Systems and methods for sharing the results of computing operations among related computing systems

• US 9,002,972 B2
• Filed: 01/29/2010
• Issued: 04/07/2015
• Est. Priority Date: 01/29/2010
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Meyer, James, Buches, David, McCorkendale, Bruce, Sobel, William E.
• Primary Examiner(s): NGUYEN, MINH CHAU
• Application Number:
  US12/696,970
• Publication Number:
  US 20110191341A1
• Time in Patent Office: 1,894 Days
• Field of Search: 709203-204, 709/213
• US Class Current: 709/213
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/562 Static detection

Abstract

A computer-implemented for sharing the results of computing operations among related computing systems may include: 1) identifying a need to perform a computing operation on a file, 2) identifying a unique identifier associated with the file, 3) determining, by using the unique identifier to query a shared store that is shared by a group of related computing systems, that at least one computing system within the group of related computing systems has previously performed the computing operation on an instance of the file, and then 4) retrieving the results of the computing operation from the shared store instead of performing the computing operation. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for sharing the results of computing operations among related computing systems, at least a portion of the method being performed by a computing system comprising at least one processor, the method comprising:

identifying a need to perform a computing operation on a file;

determining that the file satisfies criteria related to potential savings of computing resources within a group of related computing systems, the determination indicating that computing resources required to perform the computing operation on the file will likely exceed computing resources required to identify and share results of the computing operation previously performed by at least one other computing system within the group of related computing systems;

only after determining that the file satisfies the criteria related to potential savings of computing resources within the group of related computing systems, identifying a unique identifier associated with the file;

determining, by using the unique identifier to query a shared store that is shared by the group of related computing systems, that the other computing system within the group of related computing systems has previously performed the computing operation on an instance of the file;

retrieving the results of the computing operation previously performed by the other computing system from the shared store instead of performing the computing operation.

2. The method of claim 1, wherein identifying a unique identifier associated with the file comprises identifying a hash of the file.

3. The method of claim 2, wherein identifying a hash of the file comprises at least one of:

creating the hash;

retrieving the hash from a local store.

4. The method of claim 3, further comprising:

determining that the file has been modified;

clearing information associated with the file from the local store.

5. The method of claim 1, wherein determining that the file satisfies the criteria related to potential savings of computing resources within the group of related computing systems comprises at least one of:

determining that an additional instance of the file is likely to be located on at least one additional computing system within the group of related computing systems;

determining that the file is unlikely to change frequently.

6. The method of claim 5, wherein determining that an additional instance of the file is likely to be located on at least one additional computing system within the group of related computing systems comprises at least one of:

determining that the file is located in a location that is likely to contain non-user-generated files;

determining that the file is not located in a location that is likely to contain user-generated files.

7. The method of claim 5, wherein determining that the file is unlikely to change frequently comprises at least one of:

determining that the file is located in a location that is commonly associated with static files;

determining that the file has changed less than a predetermined number of times within a predetermined period of time;

determining that the file has remained static over a predetermined period of time.

8. The method of claim 1, wherein the shared store contains at least one of:

a hash of the file;

the date of the computing operation performed in connection with the file.

9. The method of claim 8, wherein the results of the computing operation performed in connection with the file comprise information that identifies at least one of:

a classification assigned to the file during a malware analysis;

at least one rationale for the classification assigned to the file during the malware analysis;

at least one virus definition set or heuristic used when performing the malware analysis.

10. The method of claim 1, wherein the computing operation comprises at least one of:

a malware analysis of the file;

a data-loss-prevention analysis of the file;

a community-based-reputation lookup for the file;

a file-type analysis of the file.

11. The method of claim 1, wherein determining that at least one other computing system within the group of related computing systems has previously performed the computing operation on an instance of the file comprises determining that at least one other computing system within the group of related computing systems has previously performed a malware analysis on an instance of the file using:

an identical virus definition set or heuristic;

a similar virus definition set or heuristic;

a more-recent virus definition set or heuristic.

12. The method of claim 1, wherein the shared store comprises at least a portion of at least one of:

a network-attached storage device;

a storage area network;

a file server;

a cloud-based storage device;

a secured partition of a local storage device managed by a hypervisor.

13. The method of claim 1, wherein the shared store is indexed based on file hashes.

14. The method of claim 1, wherein the group of related computing systems comprises:

a plurality of virtual machines running on a common host computing system;

a plurality of physical machines connected to a common network.

15. The method of claim 1, further comprising:

identifying a need to perform an additional computing operation on the file;

determining, by using the unique identifier to query the shared store, that the additional computing operation has not been previously performed on an instance of the file;

performing the additional computing operation on the file;

updating the shared store with the results of the additional computing operation.

16. A system for sharing the results of computing operations among related computing systems, the system comprising:

an operation-identification module programmed to identify a need to perform a computing operation on a file;

a file-identification module programmed to;

determine that the file satisfies criteria related to potential savings of computing resources within a group of related computing systems, the determination indicating that computing resources required to perform the computing operation on the file will likely exceed computing resources required to identify and share results of the computing operation previously performed by at least one other computing system within the group of related computing systems;

only after determining that the file satisfies the criteria related to potential savings of computing resources within the group of related computing systems, identify a unique identifier associated with the file;

a query module programmed to;

determine, by using the unique identifier to query a shared store that is shared by the group of related computing systems, that the other computing system within the group of related computing systems has previously performed the computing operation on an instance of the file;

retrieving the results of the computing operation previously performed by the other computing system from the shared store instead of performing the computing operation;

at least one computer processor configured to execute the operation-identification module, the file-identification module, and the query module.

17. The system of claim 16, wherein the file-identification module determines that the file satisfies the criteria related to potential savings of computing resources within the group of related computing systems by at least one of:

determining that an additional instance of the file is likely to be located on at least one additional computing system within the group of related computing systems;

determining that the file is unlikely to change frequently.

18. The system of claim 16, wherein the shared store contains at least one of:

a hash of the file;

the date of the computing operation performed in connection with the file.

19. A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing system, cause the computing system to:

identify a need to perform a computing operation on a file;

determine that the file satisfies criteria related to potential savings of computing resources within a group of related computing systems, the determination indicating that computing resources required to perform the computing operation on the file will likely exceed computing resources required to identify and share results of the computing operation previously performed by at least one other computing system within the group of related computing systems;

only after determining that the file satisfies the criteria related to potential savings of computing resources within the group of related computing systems, identify a unique identifier associated with the file;

determine, by using the unique identifier to query a shared store that is shared by the group of related computing systems, that the other computing system within the group of related computing systems has previously performed the computing operation on an instance of the file;

retrieve the results of the computing operation previously performed by the other computing system from the shared store instead of performing the computing operation.

20. The computer-readable-storage medium of claim 19, wherein the computing operation comprises at least one of:

a malware analysis of the file;

a data-loss-prevention analysis of the file;

a community-based-reputation lookup for the file;

a file-type analysis of the file.