Anti-malware scanning system and method thereof

• US 8,719,931 B2
• Filed: 11/30/2011
• Issued: 05/06/2014
• Est. Priority Date: 11/30/2010
• Status: Expired due to Fees

• Current Assignee: Samsung SDS (China) Co., Ltd. (Samsung Group)
• Original Assignee: Samsung SDS (China) Co., Ltd. (Samsung Group)
• Inventors: Lee, KangKyu
• Primary Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US13/307,729
• Publication Number:
  US 20120137365A1
• Time in Patent Office: 888 Days
• Field of Search: None
• US Class Current: 726/22
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/567 using dedicated hardware

Abstract

Provided are an anti-malware scanning system and a method thereof. The system includes: a host; and a chip which is removably connected to the host, receives a file to be scanned from the host, and scans whether malware exists in the file, wherein the host adjusts a size of the file to be scanned to correspond to a storage capacity of a storage unit of the chip and transmits the adjusted file to the chip. Accordingly, scanning is performed effectively even in an environment in which resources of the anti-malware scanning system are limited.

Claims

1. An anti-malware scanning system comprising:

a host; and

a chip which is removably connected to the host, receives a file to be scanned from the host, and scans whether malware exists in the received file,

wherein, if a size of the file to be scanned is larger than a storage capacity of a storage unit of the chip, the host adjusts the size of the file to be scanned according to the storage capacity of the storage unit of the chip and transmits the adjusted file to the chip, and

wherein the host adjusts the size of the file to be scanned to a size determined by the chip.

2. The anti-malware scanning system as claimed in claim 1, wherein:

the storage unit comprises a volatile storage unit and a non-volatile storage unit; and

if the received file to be scanned is smaller than a capacity of the volatile storage unit, the chip stores the received file to be scanned in the volatile storage unit, and, if the received file to be scanned is larger than the capacity of the volatile storage unit, the chip stores the received file to be scanned in the non-volatile storage unit.

3. The anti-malware scanning system as claimed in claim 2, wherein, if the received file to be scanned is a compressed file, the chip stores the received file to be scanned in the volatile storage unit if a size of the received file after decompression is smaller than the capacity of the volatile storage unit, and stores the received file to be scanned in the non-volatile storage unit if the size of the received file after decompression is larger than the capacity of the volatile storage unit.

4. The anti-malware scanning system as claimed in claim 1, wherein:

the storage unit comprises a volatile storage unit;

the host transmits a part of the file to be scanned to the chip; and

the host or the chip determines a size of the part of the file to be smaller than a capacity of the volatile storage unit.

5. The anti-malware scanning system as claimed in claim 4, wherein the file to be scanned is a compressed file.

18. The anti-malware scanning system as claimed in claim 1, wherein the chip transmits a result of the scan to the host.

6. A method for scanning whether malware exists in a file of a host, the method comprising:

transmitting the file to be scanned to a chip which is removably connected to the host; and

scanning, by the chip, the transmitted file for malware,

wherein the transmitting comprises, if a size of the file to be scanned is larger than a storage capacity of a storage unit of the chip, transmitting a part of the file to be scanned to the chip,

wherein the storage unit comprises a volatile storage unit, and

wherein a size of the part of the file to be scanned is smaller than a capacity of the volatile storage unit.

7. The method as claimed in claim 6, wherein:

the storage unit comprises a volatile storage unit and a non-volatile storage unit; and

the scanning comprises;

if the size of the file to be scanned is smaller than a capacity of the volatile storage unit, storing the transmitted file to be scanned in the volatile memory, and, if the size of the file to be scanned is larger than the capacity of the volatile storage unit, storing the transmitted file to be scanned in the non-volatile storage unit, and

scanning by comparing the part of the file stored in the volatile storage unit or the non-volatile storage unit and signature data in sequence.

8. The method as claimed in claim 6, further comprising:

if the file to be scanned is a compressed file, determining whether the file is decompressable in part; and

if the file is decompressable in part, decompressing the file in part,

wherein the transmitting further comprises transmitting a part of the file decompressed in part to the chip.

9. The method as claimed in claim 8, wherein the transmitting further comprises, if the file is not decompressable in part, decompressing an entirety of the file and transmitting a part of the decompressed entire file.

10. The method as claimed in claim 6, further comprising comparing the size of the file to be scanned and the storage capacity of the storage unit of the chip.

15. A non-transitory computer readable recording medium having recorded thereon a program executable by a computer for performing the method of claim 6.

11. A method for scanning whether malware exists in a file of a host, the method comprising:

transmitting the file to be scanned to a chip which is removably connected to the host; and

receiving a result of malware scanning from the chip,

wherein the transmitting comprises, if a size of the file to be scanned is larger than a storage capacity of a storage unit of the chip, transmitting a part of the file to be scanned to the chip,

wherein the storage unit comprises a volatile storage unit, and

wherein a size of the part of the file to be scanned is smaller than a capacity of the volatile storage unit.

12. The method as claimed in claim 11, further comprising:

if the file to be scanned is a compressed file, determining whether the file is decompressable in part; and

if the file is decompressable in part, decompressing the file in part,

wherein the transmitting further comprises transmitting a part of the file decompressed in part to the chip.

13. The method as claimed in claim 12, wherein the transmitting further comprises, if the file is not decompressable in part, decompressing an entirety of the file and transmitting a part of the decompressed entire file.

16. A non-transitory computer readable recording medium having recorded thereon a program executable by a computer for performing the method of claim 11.

14. A method for scanning whether malware exists in a file of a host, the method comprising:

receiving, by a chip which is removably connected to the host, the file to be scanned from the host; and

scanning, by the chip, the received file for malware,

wherein the receiving comprises, if a size of the file to be scanned is larger than a storage capacity of a storage unit of the chip, receiving a part of the file to be scanned,

wherein the storage unit comprises a volatile storage unit, and

wherein a size of the part of the file to be scanned is smaller than a capacity of the volatile storage unit.

17. A non-transitory computer readable recording medium having recorded thereon a program executable by a computer for performing the method of claim 14.