System, method and computer program product for scanning portions of data

• US 9,686,119 B2
• Filed: 08/11/2014
• Issued: 06/20/2017
• Est. Priority Date: 12/19/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Wilson, Nicolas K., Hearnden, Stephen Owen, Lucas, Martin J., Hinton, Christopher M.
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): TRUONG, THONG P
• Application Number:
  US14/456,942
• Publication Number:
  US 20150067856A1
• Time in Patent Office: 1,044 Days
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A scanning system, method and computer program product are provided. In use, portions of data are scanned. Further, access to a scanned portion of the data is allowed during scanning of another portion of the data.

Claims

1. At least one non-transitory computer readable medium comprising computer code that when executed by a processor:

receives, by an on-access scanner, a notification from a file system application programming interface of a request by an application to access data;

determines a scan order for two or more portions of the data based, at least in part, on an access pattern to be utilized by the application to access the two or more portions, wherein a scanner is to perform scans on the two or more portions of the data according to the scan order; and

sends a message to the file system application programming interface if a scan of a first portion of the two or more portions indicates the first portion is clean, wherein access to the first portion by the application is to be allowed during scanning of at least a second portion of the two or more portions of the data.

2. The at least one non-transitory computer readable medium according to claim 1, wherein the on-access scanner includes the scanner.

3. The at least one non-transitory computer readable medium according to claim 1, wherein the on-access scanner includes an interface that is separate from the scanner, and wherein the interface is to be in communication with the scanner.

4. The at least one non-transitory computer readable medium according to claim 1, wherein the message includes an open function call from the scanner to the file system application programming interface.

5. The at least one non-transitory computer readable medium according to claim 1, wherein the computer code when executed by a processor:

determines a status of each one of a plurality of portions of the data; and

allows without scanning, access to one or more portions of the plurality of portions of the data determined to have a known clean status.

6. The at least one non-transitory computer readable medium according to claim 5, wherein the computer code when executed by a processor:

determines the two or more portions of the data have an unknown clean status before the scan order is determined, wherein access by the application to at least one portion of the one or more portions having a known clean status is to be allowed during scanning of at least one portion of the two or more portions having an unknown clean status.

7. The at least one non-transitory computer readable medium according to claim 1, wherein the computer code when executed by a processor:

receives an unlock message from the scanner indicating the first portion of the data is clean based on the scan of the first portion by the scanner, wherein the message to the file system application programming interface includes an allow message to be sent in response to receiving the unlock message from the scanner.

8. A system, comprising:

an on-access scanner including one or more processors, the one or more processors configured to;

receive a notification from a file system application programming interface of a request by an application to access data;

determine a scan order for two or more portions of the data based, at least in part, on an access pattern to be utilized by the application to access the two or more portions; and

send a message to the file system application programming interface if a scan of a first portion of the two or more portions indicates the first portion is clean, wherein access to the first portion by the application is to be allowed during scanning of at least a second portion of the two or more portions of the data; and

a scanner configured to scan the two or more portions of the data according to the scan order.

9. The system according to claim 8,

wherein the scanner is further configured to:

receive two or more scan requests from the on-access scanner to scan the two or more portions of the data based on the scan order, wherein the message includes an open function call from the scanner to the file system application programming interface.

10. The system according to claim 8, wherein the one or more processors of the on-access scanner are further configured to:

receive an unlock message from the scanner indicating the first portion of the data is clean based on the scan of the first portion by the scanner, wherein the message to the file system application programming interface includes an allow message to be sent in response to receiving the unlock message from the scanner.

11. The system according to claim 8, wherein the one or more processors of the on-access scanner are further configured to:

determine a status of each one of a plurality of portions of the data; and

allow without scanning, access to one or more portions of the plurality of portions of the data determined to have a known clean status.

12. The system according to claim 11, wherein the one or more processors of the on-access scanner are further configured to:

determine the two or more portions of the data have an unknown clean status before the scan order is determined, wherein access by the application to at least one portion of the one or more portions having a known clean status is to be allowed during scanning of at least one portion of the two or more portions having an unknown clean status.

13. At least one non-transitory computer readable medium comprising computer code that when executed by a processor:

receives, by an on-access scanner, a notification from a file system application programming interface of a request by an application to access data;

determines a scan order for two or more portions of the data based, at least in part, on information associated with the data, wherein a scanner is to perform scans on the two or more portions of the data according to the scan order; and

sends a message to the file system application programming interface if a scan of a first portion of the two or more portions indicates the first portion is clean, wherein access to the first portion by the application is to be allowed during scanning of at least a second portion of the two or more portions of the data.

14. The at least one non-transitory computer readable medium according to claim 13, wherein the information includes one or more of the application requesting access to the data, a file type of the data, and a context of the request.

15. The at least one non-transitory computer readable medium according to claim 13, wherein the on-access scanner includes the scanner.

16. The at least one non-transitory computer readable medium according to claim 13, wherein the on-access scanner includes an interface that is separate from the scanner, and wherein the interface is to be in communication with the scanner.

17. The at least one non-transitory computer readable medium according to claim 13, wherein the message includes an open function call from the scanner to the file system application programming interface.

18. The at least one non-transitory computer readable medium according to claim 13, wherein the computer code when executed by a processor:

determines a status of each one of a plurality of portions of the data; and

allows without scanning, access to one or more portions of the plurality of portions of the data determined to have a known clean status.

19. The at least one non-transitory computer readable medium according to claim 18, wherein the computer code when executed by a processor:

determines the two or more portions of the data have an unknown clean status before the scan order is determined, wherein access by the application to at least one portion of the one or more portions having a known clean status is to be allowed during scanning of at least one portion of the two or more portions having an unknown clean status.

20. The at least one non-transitory computer readable medium according to claim 13, wherein the computer code when executed by a processor:

receives an unlock message from the scanner indicating the first portion of the data is clean based on the scan of the first portion by the scanner, wherein the message to the file system application programming interface includes an allow message to be sent in response to receiving the unlock message from the scanner.