory computer readable medium of claim 8 further comprising:

program code for causing a main thread to launch a separate thread;

program code for causing the separate thread to perform an optimized scan of the file utilizing the listing of accessed portions; and

program code for causing the main thread to process other files for malicious code scanning concurrently with the scanning of the file by the separate thread.

13. The non-transitory computer readable medium of claim 8 further comprising:

program code for, responsive to a change of which portions of the file are accessed during scanning, updating the associated listing of accessed portions of the file.

14. The non-transitory computer readable medium of claim 8 wherein the accessed portions of the file are relocated to be contiguous with accessed portions of other files on the medium.

15. A computer system for efficiently scanning files for malicious code, the computer system comprising:

a computer processor; and

a computer-readable storage medium storing software portions configured to execute on the computer processor, the software portions comprising;

a software portion configured to scan a file on a medium for malicious code identified by a malicious code signature, the scanning comprising accessing portions of the file to examine the portions for the malicious code signature, the accessed portions of the file constituting less than all of the file;

a software portion configured to create a listing of the portions of the file accessed during the scanning for the malicious code signature; and

a software portion configured to utilize the listing of accessed portions of the file to optimize a subsequent scan of the file by the computer for malicious code, wherein the utilizing comprises, prior to the subsequent scan of the file, relocating the accessed portions of the file to be contiguous on the medium.

16. The computer system of claim 15 wherein the software portion configured to utilize the listing of accessed portions of the file to optimize the subsequent scan of the file further comprises:

a software portion configured to read only the listed portions of the file into dynamic memory from the medium prior to the subsequent scan of the file.

17. The computer system of claim 15 wherein the software portion configured to utilize the listing of accessed portions of the file to optimize the subsequent scan of the file further comprises:

a software portion configured to disable operating system read-ahead during the subsequent scan of the file.

18. The computer system of claim 15 wherein the software portion configured to utilize the listing of accessed portions of the file to optimize the subsequent scan of the file further comprises:

a software portion configured to disable operating system input-output caching during the subsequent scan of the file.

19. The computer system of claim 15 further comprising:

a software portion configured to cause a main thread to launch a separate thread;

a software portion configured to cause the separate thread to perform an optimized scan of the file utilizing the listing of accessed portions; and

a software portion configured to cause the main thread to process other files for malicious code scanning concurrently with the scanning of the file by the separate thread.

20. The computer system of claim 15 further comprising:

a software portion configured to update the associated listing of accessed portions of the file, responsive to a change of which portions of the file are accessed during scanning.

21. The computer system of claim 15 wherein the accessed portions of the file are relocated to be contiguous with accessed portions of other files on the medium.