Lookahead signature-based malware detection
AssigneeMalwarebytes Inc.
InventorRavi Kalyan Namballa
Life of this patent
Estimating the term…
Abstract
A computing device determines, for a first time period, a usage-based file list identifying one or more executable files. The computing device determines, for each of the one or more executable files identified by the usage-based file list, whether to perform a malware scan upon the executable file based on a cached record for the executable file. The computing device schedules, for execution during a preceding time period before the first time period, a malware scan for at least one of the one or more executable files based on the corresponding determination of whether to perform a malware scan. Each scheduled malware scan is initiated as a low priority thread for execution. The computing device performs each scheduled malware scan during the preceding time period.
Claims20
A computer-implemented method, comprising:
- determining, for a first time period, an executable file predicted to be used during the first time period;
- determining whether to perform a malware scan upon the executable file based on a cached record for the executable file;
- scheduling, for execution during a preceding time period before the first time period, a malware scan for the executable file based on the corresponding determination of whether to perform a malware scan;
- and
- performing the scheduled malware scan during the preceding time period.
A non-transitory computer-readable storage medium storing computer program instructions executable by a processor to perform steps, the steps comprising:
- determining, for a first time period, an executable file predicted to be used during the first time period;
- determining whether to perform a malware scan upon the executable file based on a cached record for the executable file;
- scheduling, for execution during a preceding time period before the first time period, a malware scan for the executable file based on the corresponding determination of whether to perform a malware scan;
- and
- performing the scheduled malware scan during the preceding time period.
A system, comprising:
- a processor;
- and
- a non-transitory computer-readable storage medium storing computer program instructions executable by the processor to perform steps, the steps comprising:
- determining, for a first time period, an executable file predicted to be used during the first time period;
- determining whether to perform a malware scan upon the executable file based on a cached record for the executable file;
- scheduling, for execution during a preceding time period before the first time period, a malware scan for the executable file based on the corresponding determination of whether to perform a malware scan;
- and
- performing the scheduled malware scan during the preceding time period.
Dependencies are inferred from the claim text.