Context-aware real-time computer-protection systems and methods

Abstract

The invention relates to context-aware real-time computer-protection systems and methods. A computer-implemented method for determining, in response to an event of interest, whether to perform a real-time file scan by examining the full context of the event of interest may comprise: 1) detecting an event of interest, 2) identifying at least one file associated with the event of interest, 3) accessing contextual metadata associated with the event of interest, 4) accessing at least one rule that comprises criteria for determining, based on the event of interest and the contextual metadata, whether to perform a security scan on the file, and then 5) determining, by applying the rule, whether to perform the security scan on the file. Corresponding systems and computer-readable media are also disclosed.

Description

Background technique [0001] Performance is a constant concern for vendors of real-time security products such as real-time file scanning solutions. Traditional real-time file scanning solutions typically: 1) detect when a file has been opened or modified and then 2) determine whether the file has been compromised by scanning the file in question. While a single file scan may not unduly consume computing system resources, the number of file operations performed by current operating systems may require many more file scans, which in turn may result in significantly slower computing system performance and user annoyance . [0002] While some security vendors have attempted to limit the performance impact of real-time file scanning solutions by skipping file scanning based on file extensions or based on whether the file is open or closed, such conventional approaches have limited effectiveness and reliability Restricted. For example, such methods may fail to identify malicious ...

AI Technical Summary

Problems solved by technology

While a single file scan may not unduly consume computing system resources, the number of file operations performed by current operating systems may require many more file scans, which in turn may result in significantly slower computing system performance and user annoyance

[0002] While some security vendors have attempted to limit the performance impact of real-time file scanning solutions by skipping file scanning based on file extensions or based on whether the file is open or closed, such conventional approaches have limited effectiveness and reliability Restricted

For example, such methods may fail to identify malicious files with file extensions that appear to be legitimate, and such methods may dedicate computing resources to scanning modified files even though there is a high probability that the modified file is not a security threat

Images