# US 2014/0157408 A1 · Method for scanning file, client and server thereof

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0157408 A1
- Document ID: US20140157408A1
- Status: Published application
- Kind: A1
- Application number: 14/130,665
- Filed: 2012-07-09
- Published: 2014-06-05
- Earliest claimed: 2011-08-04
- Assignees: Tencent Technology (Shenzhen) Company Limited
- Inventors: Shuhui Mei; Anwu Liang
- Web page: https://patentgrep.com/patent/US20140157408A1

## CPC

- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 21/564: {by virus signature recognition}
- G06F 21/565: {by checking file integrity}
- G06F 21/567: {using dedicated hardware}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- G06F 21/60: Protecting data
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- G06F 2221/2101: Auditing as a secondary aspect
- G06F 2221/2139: Recurrent verification
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method for scanning files includes enumerating unscanned files; obtaining attributions of the unscanned files from the enumerated files one by one, and transmitting to a server the attributions; comparing the attributions with features that are stored in the server; obtaining the features that are consistent with the attributions and types that the features belong to; and generating a mapping relationship between the unscanned files, the attributions and the types according to the features that are consistent with the attributions and the types of the features, and recording the mapping relationship in a first scanning result. The above method uploads the attributions of the files to the server; and makes the safety and risky recognition of the file through comparing with the features and the corresponding types.

## Claims

### Claim 1

(canceled)

### Claim 2

A method for scanning files, comprising:
enumerating unscanned files;
obtaining attributions of the unscanned files from the enumerated files one by one, and transmitting to a server the attributions;
comparing the attributions with features that are stored in the server, obtaining the features that are consistent with the attributions and types that the features belong to; and
generating a mapping relationship between the unscanned files, the attributions and the types according to the features that are consistent with the attributions and the types of the features, and recording the mapping relationship in a first scanning result;
determining locally unscanned files for a local scanning according to the first scanning result;
locally scanning the unscanned files, and obtaining a second scanning result; and
integrating the second scanning result and the first scanning result, to generate a third scanning result.

### Claim 3 (depends on 2)

The method for scanning files according to claim 2, wherein after recording the mapping relationship in the first scanning result, the method further comprises:
removing the unscanned files corresponding to the files in the third scanning result from an enumerated queue.

### Claim 4 (depends on 3)

The method for scanning files according to claim 3, wherein after removing the unscanned files corresponding to the files in the third scanning result from an enumerated queue, the method further comprises:
determining whether there is blank in the enumerated queue, and adding unscanned files that are not included in the enumerated queue into the enumerated queue if there is blank.

### Claim 5 (depends on 2)

The method for scanning files according to claim 2, wherein before obtaining attributions of the unscanned files from the enumerated files one by one, the method further comprises:
determining whether a length of the enumerated unscanned files have reached a first threshold;
searching in the enumerated unscanned files for those unscanned files that meet preset conditions if the length reached the first threshold; and obtaining attributions of the unscanned files from the enumerated files one by one;
wherein before determining locally unscanned files for a local scanning according to the first scanning result, the method further comprises:
determining whether the length of the enumerated unscanned files have reached a second threshold; and determining locally unscanned files for a local scanning according to the first scanning result if the length reached the second threshold.

### Claim 6 (depends on 2)

The method for scanning files according to claim 2, wherein after transmitting to a server the attributions, the method further comprises:
tagging the unscanned files that have transmitted the attributions;
wherein determining locally unscanned files for a local scanning according to the first scanning result comprises:
determining the files to be secondly scanned among the enumerated files according to the first scanning result;
choosing untagged unscanned files in the enumerated unscanned files, determining the files to be secondly scanned and the untagged unscanned files to be the files for local scanning.

### Claim 7 (depends on 6)

The method for scanning files according to claim 6, wherein locally scanning the unscanned files, and obtaining a second scanning result comprises:
successively scanning the files for second scanning and the untagged files according to a preset priority.

### Claim 8 (depends on 2)

The method for scanning files according to claim 2, wherein after integrating the second scanning result and the first scanning result, to generate a third scanning result, the method further comprises:
obtaining the type of the files for the second scanning in the second scanning result;
determining a risk of the file for the second scanning according to the type; and uploading the attribution of the file for the second scanning if the file is of risk;
scanning the file for the second scanning to determine a corresponding suspicious index if the file is not of risk;
determining whether the suspicious index has exceeded a suspicious threshold; and uploading the attribution of the file for the second scanning if the suspicious index exceeds the suspicious threshold.

### Claim 9

(canceled)

### Claim 10

A method for scanning files, comprising:
enumerating unscanned files; and
obtaining attributions of the unscanned files from the enumerated files one by one, and transmitting to a server the attributions;
determining files for local scanning according to a first scanning result fed back from the server;
locally scanning the determined files for local scanning, and generating a second scanning result; and
integrating the second scanning result with the first scanning result to generate a third scanning result.

### Claim 11 (depends on 10)

The method for scanning files according to claim 10, wherein after integrating the second scanning result with the first scanning result to generate a third scanning result, the method further comprises:
removing the unscanned files corresponding to the files in the third scanning result from an enumerated queue.

### Claim 12 (depends on 11)

The method for scanning files according to claim 11, wherein after removing the unscanned files corresponding to the files in the third scanning result from an enumerated queue, the method further comprises:
determining whether there is blank in the enumerated queue; and adding unscanned files that are not included in the enumerated queue into the enumerated queue if there is blank.

### Claim 13 (depends on 10)

The method for scanning files according to claim 10, wherein before obtaining attributions of the unscanned files from the enumerated files one by one, the method further comprising:
determining whether a length of the enumerated unscanned files have reached a first threshold;
searching in the enumerated unscanned files for those unscanned files that meet preset conditions if the length reached the first threshold; and obtaining attributions of the unscanned files from the enumerated files one by one;
wherein before determining locally unscanned files for a local scanning according to the first scanning result, the method further comprises:
determining whether the length of the enumerated unscanned files have reached a second threshold; and determining locally unscanned files for a local scanning according to the first scanning result if the length reached the second threshold.

### Claim 14 (depends on 10)

The method for scanning files according to claim 10, wherein after transmitting to a server the attributions, the method further comprises:
tagging the unscanned files that have transmitted the attributions;
wherein determining locally unscanned files for a local scanning according to the first scanning result comprises:
determining the files to be secondly scanned among the enumerated files according to the first scanning result;
choosing untagged unscanned files in the enumerated unscanned files, determining the files to be secondly scanned and the untagged unscanned files to be the files for local scanning.

### Claim 15 (depends on 14)

The method for scanning files according to claim 14, wherein locally scanning the unscanned files, and obtaining a second scanning result comprises:
successively scanning the files for second scanning and the untagged files according to a preset priority.

### Claim 16 (depends on 10)

The method for scanning files according to claim 10, wherein after integrating the second scanning result and the first scanning result, to generate a third scanning result, the method further comprises:
obtaining the type of the files for the second scanning in the second scanning result;
determining a risk of the file for the second scanning according to the type; and uploading the attribution of the file for the second scanning if the file is of risk;
scanning the file for the second scanning to determine a corresponding suspicious index if the file is not of risk;
determining whether the suspicious index has exceeded a suspicious threshold; and uploading the attribution of the file for the second scanning if the suspicious index exceeds the suspicious threshold.

### Claim 17

(canceled)

### Claim 18

(canceled)

### Claim 19

A system for scanning files, comprising a client and a server;
wherein the client comprises:
an enumerating module for enumerating files;
an attribution obtaining module for obtaining attributions of unscanned files one by one, and transmitting to the server the attributions;
a file determining module for determining locally unscanned files for the local scanning according to the first scanning result;
a scanning module for locally scanning the determined files for local scanning, and generating a second scanning result; and
a result integration module for integrating the second scanning result with the first scanning result to generate a third scanning result, and
wherein the server comprises:
a database for storing features and the types of the features;
a comparison module for comparing the attribution with the features that are stored, and obtaining those features that are consistent with the attributions and the type that the features belong to; and
a mapping relationship module for generating a mapping relationship between the unscanned files, the attributions and the types according to the features that are consistent with the attributions and the types of the features, and recording the mapping relationship in a first scanning result.

### Claim 20 (depends on 19)

The system for scanning files according to claim 19, wherein the client further comprises:
a removing module for removing the unscanned files corresponding to the files in the third scanning result from the enumerated queue.

### Claim 21 (depends on 20)

The system for scanning files according to claim 20, wherein the client further comprises:
an adding module for determining whether there is blank in the enumerated queue, and adding unscanned files that are not included in the enumerated queue into the enumerated queue if there is blank.

### Claim 22 (depends on 19)

The system for scanning files according to claim 19, wherein the client further comprises:
an enumerating determining module for determining whether a length of the enumerated unscanned files have reached a first threshold; and informing a searching module if it is reached;
a searching module for searching in the enumerated unscanned files for those unscanned files that meet preset conditions;
wherein the enumerating determining module is further used for determining whether the length of the enumerated unscanned files have reached a second threshold, and informing the file determining module if it is reached.

### Claim 23 (depends on 19)

The system for scanning files according to claim 19, wherein the client further comprises:
a tagging module for tagging the files that have transmitted the attributions;
wherein the file determining module further comprises:
a second scanning unit for determining the files to be secondly scanned among the enumerated files according to the first scanning result;
a selection unit for choosing the untagged unscanned files in the enumerated unscanned files, determining the files to be secondly scanned and the untagged unscanned files to be the files for local scanning.

### Claim 24 (depends on 23)

The system for scanning files according to claim 23, wherein the scanning module is further used for successively scanning the files for second scanning and the untagged files according to the preset priority.

### Claim 25 (depends on 19)

The system for scanning files according to claim 19, wherein the client further comprises:
a type obtaining module for obtaining the type of the files for the second scanning in the second scanning result;
a risk determining module for determining the risk of the file for the second scanning according to the type; informing an uploading module if it is risky, or informing the scanning module if not;
the uploading module for uploading the attribution of the file for the second scanning;
the scanning module is further used for scanning the file for the second scanning to determine a corresponding suspicious index;
a suspicious index determining module for determining whether the suspicious index has exceeded a suspicious threshold; and informing the uploading module if it has exceeded.

### Claim 26

(canceled)

### Claim 27

A client for scanning files, comprising:
an enumerating module for enumerating files; and
an attribution obtaining module for obtaining attributions of unscanned files one by one, and transmitting to the server the attributions;
a file determining module for determining locally unscanned files for the local scanning according to the first scanning result;
a scanning module for locally scanning the determined files for local scanning, and generating a second scanning result;
a result integration module for integrating the second scanning result with the first scanning result to generate a third scanning result.

### Claim 28 (depends on 27)

The client for scanning files according to claim 27, wherein the client further comprises:
a removing module for removing the unscanned files corresponding to the files in the third scanning result from the enumerated queue.

### Claim 29 (depends on 28)

The client for scanning files according to claim 28, wherein the client further comprises:
an adding module for determining whether there is blank in the enumerated queue, and adding unscanned files that are not included in the enumerated queue into the enumerated queue if there is blank.

### Claim 30 (depends on 27)

The client for scanning files according to claim 27, wherein the client further comprises:
an enumerating determining module for determining whether a length of the enumerated unscanned files have reached a first threshold; and informing a searching module if it is reached;
a searching module for searching in the enumerated unscanned files for those unscanned files that meet preset conditions;
wherein the enumerating determining module is further used for determining whether the length of the enumerated unscanned files have reached a second threshold, and informing the file determining module if it is reached.

### Claim 31 (depends on 27)

The client for scanning files according to claim 27, wherein the client further comprises:
a tagging module for tagging the files that have transmitted the attributions;
wherein the file determining module further comprises:
a second scanning unit for determining the files to be secondly scanned among the enumerated files according to the first scanning result;
a selection unit for choosing the untagged unscanned files in the enumerated unscanned files, determining the files to be secondly scanned and the untagged unscanned files to be the files for local scanning.

### Claim 32 (depends on 31)

The client for scanning files according to claim 31, wherein the scanning module is further used for successively scanning the files for second scanning and the untagged files according to the preset priority.

### Claim 33 (depends on 27)

The client for scanning files according to claim 27, wherein the client further comprises:
a type obtaining module for obtaining the type of the files for the second scanning in the second scanning result;
a risk determining module for determining the risk of the file for the second scanning according to the type; informing an uploading module if it is risky, or informing the scanning module if not;
the uploading module for uploading the attribution of the file for the second scanning;
the scanning module is further used for scanning the file for the second scanning to determine a corresponding suspicious index;
a suspicious index determining module for determining whether the suspicious index has exceeded a suspicious threshold; and informing the uploading module if it has exceeded.

### Claim 34

(canceled)