Fingerprint analysis for anti-virus scan

• US 8,893,277 B2
• Filed: 05/20/2010
• Issued: 11/18/2014
• Est. Priority Date: 11/16/2009
• Status: Expired due to Fees

• Current Assignee: Quantum Corporation (Chi Ko Investment Co., Ltd.)
• Original Assignee: Quantum Corporation (Chi Ko Investment Co., Ltd.)
• Inventors: Wade, Gregory L., Haile, J. Mitchell
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US12/783,899
• Publication Number:
  US 20110119764A1
• Time in Patent Office: 1,643 Days
• Field of Search: 726/24
• US Class Current: 726/24
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Disclosed is a method of operating a data identification system. The method comprises identifying a first plurality of changed blocks in a first primary storage volume, processing the first plurality of changed blocks to generate a first plurality of fingerprints, scanning a first plurality of data items stored in a first secondary storage volume within the first primary storage volume corresponding to the first plurality of changed blocks to identify a first infected data item of the first plurality of data items, identifying a first reference fingerprint from the first plurality of fingerprints corresponding to the first infected data item, identifying a second plurality of changed blocks in a second primary storage volume corresponding to a second plurality of data items stored in a second secondary storage volume within the second primary storage volume, processing the second plurality of changed blocks to generate a second plurality of fingerprints, and identifying a first target fingerprint from the second plurality of fingerprints that corresponds to the first reference fingerprint.

Claims

1. A method of operating a data identification system, the method comprising:

identifying a first plurality of changed blocks in a first virtual machine file stored on a physical storage system;

processing the first plurality of changed blocks to generate a first plurality of fingerprints;

scanning a first plurality of data items stored in a first virtual drive within the first virtual machine file to identify a first infected data item of the first plurality of data items, wherein the first infected data item is stored in a portion of the first virtual drive within at least one of the first plurality of changed blocks;

identifying a first reference fingerprint from the first plurality of fingerprints corresponding to the first infected data item;

identifying a second plurality of changed blocks in a second virtual machine file stored on the physical storage system corresponding to a second plurality of data items stored in a second virtual drive within the second virtual machine file;

processing the second plurality of changed blocks to generate a second plurality of fingerprints; and

identifying a first target fingerprint from the second plurality of fingerprints that corresponds to the first reference fingerprint.

2. The method of claim 1 further comprising adding the first reference fingerprint to an infected fingerprint list.

3. The method of claim 2 further comprising scanning a first target data item of a second plurality of data items to identify a second infected data item, wherein the first target data item corresponds to the first target fingerprint of the second plurality of fingerprints.

4. The method of claim 3 further comprising scanning a subset of data items of the second plurality of data items not including the first target data item to identify another infected data item of the subset of data items of the second plurality of data items.

5. The method of claim 4 further comprising adding another fingerprint from the second plurality of fingerprints corresponding to the another infected data item of the subset of data items of the second plurality of files to the infected fingerprint list.

6. The method of claim 4 further comprising adding the second plurality of fingerprints to the infected fingerprint list if the first target fingerprint from the second plurality of fingerprints matches the first reference fingerprint from the first plurality of fingerprints.

7. The method of claim 4 further comprising adding the first plurality of fingerprints not including the first reference fingerprint from the first plurality of fingerprints to a non-infected fingerprint list.

8. The method of claim 7 further comprising comparing each fingerprint of the second plurality of fingerprints to each fingerprint of the non-infected fingerprint list if each fingerprint of the second plurality of fingerprints does not match a fingerprint of the infected fingerprint list.

9. A data identification system, the system comprising:

an interface configured to receive a scan request a scan request; and

a processor in communication with the interface and configured to receive the scan request, identify a first plurality of changed blocks in a first virtual machine file stored on a physical storage system, process the first plurality of changed blocks to generate a first plurality of fingerprints, scan a first plurality of data items stored in a first virtual drive within the first virtual machine file to identify a first infected data item of the first plurality of data items, wherein the first infected data item is stored in a portion of the first virtual drive within at least one of the first plurality of changed blocks, identify a first reference fingerprint from the first plurality of fingerprints corresponding to the first infected data item, identify a second plurality of changed blocks in a second virtual machine file stored on the physical storage system corresponding to a second plurality of data items stored in a second virtual drive within the second virtual machine file, process the second plurality of changed blocks to generate a second plurality of fingerprints, and identify a first target fingerprint from the second plurality of fingerprints that corresponds to the first reference fingerprint.

10. The data identification system of claim 9 the processor further configured to add the first reference fingerprint to an infected fingerprint list.

11. The data identification system of claim 10 the processor further configured to scan a first target data item of a second plurality of data items to identify a second infected data item, wherein the first target data item corresponds to the first target fingerprint of the second plurality of fingerprints.

12. The data identification system of claim 11 the processor further configured to scan a subset of data items of the second plurality of data items not including the first target data item to identify another infected data item of the subset of data items of the second plurality of data items.

13. The data identification system of claim 12 the processor further configured to add another fingerprint from the second plurality of fingerprints corresponding to the another infected data item of the subset of data items of the second plurality of files to the infected fingerprint list.

14. The data identification system of claim 12 the processor further configured to add the second plurality of fingerprints to the infected fingerprint list if the first target fingerprint from the second plurality of fingerprints matches the first reference fingerprint from the first plurality of fingerprints.

15. The data identification system of claim 12 the processor further configured to add the first plurality of fingerprints not including the first reference fingerprint from the first plurality of fingerprints to a non-infected fingerprint list.

16. The data identification system of claim 15 the processor further configured to compare each fingerprint of the second plurality of fingerprints to each fingerprint of the non-infected fingerprint list if each fingerprint of the second plurality of fingerprints does not match a fingerprint of the infected fingerprint list.

17. A non-transitory computer readable medium having program instructions stored thereon for operating a data identification system that, when executed by a data identification system, direct the data identification system to:

identify a first plurality of changed blocks in a first virtual machine file stored on a physical storage system;

process the first plurality of changed blocks to generate a first plurality of fingerprints;

scan a first plurality of data items stored in a first virtual drive within the first virtual machine file to identify a first infected data item of the first plurality of data items, wherein the first infected data item is stored in a portion of the first virtual drive within at least one of the first plurality of changed blocks;

identify a first reference fingerprint from the first plurality of fingerprints corresponding to the first infected data item;

identify a second plurality of changed blocks in a second virtual machine file stored on the physical storage system corresponding to a second plurality of data items stored in a second virtual drive within the second virtual machine file;

process the second plurality of changed blocks to generate a second plurality of fingerprints; and

identify a first target fingerprint from the second plurality of fingerprints that corresponds to the first reference fingerprint.