Fingerprint analysis for anti-virus scan

• US 9,449,174 B2
• Filed: 07/29/2014
• Issued: 09/20/2016
• Est. Priority Date: 11/16/2009
• Status: Active Grant

• Current Assignee: Quantum Corporation (Chi Ko Investment Co., Ltd.)
• Original Assignee: Quantum Corporation (Chi Ko Investment Co., Ltd.)
• Inventors: Wade, Gregory L., Haile, J. Mitchell
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US14/445,338
• Publication Number:
  US 20140337981A1
• Time in Patent Office: 784 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Disclosed are systems and methods for fingerprint analysis for anti-virus scanning. In an embodiment, a method of scanning for infected data items is disclosed. The method provides identifying a plurality of changed data items on a server machine. The method further provides, from a data system in communication with the server machine, performing a virus scan on the plurality of changed data items. The method further provides that the data system maintains a list of data items that the virus scan found to be infected.

Claims

1. A method of scanning for infected data items, the method comprising:

identifying a first plurality of changed data blocks of a first virtual machine file stored on a server machine;

from a data system in communication with the server machine, performing a virus scan on the first plurality of changed data blocks, wherein performing the virus scan comprises;

processing the plurality of changed data blocks to generate a plurality of fingerprints;

identifying a target fingerprint from the plurality of fingerprints using a reference fingerprint, wherein the reference fingerprint is generated from a second plurality of changed data blocks of a second virtual machine file representing an infected data item in the second virtual machine file; and

identifying the infected data item corresponding to the target fingerprint within a plurality of data items in the first virtual machine file; and

in the data system, adding the infected data item to a list of data items in the first virtual machine file that the virus scan found to be infected.

2. The method of claim 1, wherein the reference fingerprint is one of a plurality of reference fingerprints.

3. The method of claim 1, further comprising:

receiving the plurality of changed data blocks in the data system from the server machine.

4. A non-transitory computer readable medium having instructions stored thereon for operating a data system that, when executed by the data system, direct the data system to perform a method of scanning for infected data items, the method comprising:

identifying a first plurality of changed data blocks of a first virtual machine file stored on a server machine;

performing a virus scan on the first plurality of changed data blocks, wherein performing the virus scan comprises;

processing the plurality of changed data blocks to generate a plurality of fingerprints;

identifying a target fingerprint from the plurality of fingerprints using a reference fingerprint, wherein the reference fingerprint is generated from a second plurality of changed data blocks of a second virtual machine file representing an infected data item in the second virtual machine file; and

identifying the infected data item corresponding to the target fingerprint within a plurality of data items in the first virtual machine file; and

adding the infected data item to a list of data items in the first virtual machine file that the virus scan found to be infected.

5. The non-transitory computer readable medium of claim 4, wherein the reference fingerprint is one of a plurality of reference fingerprints.

6. The non-transitory computer readable medium of claim 4, further comprising:

receiving the plurality of changed data blocks from the server machine.

7. A data system comprising:

a processor configured to identify a first plurality of changed data blocks of a first virtual machine file stored on a server machine, and perform a virus scan on the first plurality of changed data blocks, wherein performing the virus scan comprises;

processing the plurality of changed data blocks to generate a plurality of fingerprints;

identifying a target fingerprint from the plurality of fingerprints using a reference fingerprint, wherein the reference fingerprint is generated from a second plurality of changed data blocks of a second virtual machine file representing an infected data item in the second virtual machine file; and

identifying the infected data item corresponding to the target fingerprint within a plurality of data items in the first virtual machine file; and

a storage system configured to add the infected data item to a list of data items in the first virtual machine file that the virus scan found to be infected.

8. The data system of claim 7, wherein the reference fingerprint is one of a plurality of reference fingerprints.

9. The data system of claim 7, further comprising:

a communication interface configured to receive the plurality of changed data blocks from the server machine.