Scanning computer files for specified content

• US 9,866,585 B2
• Filed: 12/26/2014
• Issued: 01/09/2018
• Est. Priority Date: 06/15/2001
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Grupe, Robert
• Primary Examiner(s): Zee, Edward
• Assistant Examiner(s): NGUY, CHI D
• Application Number:
  US14/583,481
• Publication Number:
  US 20150128277A1
• Time in Patent Office: 1,110 Days
• Field of Search: 726 22- 25
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Scanning for computer viruses or E-mail and data content filtering is performed using a distributed programming approach. A master computer 4 serves to divide the scanning operation into a plurality of tasks that are allocated to further computers 8, 10, 12, 14, 20. These further computers then separately perform the tasks and return the results to the master computer 4. The master computer 4 can check the update status of the further computers prior to them starting operation in order to check that they have the latest data defining the scanning to be performed.

Claims

1. A computer program product, embodied on a non-transitory, machine readable medium, that, when executed, causes a processor to perform a method comprising:

transmitting definition or filtering data;

processing at least one of a plurality of computer files, based, at least in part, on the definition or filtering data, wherein the processing is divided into a plurality of tasks;

issuing to one or more further computers a scanning task of the plurality of tasks of the processing of the at least one of the plurality of computer files, in response to a receipt of an availability indication from the one or more further computers;

performing at least one of the plurality of tasks, wherein the at least one of the plurality of tasks scans for unwanted content that is more common than unwanted content for which the scanning task scans;

receiving from the one or more further computers a result of the scanning task of the plurality of tasks; and

responsive to a detection of a computer file with one or more characteristics indicating the unwanted content for which the at least one of the plurality of tasks and the scanning task scan, taking a responsive action.

2. The computer program product according to claim 1, wherein the responsive action is banning the computer file from use.

3. The computer program product according to claim 1, wherein the responsive action is quarantining the computer file.

4. The computer program product according to claim 1, wherein the plurality of computer files are incoming email messages.

5. The computer program product according to claim 1, wherein the plurality of computer files are stored remotely from the processor.

6. The computer program product according to claim 1, wherein the plurality of computer files are transmission streams.

7. The computer program product according to claim 1, wherein the unwanted content is at least one of a computer virus, a worm program, or a Trojan program.

8. The computer program product according to claim 1, wherein the at least one of the plurality of tasks is scanning for unwanted content that is more recent than unwanted content for which the scanning task of the plurality of tasks scans.

9. The computer program product according to claim 1, wherein the plurality of computer files are stored on a network storage device remote from the processor, and the scanning task includes an allocation of a predetermined block of the plurality of computer files on the network storage device.

10. A method implemented by an apparatus, the method comprising:

transmitting definition or filtering data;

processing at least one of a plurality of computer files, based, at least in part, on the definition or filtering data, wherein the processing is divided into a plurality of tasks;

issuing to one or more further computers a scanning task of the plurality of tasks of the processing of the at least one of the plurality of computer files, in response to a receipt of an availability indication from the one or more further computers;

performing, with a processing unit of the apparatus, at least one of the plurality of tasks, wherein the at least one of the plurality of tasks scans for unwanted content that is more common than unwanted content for which the scanning task scans;

receiving from the one or more further computers a result of the scanning task of the plurality of tasks; and

responsive to a detection of a computer file with one or more characteristics indicating the unwanted content for which the at least one of the plurality of tasks and the scanning task scan, taking a responsive action.

11. The method according to claim 10, wherein the plurality of computer files are incoming email messages.

12. The method according to claim 10, wherein the plurality of computer files are transmission streams.

13. An apparatus, comprising:

a network interface that transmits definition or filtering data; and

a processing unit configured to perform a processing of at least one of a plurality of computer files, based, at least in part, on the definition or filtering data, wherein the processing is divided into a plurality of tasks, and

the network interface issues to one or more further computers a scanning task of the plurality of tasks of the processing of the at least one of the plurality of computer files, in response to a receipt of an availability indication from the one or more further computers,

the processing unit performs at least one of the plurality of tasks, wherein the at least one of the plurality of tasks scans for unwanted content that is more common than unwanted content for which the scanning task scans,

the network interface receives from the one or more further computers a result of the scanning task of the plurality of tasks, and

the processing unit, responsive to a detection of a computer file with one or more characteristics indicating the unwanted content for which the at least one of the plurality of tasks and the scanning task scan, takes a responsive action.

14. The apparatus according to claim 13, wherein the responsive action is banning the computer file from use.

15. The apparatus according to claim 13, wherein the responsive action is quarantining the computer file.

16. The apparatus according to claim 13, wherein the plurality of computer files are incoming email messages.

17. The apparatus according to claim 13, wherein the plurality of computer files are stored remotely from the apparatus.

18. The apparatus according to claim 13, wherein the plurality of computer files are transmission streams.

19. The apparatus according to claim 13, wherein the unwanted content is at least one of a computer virus, a worm program, or a Trojan program.

20. The apparatus according to claim 13, wherein the one or more further computers is implemented as a computer on a card connected to a system bus of the apparatus.