Method and system for scanning electronic data for predetermined data patterns

A method for scanning electronic data for predetermined data patterns, the method comprising:

• reading the electronic data in serial fashion;
• consulting, during the reading, an acceleration list, the acceleration list specifying one or more sections of the electronic data that are to be scanned for the predetermined data patterns, at least one predetermined data pattern being applicable to each of the one or more sections based, at least in part, on a predetermined data address range associated with the at least one predetermined data pattern lying within that section of the electronic data, the predetermined address range specifying a location of a potential occurrence, within the electronic data, of the at least one predetermined data pattern;
• scanning for predetermined data patterns, during the reading, only the one or more sections of the electronic data specified in the acceleration list;
• and
• reporting results of the scanning to a user.

A computer system, comprising:

• at least one processor;
• a storage device containing electronic data organized as one or more files;
• and
• a memory containing a plurality of program instructions executable by the at least one processor, the plurality of program instructions being configured to cause the at least one processor, while reading a particular file in serial fashion, to:
• consult an acceleration list, the acceleration list specifying one or more sections of the particular file that are to be scanned for malware, at least one malware definition being applicable to each of the one or more sections based, at least in part, on a predetermined data address range associated with the at least one malware definition lying within that section of the particular file, the predetermined address range specifying a location of a potential occurrence, within the particular file, of the at least one malware definition;
• scan for malware only the one or more sections of the particular file specified in the acceleration list;
• and
• take corrective action responsive to results of scanning for malware only the one or more sections of the particular file specified in the acceleration list.

A network gateway apparatus, comprising:

• at least one processor;
• a communication interface configured to send and receive data over a network;
• and
• a memory containing a plurality of program instructions executable by the at least one processor, the plurality of program instructions being configured to cause the at least one processor, while reading a data stream from the network via the communication interface, to:
• consult an acceleration list, the acceleration list specifying one or more sections of the data stream that are to be scanned for malware, at least one malware definition being applicable to each of the one or more sections based, at least in part, on a predetermined data address range associated with the at least one malware definition lying within that section of the data stream, the predetermined address range specifying a location of a potential occurrence, within the data stream, of the at least one malware definition;
• scan for malware only the one or more sections of the data stream specified in the acceleration list;
• and
• take corrective action responsive to results of scanning for malware only the one or more sections of the data stream specified in the acceleration list.

A computer-readable storage medium containing a plurality of program instructions executable by a processor for scanning electronic data for malware, the plurality of program instructions comprising:

• a first instruction segment configured to read the electronic data in serial fashion;
• and
• a second instruction segment configured to perform the following as the electronic data is being read in serial fashion:
• consult an acceleration list, the acceleration list specifying one or more sections of the electronic data that are to be scanned for malware, at least one malware definition being applicable to each of the one or more sections based, at least in part, on a predetermined data address range associated with the at least one malware definition lying within that section of the electronic data, the predetermined address range specifying a location of a potential occurrence, within the electronic data, of the at least one malware definition;
• scan for malware only the one or more sections of the electronic data specified in the acceleration list;
• and
• a third instruction segment configured to take corrective action responsive to results of scanning for malware only the one or more sections of the electronic data specified in the acceleration list.