US 2013/0086683 A1 · SELECTIVELY SCANNING OBJECTS FOR INFECTION BY MALWARE

Abstract

Techniques are described herein that are capable of selectively scanning objects for infection by malware (i.e., to determine whether one or more of the objects are infected by malware). For instance, metadata that is associated with the objects may be reviewed to determine whether update(s) have been made with regard to the objects since a determination was made that the objects were not infected by malware. An update may involve increasing a number of the objects, modifying one of the objects, etc. Objects that have been updated (e.g., added and/or modified) since the determination may be scanned. Objects that have not been updated since the determination need not necessarily be scanned. For instance, an allowance may be made to perform operations with respect to the objects that have not been updated since the determination without first scanning the objects for infection by malware.

Claims20

Dependent claims

A method comprising:

determining that a plurality of objects is not infected by malware;
selecting a value of an update identifier in an update log that is associated with the plurality of objects to be a reference value in response to determining that the plurality of objects is not infected by malware, the update identifier indicating a number of updates that occur with respect to the plurality of objects;
incrementing the value of the update identifier for each update that occurs with respect to an object of the plurality of objects to provide a respective incremented value;
determining that access to a designated object that is included in the plurality of objects is initiated;
determining whether the incremented value that is associated with the designated object is greater than the reference value;
and
allowing operations to be executed with respect to the designated object in absence of scanning the designated object for infection by malware in response to determining that the incremental value that is associated with the designated object is not greater than the reference value.

4 more elements

A system comprising:

infection determination logic configured to determine whether a plurality of objects is infected by malware;
selection logic configured to select a value of an update identifier in an update log that is associated with the plurality of objects to be a reference value in response to a determination that the plurality of objects is not infected by malware, the update identifier indicating a number of updates that occur with respect to the plurality of objects;
incrementing logic configured to increment the value of the update identifier for each update that occurs with respect to an object of the plurality of objects to provide a respective incremented value;
access determination logic configured to determine whether access to a designated object that is included, in the plurality of objects is initiated;
comparison logic configured to determine whether the incremented value that is associated with the designated object is greater than the reference value;
and
allowance logic configured to allow operations to be executed with respect to the designated object in absence of scanning the designated object for infection by malware in response to a determination that access to the designated object is initiated and further in response to a determination that the incremental value that is associated with the designated object is not greater than the reference value.

4 more elements

A computer program product comprising a computer-readable medium having computer program logic recorded thereon for enabling a processor-based system to selectively scan objects based on metadata, the computer program product comprising:

a first program logic module for enabling the processor-based system to determine whether a plurality of objects is infected by malware;
a second program logic module for enabling the processor-based system to select a value of an update identifier in an update log that is associated with the plurality of objects to be a reference value in response to a determination that the plurality of objects is not infected by malware, the update identifier indicating a number of updates that occur with respect to the plurality of objects;
a third program logic module for enabling the processor-based system to increment the value of the update identifier for each update that occurs with respect to an object of the plurality of objects to provide a respective incremented value;
a fourth program logic module for enabling the processor-based system to determine whether access to a designated object that is included in the plurality of objects is initiated;
a fifth program logic module for enabling the processor-based system to determine whether the incremented value that is associated with the designated object is greater than the reference value;
a sixth program logic module for enabling the processor-based system to determine whether a log identifier that is associated with the designated object and a reference identifier that is associated with the update log are same;
and
a seventh program logic module for enabling the processor-based system to allow operations to be executed with respect to the designated object in absence of scanning the designated object for infection by malware in response to a determination that access to the designated object is initiated and further in response to a determination that the incremental value that is associated with the designated object is not greater than the reference value and further in response to a determination that the log identifier that is associated with the designated object and the reference identifier are the same.

5 more elements

Dependencies are inferred from the claim text.

Selectively scanning objects for infection by malware

Life of this patent

Selectively scanning objects for infection by malware

Life of this patent

Abstract

Claims20