System, method and computer program product for scanning portions of data

• US 9,106,478 B2
• Filed: 09/28/2012
• Issued: 08/11/2015
• Est. Priority Date: 12/19/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Hearnden, Stephen Owen, Lucas, Martin J., Hinton, Christopher M., Wilson, Nicolas K.
• Primary Examiner(s): Goodchild, William
• Assistant Examiner(s): TRUONG, THONG P
• Application Number:
  US13/629,679
• Publication Number:
  US 20130042320A1
• Time in Patent Office: 1,047 Days
• Field of Search: 726/22, 726/23, 726/24, 726/25, 713/188, 713/200, 718/188
• US Class Current: 1/1
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A scanning system, method and computer program product are provided. In use, portions of data are scanned. Further, access to a scanned portion of the data is allowed during scanning of another portion of the data.

Claims

1. A computer implemented method, comprising:

receiving a notification from a file system application programming interface, by an on-access scanner, of a request by an application to access data;

determining a status of each one of a plurality of portions of the data;

providing scan requests for two or more portions of the data when the two or more portions are determined to have unknown clean statuses;

prioritizing the scan requests to be performed based, at least in part, on a particular order utilized by the application to access the data, wherein a first scan request for a first portion of the data is prioritized to be performed before a second scan request for a second portion of the data when the application requires the first portion of the data to be accessed prior to the second portion of the data; and

sending, by the on-access scanner, an allow message to the file system programming interface when a scan of the first portion of the data indicates the first portion has a known clean status, the allow message indicating that the file system application programming interface is to allow access to the first portion of the data, wherein the first portion of the data is accessed by the application during scanning of one or more other portions of the data.

2. The method of claim 1, wherein at least one of the unknown clean statuses of the two or more portions of the data indicates at least one portion of the data has not been previously scanned.

3. The method of claim 1, wherein at least one of the unknown clean statuses of the two or more portions of the data indicates at least one portion of the data has changed based on a comparison of the at least one portion and a previously scanned version of the at least one portion.

4. The method of claim 3, further comprising:

comparing a checksum of the at least one portion of the data to a checksum of the previously scanned version of the at least one portion to determine whether the at least one portion has changed.

5. The method of claim 1, further comprising:

allowing access to the second portion of the data if a scan result indicates the second portion does not contain unwanted code.

6. The method of claim 1, wherein the request to access data is intercepted by the file system application programming interface.

7. At least one non-transitory computer readable medium comprising computer code that when executed by a processor:

receives a notification from a file system application programming interface, by an on-access scanner, of a request by an application to access data;

determines a status of each one of a plurality of portions of the data;

provides scan requests for two or more portions of the data when the two or more portions are determined to have unknown clean statuses;

prioritizes the scan requests to be performed based, at least in part, on a particular order utilized by the application to access the data, wherein a first scan request for a first portion of the data is prioritized to be performed before a second scan request for a second portion of the data when the application requires the first portion of the data to be accessed prior to the second portion of the data; and

sending, by the on-access scanner, an allow message to the file system programming interface when a scan of the first portion of the data indicates the first portion has a known clean status, the allow message indicating that the file system application programming interface is to allow access to the first portion of the data, wherein the first portion of the data is accessed by the application during scanning of one or more other portions of the data.

8. The at least one computer readable medium of claim 7, wherein at least one of the unknown clean statuses of the two or more portions of the data indicates at least one portion of the data has not been previously scanned.

9. The at least one computer readable medium of claim 7, wherein at least one of the unknown clean statuses of the two or more portions of the data indicates at least one portion of the data has changed based on a comparison of the at least one portion and a previously scanned version of the at least one portion.

10. The at least one computer readable medium of claim 7,

wherein the request to access data is intercepted by the file system application programming interface.

11. A system, comprising:

a processor configured to;

receive a notification from a file system application programming interface, by an on-access scanner, of a request by an application to access data;

determine a status of each one of a plurality of portions of the data;

provide scan requests for two or more portions of the data when the two or more portions are determined to have unknown clean statuses;

prioritize the scan requests to be performed based, at least in part, on a particular order utilized by the application to access the data, wherein a first scan request for a first portion of the data is prioritized to be performed before a second scan request for a second portion of the data when the application requires the first portion of the data to be accessed prior to the second portion of the data; and

sending, by the on-access scanner, an allow message to the file system programming interface when a scan of the first portion of the data indicates the first portion has a known clean status, the allow message indicating that the file system application programming interface is to allow access to the first portion of the data, wherein the first portion of the data is accessed by the application during scanning of one or more other portions of the data.

12. The system of claim 11, wherein at least one of the unknown clean statuses of the two or more portions of the data indicates at least one portion of the data has not been previously scanned.

13. The system of claim 11, wherein at least one of the unknown clean statuses of the two or more portions of the data indicates at least one portion of the data has changed based on a comparison of the at least one portion and a previously scanned version of the at least one portion.

14. The system of claim 11, the processor further configured to:

allow access to the second portion of the data if a scan result indicates the second portion does not contain unwanted code.

15. The system of claim 11,

wherein the request to access data is intercepted by the file system application programming interface.