Activity-Based Malware Scanning for Content Management Systems

The patent applies partial action by scanning only a subset of content items rather than all items. Specifically, it scans content items that exhibit suspicious characteristics or behaviors (e.g., files with certain extensions, content items accessed by multiple users, recently uploaded files) while leaving other content items unscanned. This approach maintains adequate malware detection capability for high-risk items while significantly reducing computing resource consumption compared to universal scanning.

The patent implements local quality by applying different scanning strategies to different content items based on their specific characteristics. High-risk content items (those with suspicious metadata, unusual access patterns, or specific file types) receive intensive scanning, while low-risk items receive no scanning or minimal scanning. This differentiated approach optimizes the balance between detection capability and resource efficiency by concentrating resources where they are most needed.

The patent reduces scanning time by applying partial action - scanning only content items that exhibit suspicious characteristics or behaviors. By identifying and scanning only the subset of content items that pose potential malware risks (based on file type, access patterns, user behavior, etc.), the system maintains effective malware detection while minimizing the total time required for scanning operations compared to universal scanning of all content items.

The patent employs preliminary action by performing risk assessment and classification of content items before initiating virus scans. The system pre-identifies content items that warrant scanning based on suspicious characteristics, metadata analysis, or behavioral patterns. This preliminary filtering step ensures that virus scanning resources are allocated only to high-priority items, significantly reducing overall scanning time while maintaining detection effectiveness.

The patent applies segmentation by dividing the content management system into distinct functional modules: a risk assessment module that evaluates content items based on characteristics and behavior, a decision module that determines which items require scanning, and a virus scanning module that performs actual scans. This segmentation creates a multi-layered defense system that achieves comprehensive malware coverage for high-risk items while reducing overall system complexity through modular design and clear separation of concerns.

The patent implements local quality by applying different levels of scanning intensity and different security policies to different content items based on their risk profiles. High-risk items undergo thorough scanning with multiple security checks, while low-risk items receive minimal or no scanning. This differentiated approach maintains effective malware coverage for critical items while reducing system complexity by avoiding uniform intensive scanning across all content.