Agentless Cloud Storage Scanner for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing environments face challenges in protecting against malware and confidential information exfiltration with minimal performance impact, particularly in scenarios where an agent cannot be installed on the template image used in cloud-based environments.
Innovation Solution
An agentless scanner is implemented that connects directly to cloud data storage, receiving notifications of storage activity and scanning files for malicious content, with actions such as altering permissions or notifying administrators to protect against threats without requiring an agent on the host application.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an agent is installed on the template image for malware detection, then detection capability is improved, but device complexity and deployment difficulty increase
Solution Approach 1:
The malware detection functionality is extracted from the cloud instance and consolidated into a separate scanning service. The scanning service receives notifications from cloud storage about file events and performs scanning independently, eliminating the need for agents on each instance while maintaining detection capability across all instances sharing the same storage.
Solution Approach 2:
A single scanning service provides universal malware detection for multiple cloud instances that share the same cloud storage. Instead of requiring separate agents on each instance, one scanning service handles security scanning for all instances, reducing overall system complexity while maintaining comprehensive protection.
2Reliability
If cloud storage scanning is implemented, then data security is improved, but scanning performance and application performance may deteriorate
Solution Approach 1:
The scanning service operates periodically based on file events rather than continuously monitoring all file operations. It scans files when notified of specific events such as uploads or modifications, reducing unnecessary scanning overhead while maintaining security. This event-driven periodic scanning improves performance by avoiding redundant scans of unchanged files.
3Ease of manufacture
If cloud storage scanning is implemented without agents, then ease of deployment is improved, but detection precision may worsen
Solution Approach 1:
The cloud storage service acts as an intermediary between the scanning service and the cloud instances. It receives file events from instances and relays them to the scanning service, which then performs detailed malware analysis. This intermediary approach enables comprehensive scanning without requiring direct agent installation on instances, maintaining detection precision while simplifying deployment.
Data Source
AI summary
A system, method and computer program for a scanning service is presented. A scanning service compatible with a cloud storage system is configured to receive notifications from a cloud storage service about storage event activity and to access data in the cloud storage service. The scanning service receives a notification regarding storage activity related to a file in the data. After the completion of the storage activity, the scanning service receives the file from the cloud storage service and scans the file. When a determination is made based on the scan that at least a portion of the file should not be distributed then an action is taken with respect to the cloud storage service based on the determination that at least a portion of the file should not be distributed.