System and method of whitelisting parent virtual images

• US 8,407,804 B2
• Filed: 09/13/2010
• Issued: 03/26/2013
• Est. Priority Date: 09/13/2010
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Plc (Sophos Group Ltd.)
• Inventors: Todorovic, Rade
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US12/880,444
• Publication Number:
  US 20120066762A1
• Time in Patent Office: 925 Days
• Field of Search: 726/26, 726/24, 726/25
• US Class Current: 726/26
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

In embodiments of the present invention improved capabilities are described for virtual machine scan optimization. In response to a change in the primary virtual machine, the virtual machine scan optimization may involve comparing the primary virtual machine to the related virtual machine and tracking changes of the primary virtual machine with respect to the related virtual machine wherein the changes are identified by location within the primary virtual machine; forming a tracked changes log; generating a relevant file map of the primary virtual machine wherein the relevant file map includes a plurality of relevant files and each of the plurality of relevant files'"'"' locations in the primary virtual machine; comparing the changed locations identified in the track changes log with the locations of the plurality of relevant files to determine if any one of the plurality of relevant files has been changed; and in the event that a relevant file has been changed, as indicated by the comparison of the relevant file map to the tracked changes log, causing the changed relevant file to be security scanned.

Claims

1. A computer program product embodied in a non-transitory computer readable medium that, when executing on one or more computers, reduces scanning requirements of a primary virtual machine based on an understanding of a related virtual machine, by performing the steps of:

creating the primary virtual machine as a child of the related virtual machine, wherein the related virtual machine is whitelisted with respect to a security requirement at the time of creation of the primary virtual machine;

in response to a change in the primary virtual machine, comparing the primary virtual machine to the related virtual machine and tracking changes of the primary virtual machine with respect to the related virtual machine wherein the changes are identified by location within the primary virtual machine, forming a tracked changes log;

generating a relevant file map of the primary virtual machine wherein the relevant file map includes a plurality of relevant files and each of the plurality of relevant files'"'"' locations in the primary virtual machine;

comparing the changed locations identified in the track changes log with the locations of the plurality of relevant files to determine if any one of the plurality of relevant files has been changed; and

performing a security scan of the primary virtual machine, wherein in the event that one of the relevant files has not been changed relative to the related virtual machine that has been whitelisted, excluding the one of the relevant files from the security scan, and further wherein in the event that one of the relevant files has been changed, as indicated by the comparison of the relevant file map to the tracked changes log, causing the changed relevant file to be security scanned.

2. The computer program product of claim 1 wherein if a tracked change exists, but the map indicates that no relevant files reside in that location, then no security scan is done.

3. The computer program product of claim 1, wherein an alert is generated prior to the security scan.

4. The computer program product of claim 1, further comprising, allowing the security scan to be deferred by a user.

5. The computer program product of claim 1, further comprising, if a change in the related virtual machine is indicated in the tracked changes log, the user is given the option of performing additional tasks.

6. The computer program product of claim 5, wherein the additional task is updating a policy prior to a re-scan.

7. The computer program product of claim 5, wherein the additional task is deploying a remedial action.

8. The computer program product of claim 5, wherein the additional task is encrypting the data.