Predictive real-time and scheduled anti-virus scanning

A system for combining predictive analytics from a real-time file access module and a scheduler module in order to enhance overall system performance for a distributed file system performing antivirus scanning comprising at least one storage device and at least one hardware processor configured to:

• receive a first access request at a node of the distributed file system for a first file stored on the node;
• determine if the first file must undergo an anti-virus scan prior to allowing access to the first file;
• place the first file in a real-time anti-virus scan queue;
• predict at least a second file, which will be requested after the first file, wherein the prediction is based on a heuristic data set, the heuristic data set including a statistically significant likelihood that a second access request will be received for the second file based on a past pattern showing the second file being requested after the first file;
• evaluate at a node of the distributed file system a plurality of parameters, each parameter being associated with a respective plurality of files stored in the distributed file storage system;
• create a sequentially ordered list of the plurality of stored files based on the plurality of parameters, wherein the sequentially ordered list comprising one or more files to undergo the anti-virus scan on a lower priority than files in the real-time anti-virus scan queue, and wherein the plurality of stored files are ordered according to at least one parameter;
• place the predicted at least the second file in a predictive scan queue, wherein the predicted at least the second file in the predictive scan queue will undergo the anti-virus scan on a lower priority than the files in the real-time anti-virus scan queue and on a higher priority than the files in the sequentially ordered list;
• perform the anti-virus scan on the files in the real-time anti-virus scan queue, the predictive scan queue, and the sequentially ordered list, wherein the anti-virus scan on the files in the real-time anti-virus scan queue and the predictive scan queue are performed at an overlapping point in time.

A non-transitory computer readable medium for combining predictive analytics from a real-time file access module and a scheduler module in order to enhance overall system performance for a distributed file system performing antivirus scanning with program instructions stored thereon to perform the following acts:

• receive a first access request at a node of the distributed file system for a first file stored on the node;
• determine if the first file must undergo an anti-virus scan prior to allowing access to the first file;
• place the first file in a real-time anti-virus scan queue;
• predict at least a second file, which will be requested after the first file, wherein the prediction is based on a heuristic data set, the heuristic data set including a statistically significant likelihood that a second access request will be received for the second file based on a past pattern showing the second file being requested after the first file;
• evaluate at a node of the distributed file system a plurality of parameters, each parameter being associated with a respective plurality of files stored in the distributed file storage system;
• create a sequentially ordered list of the plurality of stored files based on the plurality of parameters, wherein the sequentially ordered list comprising one or more files to undergo the anti-virus scan on a lower priority than files in the real-time anti-virus scan queue, and wherein the plurality of stored files are ordered according to at least one parameter;
• place the predicted at least the second file in a predictive scan queue, wherein the predicted at least the second file in the predictive scan queue will undergo the anti-virus scan on a lower priority than the files in the real-time anti-virus scan queue and on a higher priority than the files in the sequentially ordered list;
• perform the anti-virus scan on the files in the real-time anti-virus scan queue, the predictive scan queue, and the sequentially ordered list, wherein the anti-virus scan on the files in the real-time anti-virus scan queue and the predictive scan queue are performed at an overlapping point in time.