Semi-synchronous scanning of modified files in real time

#This invention pertains generally to computer security, and more specifically to semi-synchronous antivirus scanning of files in real time.

#Computer systems face a threat of attack by malicious computer code, such as worms, viruses and Trojan horses. As used herein, “malicious computer code” is any code that enters a computer without an authorized user's knowledge and/or without an authorized user's consent.

#Some current antivirus protection systems are configured so that an anti-virus scan can be performed when an application modifies and then closes a file. Such an anti-virus scan is performed in the context of the thread performing the closing of the file, thus blocking the closing thread from performing other activities until this scan is completed. In the meantime, other activities involving this file, such as a request to open the file, are also prevented until the scan is completed. Waiting for this scan to complete can be a very time-consuming process, particularly when the scan is being conducted on a container file that must be decomposed into parts, each of which need to be scanned separately. While the scan is occurring, the thread closing the file can appear to be unresponsive. The system can be configured to permit access of the file before the scan is complete, making the application appear more responsive, but there is a risk that malicious code may be accessed before it is repaired. There is currently no method for freeing the closing thread so that it can perform other tasks while the scan is occurring, without compromising the security of the system.

#FIG. 1 is a block diagram illustrating a high level overview of a system for practicing some embodiments of the present invention.

#FIG. 2 is a flowchart illustrating steps for performing some embodiments of the present invention.

#FIG. 3 is a flowchart illustrating steps for the thread manager performing a real time anti-virus scan of a file that a thread attempted to open or close, according to some embodiments of the present invention.

#The Figures depict embodiments of the present invention for purposes of illustration only. One skilled in the art will readily recognize from the following discussion that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles of the invention described herein.

#FIG. 1 illustrates a high level overview of a system 100 for performing some embodiments of the present invention. A thread manager 101 performs an anti-virus scan of a file in real-time. It is to be understood that although the thread manager 101 is illustrated as a single entity, as the term is used herein a thread manager 101 refers to a collection of functionalities, which can be implemented as software, hardware, firmware or any combination of the three. Where a thread manager 101 is implemented as software, it can be implemented as a standalone program, but can also be implemented in other ways, for example as part of a larger program, as a plurality of separate programs, or as one or more statically or dynamically linked libraries.

#Referring to FIG. 1, the thread manager 101 executes on a computer 102. In FIG. 1, the thread manager 101 is shown executing in kernel space 105, but in other examples the thread manager 101 can execute in user space 104 instead. In addition, some functionalities of the thread manager 101 can execute in kernel space 105 while others execute in user space 104. In the embodiment illustrated in FIG. 1, there is shown an application 114, (e.g., Microsoft Word®, Adobe Acrobat®, or any other type of application or program). In addition, the application 114 can be the operating system 106, itself. In the embodiment illustrated in FIG. 1, the application 114 attempts to perform an activity concerning a file. For example, the application 114 can attempt to close the file or open the file. The application 114 could alternatively be attempting to read the contents of a file that is open, modify the file, or perform any other type of activity concerning the file.