System, method, and computer program product for conditionally performing a scan on data based on an associated data structure

• US 9,092,624 B2
• Filed: 10/01/2012
• Issued: 07/28/2015
• Est. Priority Date: 10/16/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Kolingivadi, Deepakeswaran, Hariharasubramanian, Muthu Nivas
• Primary Examiner(s): Lewis, Lisa
• Application Number:
  US13/633,087
• Publication Number:
  US 20130024935A1
• Time in Patent Office: 1,030 Days
• Field of Search: 713/164, 713/181, 713/188, 726/2, 726/3, 726 11- 14, 726 22- 25
• US Class Current: 1/1
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system, method, and computer program product are provided for conditionally performing a scan of data based on an associated data structure. In use, at least one aspect is identified for each of a first plurality of scanners utilized to perform a scan on data at a first network device. Additionally, at least one data structure is associated with the data, where the at least one data structure reflects the at least one aspect of each of the first plurality of scanners. Furthermore, a subsequent scan on the data is conditionally performed utilizing each of a second plurality of scanners at a second network device, based on the at least one data structure.

Claims

1. A method, comprising:

receiving first data from a first network device configured to utilize a first plurality of scanners to perform a first scan;

identifying a first data structure associated with the first data;

comparing the first data structure to a second data structure at a second device, wherein the second data structure reflects an aspect of a second plurality of scanners, and wherein the second device is configured to communicate with the first device over a network connection;

making a determination as to whether hash values associated with the first plurality of scanners and the second plurality of scanners have been compared; and

preventing the second plurality of scanners from performing a subsequent scan of the first data based on the determination.

2. The method of claim 1, wherein the first data is sent by a mail server and received at a gateway.

3. The method of claim 1, wherein the second plurality of scanners are part of a group of scanners, the group consisting of:

a) an antivirus scanner;

b) an anti-spam scanner;

c) a mail size filtering scanner;

d) a file filtering scanner; and

e) a corrupt content scanner.

4. The method of claim 1, wherein the second plurality of scanners are configured for identifying unwanted data.

5. The method of claim 1, wherein the data structure reflects an aspect for each of the second plurality of scanners, the data structure being included in a group of data structures, the group consisting of:

a) a hash;

b) a string; and

c) an array.

6. The method of claim 1, wherein the second plurality of scanners scan the first data if the first data structure does not match the second data structure.

7. The method of claim 1, wherein settings and versions of the first plurality of scanners and the second plurality of scanners are compared in order to determine whether to perform the subsequent scan.

8. The method of claim 1, further comprising:

determining whether one or more hashes exist for an electronic mail message;

retrieving particular hashes for at least one scanner previously utilized for scanning the electronic mail message at the first network device; and

determining not to subsequently scan the electronic mail message.

9. The method of claim 1, wherein the first data includes hashes associated with scan settings of the first plurality of scanners.

10. The method of claim 1, further comprising:

evaluating an e-mail message;

setting a flag for a particular one of the second plurality of scanners; and

scanning the e-mail message using the particular one of the second plurality of scanners.

11. The method of claim 1, further comprising:

setting a plurality of flags associated with a subset of the second plurality of scanners; and

updating a scan database of the second network device based on the plurality of flags.

12. Non-transitory media that includes code for execution and when executed by a processor operable to perform operations, comprising:

receiving first data from a first network device configured to utilize a first plurality of scanners to perform a first scan;

identifying a first data structure associated with the first data;

comparing the first data structure to a second data structure at a second device, wherein the second data structure reflects an aspect of a second plurality of scanners, and wherein the second device is configured to communicate with the first device over a network connection;

making a determination as to whether hash values associated with the first plurality of scanners and the second plurality of scanners have been compared; and

preventing the second plurality of scanners from performing a subsequent scan of the first data based on the determination.

13. The media of claim 12, wherein the first data is sent by a mail server and received at a gateway.

14. The media of claim 12, wherein the second plurality of scanners are part of a group of scanners, the group consisting of:

a) an antivirus scanner;

b) an anti-spam scanner;

c) a mail size filtering scanner;

d) a file filtering scanner; and

e) a corrupt content scanner.

15. The media of claim 12, wherein the second plurality of scanners scan the first data if the first data structure does not match the second data structure.

16. The media of claim 12, wherein settings and versions of the first plurality of scanners and the second plurality of scanners are compared in order to determine whether to perform the subsequent scan.

17. An apparatus, comprising:

a processor coupled to a memory, wherein the apparatus is configured to;

receive first data from a first network device configured to utilize a first plurality of scanners to perform a first scan;

identify a first data structure associated with the first data;

compare the first data structure to a second data structure at a second device, wherein the second data structure reflects an aspect of a second plurality of scanners, and wherein the second device is configured to communicate with the first device over a network connection;

make a determination as to whether hash values associated with the first plurality of scanners and the second plurality of scanners have been compared; and

prevent the second plurality of scanners from performing a subsequent scan of the first data based on the determination.

18. The apparatus of claim 17, wherein the second plurality of scanners are configured for identifying unwanted data.

19. The apparatus of claim 17, wherein settings and versions of the first plurality of scanners and the second plurality of scanners are compared in order to determine whether to perform the subsequent scan.

20. The apparatus of claim 17, the apparatus further configured to:

set a plurality of flags associated with a subset of the second plurality of scanners; and

update a scan database of the second network device based on the plurality of flags.