Virtual Machine Snapshot Scanning Without Filesystem Mounting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus scan methods for virtual machines are inefficient and time-consuming, particularly when scanning backup snapshots stored on remote storage, as they require mounting the file system, which is slow and resource-intensive.
Innovation Solution
A system and method for performing antivirus scans on virtual machine snapshots that involves accessing multiple backup snapshots, identifying a reference snapshot, comparing file system metadata, and performing sequential screenings to detect malicious files without mounting the file system, using disk offsets and checksums to efficiently identify infected snapshots.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the file system is mounted to perform antivirus scan, then the scan can be performed using existing techniques, but the scan time becomes very time consuming and inefficient
Solution Approach 1:
The patent extracts file metadata (names, paths, checksums) from VMDK files before the antivirus scan is performed. This preliminary extraction of file information allows the antivirus engine to scan file listings rather than mounted file systems, significantly reducing scan time while maintaining detection accuracy. The metadata is prepared in advance to enable efficient scanning without filesystem mounting.
Solution Approach 2:
The patent extracts only the necessary file metadata (names, paths, checksums) from the VMDK files, separating this information from the complete filesystem structure. By taking out only the essential file listing information needed for antivirus scanning, the system avoids the time-consuming process of mounting entire filesystemes while still enabling comprehensive virus detection on all files.
2Reliability
If the entire disk is downloaded for mounting the filesystem, then the antivirus scan can be performed, but the process becomes inefficient especially when backups are stored on remote storage
Solution Approach 1:
The patent extracts only the essential file metadata (names, paths, checksums) from VMDK files stored on remote storage, rather than downloading entire filesystemes. This extraction approach retrieves minimal necessary information locally, enabling antivirus scanning without the resource-intensive operation of downloading complete disk images from remote storage locations.
Solution Approach 2:
The patent creates a lightweight copy of file metadata information from the VMDK files, which is then used for antivirus scanning. Instead of copying or downloading the actual file contents or complete filesystem structures, the system works with extracted metadata copies, dramatically reducing network bandwidth consumption and storage requirements while maintaining scan effectiveness.
3Reliability
If the file system is mounted to perform antivirus scan, then the scan can be performed on files, but the process becomes slow and resource-intensive
Solution Approach 1:
The patent extracts file metadata (names, paths, checksums) from VMDK files and uses this extracted information for antivirus scanning. By working with extracted metadata rather than mounted filesystemes, the system maintains comprehensive file coverage for accurate virus detection while achieving significantly higher scanning speeds and reduced resource consumption.
Solution Approach 2:
The patent replaces the mechanical filesystem mounting process with a direct metadata-based scanning approach. Instead of using the traditional mechanical process of mounting filesystemes to access files, the system substitutes this with direct parsing and scanning of extracted file metadata, eliminating the overhead of filesystem mounting while maintaining detection capabilities.
Data Source
AI summary
A system for performing an antivirus scan of backup snapshots of a virtual machine is provided. The system includes a memory storing one or more processor-executable routines and a processor communicatively coupled to the memory. The processor is configured to execute the one or more processor-executable routines to access a plurality of backup snapshots of the virtual machine and perform a complete antivirus scan of one or more snapshots to identify a reference snapshot. The reference snapshot includes one or more malicious files. The processor is further configured to compare file system metadata of a first snapshot with respective file system metadata of the reference snapshot to identify files that have changed between the first and reference snapshots and perform the antivirus scan of the identified changed files to detect one or more malicious files and to generate an updated list of the malicious files. The processor is further configured to access a second snapshot and the updated list of malicious files with corresponding metadata of the files and perform first, second and third screenings of the second snapshot to detect an infected snapshot. The processor is further configured to compare disk offsets and checksum of corresponding data at the disk offsets, metadata and file checksum respectively of the malicious files with corresponding files of the second snapshot to perform the first, second and third screenings in a sequential manner. The processor is further configured to repeat the first, second and third screenings for the plurality of backup snapshots of the virtual machine.