# US 10,372,900 B2 · System and method for executing calls from OS process to file system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,372,900 B2
- Document ID: US10372900B2
- Status: Granted
- Kind: B2
- Application number: 15/040,055
- Filed: 2016-02-10
- Published: 2017-06-22
- Granted: 2019-08-06
- Earliest claimed: 2015-12-18
- Assignees: AO Kaspersky Lab
- Applicants: AO Kaspersky Lab
- Inventors: Vyacheslav I. Levchenko; Andrey V. Sobko; Konstantin Y. Manurin; Vladimir V. Strogov
- Web page: https://patentgrep.com/patent/US10372900B2

## CPC

- G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
- G06F 21/561: {Virus type analysis}
- G06F 2221/033: Test or assess software
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Disclosed are system and method for executing calls to a file system of a computer. An exemplary method comprises intercepting, by a software agent, a call to the file system; determining one or more parameters of the call that identify its functionality; determining a priority of executing the call based on the one or more parameters; storing information about the call, the parameters and the priority into a database; selecting from the database, one or more calls for execution based at least in part on relative priorities of execution of the plurality of calls stored in the database; determining whether to execute or not to execute a selected call based on whether the selected call interferes with execution of an earlier selected call; and when the selected call does not interfere with execution of an earlier selected call, passing the selected call to the file system for execution.

## Claims

### Claim 1

A method for executing calls to a file system of a computer, the method comprising:
intercepting, by a software agent executed by a processor, a first call to the file system;
determining two or more parameters of the first call that identify at least one functionality of the call, the two or more parameters comprising a first call parameter specifying a type of operation of the first call and a second call parameter specifying a file identifier of the first call;
determining an execution priority associated with the first call based on the two or more parameters;
storing information about the first call, the parameters, and the execution priority to a database, wherein the stored information is combined with a data block associated with a second call of a plurality of calls stored in the database into a set of call data blocks, wherein call parameters of the second call specifying a type of operation of the second call and a file identifier of the second call are the same as at least two of the parameters of the first call, each call data block including a respective call, parameters of the respective call, and execution priority of the respective call;
selecting, from the database, one or more calls for execution based at least in part on relative priorities of execution of the plurality of calls stored in the database;
determining whether to execute or not to execute a selected call based on whether the selected call interferes with execution of an earlier selected call having a same file identifier as the selected call, wherein the earlier selected call is from a process of an antivirus application and has a higher relative execution priority;
responsive to determining that the selected call does not interfere with execution of the earlier selected call, passing the selected call to the file system for execution; and
responsive to determining that the selected call does interfere with execution of the earlier selected call, sending the selected call to a caching module.

### Claim 2 (depends on 1)

The method of claim 1, wherein intercepting, by the software agent, the first call to the file system includes intercepting a call from the process of the antivirus application to the file system.

### Claim 3 (depends on 1)

The method of claim 1, wherein the software agent includes a driver configured to detect calls to the file system and modify the detected calls to be redirected to the driver.

### Claim 4 (depends on 1)

The method of claim 1, wherein the two or more parameters include: an identifier of the process that made the call, attributes of a file, parameters of data contained in the file, and security policies for accessing the file.

### Claim 5 (depends on 1)

The method of claim 1, wherein selecting from the database, one or more calls for execution based at least in part on relative priorities of execution of the plurality of calls stored in the database includes one or more of:
selecting a call with a specified priority;
selecting a call with a higher priority over all other calls in the database;
selecting a call having lower priority than a call that was sent for execution earlier;
selecting a call having higher priority than a call that was sent for execution earlier; or
selecting two or more calls having the same priority of execution provided that the total number of such calls exceeds a threshold.

### Claim 6 (depends on 1)

The method of claim 1, wherein determining whether to execute the selected call based on whether the selected call interferes with execution of the earlier selected call includes:
determining whether the selected call has at least one parameter in common with an earlier selected call that still being executed.

### Claim 7 (depends on 1)

The method of claim 1, wherein determining whether the selected call interferes with execution of the earlier selected call further comprising:
determining that the selected call does not interfere with execution of the earlier selected call responsive to determining that a call parameter of the selected call and a call parameter of the earlier selected call both include a call type specifying a read operation is to be executed on a file associated with the same file identifier.

### Claim 8 (depends on 1)

The method of claim 1, wherein determining whether the selected call interferes with execution of the earlier selected call further comprises:
determining that the selected call does not interfere with execution of the earlier selected call responsive to determining that no call parameters associated with the selected call are equal to any call parameters associated with the earlier selected call.

### Claim 9

A system for executing calls to a file system of a computer, the system comprising:
a hardware processor configured to:
execute a software agent operable to intercept a first call to the file system;
determine two or more parameters of the first call that identify at least one functionality of the call, the two or more parameters comprising a first call parameter specifying a type of operation of the first call and a second call parameter specifying a file identifier of the first call;
determine an execution priority associated with the first call based on the two or more parameters;
store information about the first call, the parameters, and the execution priority to a database, wherein the stored information is combined with a data block associated with a second call of a plurality of calls stored in the database into a set of call data blocks, wherein call parameters of the second call specifying a type of operation of the second call and a file identifier of the second call are the same as at least two of the parameters of the first call, each call data block including a respective call, parameters of the respective call, and execution priority of the respective call;
select from the database, one or more calls for execution based at least in part on relative priorities of execution of the plurality of calls stored in the database;
determine whether to execute or not to execute a selected call based on whether the selected call interferes with execution of an earlier selected call having a same file identifier as the selected call, wherein the earlier selected call is from a process of an antivirus application and has a higher relative execution priority;
responsive to determining that the selected call does not interfere with execution of the earlier selected call, pass the selected call to the file system for execution; and
responsive to determining that the selected call does interfere with execution of the earlier selected call, send the selected call to a caching module.

### Claim 10 (depends on 9)

The system of claim 9, wherein the software agent is operable to intercept a call from the process of the antivirus application to the file system.

### Claim 11 (depends on 9)

The system of claim 9, wherein the software agent includes a driver configured to detect calls to the file system and modify the detected calls to be redirected to the driver.

### Claim 12 (depends on 9)

The system of claim 9, wherein the two or more parameters include: an identifier of the process that made the call, attributes of a file, parameters of data contained in the file, and security policies for accessing the file.

### Claim 13 (depends on 9)

The system of claim 9, wherein, to select from the database, one or more calls for execution based at least in part on relative priorities of execution of the plurality of calls stored in the database, the hardware processor is configured to perform one or more of:
selecting a call with a specified priority;
selecting a call with a higher priority over all other calls in the database;
selecting a call having lower priority than a call that was sent for execution earlier;
selecting a call having higher priority than a call that was sent for execution earlier; or
selecting two or more calls having the same priority of execution provided that the total number of such calls exceeds a threshold.

### Claim 14 (depends on 9)

The system of claim 9, wherein, to determine whether to execute the selected call based on whether the selected call interferes with execution of the earlier selected call, the hardware processor is configured to perform:
determining whether the selected call has at least one parameter in common with an earlier selected call that still being executed.

### Claim 15

A non-transitory computer readable medium storing computer executable instructions for executing calls to a file system of a computer, including instructions for:
intercepting, by a software agent executed by a processor, a first call to the file system;
determining two or more parameters of the first call that identify functionality of the call, the two or more parameters comprising a first call parameter specifying a type of operation of the first call and a second call parameter specifying a file identifier of the first call;
determining an execution priority associated with the first call based on the two or more parameters;
storing information about the first call, the parameters, and the execution priority to a database, wherein the stored information is combined with a data block associated with a second call of a plurality of calls stored in the database into a set of call data blocks, wherein call parameters of the second call specifying a type of operation of the second call and a file identifier of the second call are the same as at least two of the parameters of the first call, each call data block including a respective call, parameters of the respective call, and execution priority of the respective call;
selecting, from the database, one or more calls for execution based at least in part on relative priorities of execution of the plurality of calls stored in the database;
determining whether to execute or not to execute a selected call based on whether the selected call interferes with execution of an earlier selected call having a same file identifier as the selected call, wherein the earlier selected call is from a process of an antivirus application and has a higher relative execution priority;
responsive to determining that the selected call does not interfere with execution of the earlier selected call, passing the selected call to the file system for execution; and
responsive to determining that the selected call does interfere with execution of the earlier selected call, sending the selected call to a caching module.

### Claim 16 (depends on 15)

The non-transitory computer readable medium of claim 15, wherein intercepting, by a software agent, a call to the file system includes intercepting a call from the process of the antivirus application to the file system.

### Claim 17 (depends on 15)

The non-transitory computer readable medium of claim 15, wherein the software agent includes a driver configured to detect calls to the file system and modify the detected calls to be redirected to the driver.

### Claim 18 (depends on 15)

The non-transitory computer readable medium of claim 15, wherein the two or more parameters include: an identifier of the process that made the call, attributes of a file, parameters of data contained in the file, and security policies for accessing the file.

### Claim 19 (depends on 15)

The non-transitory computer readable medium of claim 15, wherein the instructions for selecting from the database, one or more calls for execution based at least in part on relative priorities of execution of the plurality of calls stored in the database comprises instructions for one or more of:
selecting a call with a specified priority;
selecting a call with a higher priority over all other calls in the database;
selecting a call having lower priority than a call that was sent for execution earlier;
selecting a call having higher priority than a call that was sent for execution earlier; or
selecting two or more calls having the same priority of execution provided that the total number of such calls exceeds a threshold.

### Claim 20 (depends on 15)

The non-transitory computer readable medium of claim 15, wherein the instructions for determining whether to execute the selected call based on whether the selected call interferes with execution of the earlier selected call comprise instructions for:
determining whether the selected call has at least one parameter in common with an earlier selected call that still being executed.