System, method and computer program product for removing null values during scanning

• US 8,627,099 B2
• Filed: 08/01/2005
• Issued: 01/07/2014
• Est. Priority Date: 08/01/2005
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Kuo, Chengi J., Barbieri, Federico
• Primary Examiner(s): MOORTHY, ARAVIND K
• Application Number:
  US11/194,307
• Publication Number:
  US 20130247199A1
• Time in Patent Office: 3,081 Days
• Field of Search: 714/38, 714/25, 707/102, 717/126, 719/315, 726/22, 726/23, 726/25, 380/250, 713/165, 713/168, 713/188
• US Class Current: 713/188
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/561 Virus type analysis

Abstract

A system, method, and computer program product are provided for scanning data values. Initially, a set of data values are received. Null values between the data values are then removed such that the data values are contiguous. Further, the data values with the null values removed are scanned for the purpose of identifying unwanted data.

Claims

1. A method, comprising:

receiving a set of data values at a computer, which includes a processor;

determining if a threshold is met before removing null values;

removing the null values between the data values such that the data values are made contiguous and shorter;

evaluating a size of the data values after the null values have been removed;

scanning the set of data values with the null values removed to identify unwanted data in the computer, wherein an offset is utilized for determining a location in the set of data values where the scanning is to start, and wherein the offset matches the location in the set of data values with a first portion of a virus signature; and

collapsing at least a portion of whitespace within text-based files corresponding to the set of data values such that certain sequences of whitespace characters are replaced by a single whitespace character.

2. The method of claim 1, wherein the threshold includes a size of the set of data values.

3. The method of claim 1, wherein only a portion of the set of data values is received if the set of data values is larger than the threshold.

4. The method of claim 3, wherein the portion of the set of data values only includes the data values that are necessary for the scanning.

5. The method of claim 4, wherein, after the null values are removed in a first portion of the set of data values, the first portion of the set of data values is stored with the null values removed, and it is determined whether a second portion of the set of data values is to be received.

6. The method of claim 5, wherein, after the portions of the set of data values are stored with the null values removed, the portions of the set of data values are scanned.

7. The method of claim 3, wherein the portion of the set of data values is identified utilizing a key position.

8. The method of claim 7, wherein the key position is based on a virus signature associated with the scanning.

9. The method of claim 1, wherein the offset is based on a number of the null values located between a beginning of the portions of the set of data values and the location in the set of data values where the scanning is to start.

10. The method of claim 9, wherein a Global Regular Expression Print (GREP) function is utilized for locating the offset.

11. The method of claim 1, further comprising determining if the scanned set of data values includes the unwanted data.

12. The method of claim 11, further comprising reacting, based on the determination.

13. The method of claim 11, further comprising processing the scanned set of data values, based on the determination.

14. The method of claim 1, further comprising:

determining if a size of the set of data values exceeds a the threshold after removing the null values from the set of data values;

wherein the scanning is only performed in response to a determination that the size of the set of data values exceeds the threshold.

15. The method of claim 1, wherein the set of data values with the null values removed is permanently stored.

16. The method of claim 1, wherein the threshold is predefined as two times an amount of virus signatures associated with the scanning.

17. The method of claim 1, wherein the offset is determined after it is determined that there are no additional portions of the set of data values to be received.

18. A computer program product embodied on a non-transitory computer readable medium, comprising:

receiving a set of data values at a computer, which includes a processor;

determining if a threshold is met before removing null values;

removing the null values between the data values such that the data values are made contiguous and shorter;

evaluating a size of the data values after the null values have been removed;

scanning the set of data values with the null values removed to identify unwanted data in the computer, wherein an offset is utilized for determining a location in the set of data values where the scanning is to start, and wherein the offset matches the location in the set of data values with a first portion of a virus signature; and

collapsing at least a portion of whitespace within text-based files corresponding to the set of data values such that certain sequences of whitespace characters are replaced by a single whitespace character.

19. A system, comprising:

memory coupled to a processor via a bus; and

a processor, wherein the system is configured to;

receive a set of data values at a computer, which includes a processor;

determine if a threshold is met before removing null values;

remove the null values between the data values such that the data values are made contiguous and shorter;

evaluate a size of the data values after the null values have been removed;

scan the set of data values with the null values removed to identify unwanted data in the computer, wherein an offset is utilized for determining a location in the set of data values where the scanning is to start, and wherein the offset matches the location in the set of data values with a first portion of a virus signature; and

collapse at least a portion of whitespace within text-based files corresponding to the set of data values such that certain sequences of whitespace characters are replaced by a single whitespace character.