Virtualized File System Malware Scanning via Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtualized file systems, quick scans often miss per-user versions of shared files, which can contain malware, as these areas are not typically scanned, leading to a need for a method to locate and scan these files effectively.
Innovation Solution
A system and method that includes a scanning module to identify files for scanning, a virtualized file detection module to determine if a file is virtualized, a file retrieval module to locate virtualized versions, and a malware detection module to scan these versions for malware, ensuring comprehensive scanning during a quick scan.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire file system is scanned for malware, then malware detection coverage is improved, but scanning time and system resource consumption increase significantly
Solution Approach 1:
The patent segments the file system into multiple scan zones: frequently accessed areas (startup folders, desktop, documents) and less frequently accessed areas (program files, system directories). The segmentation allows the scanning module to perform quick scans on high-priority segments while optionally skipping or deferring low-priority segments, thereby maintaining high malware detection coverage in critical areas without requiring exhaustive scanning of the entire file system.
2Loss of time
If only frequently accessed file system portions are scanned during a quick scan, then scanning time is reduced, but malware in per-user versions of shared files may be missed
Solution Approach 1:
The patent introduces an intermediary mechanism in the form of file system hooks and metadata tracking that monitor file access patterns and virtualization operations. This intermediary layer identifies when per-user versions of shared files are created or modified, automatically adding these files to the quick scan queue without requiring a full system scan. The intermediary ensures that time-critical malware detection in virtualized files is achieved while maintaining quick scan performance.
3Reliability
If per-user versions of shared files are included in the scan, then malware detection coverage is improved, but the complexity of file location and scanning increases
Solution Approach 1:
The patent implements a universal scanning interface that handles both regular files and virtualized per-user versions of shared files through a unified API. The file retrieval module is designed to work with the file system's virtualization mechanism, automatically resolving file paths and accessing virtualized files using the same scanning logic applied to regular files. This multi-functional approach allows the scanning system to detect malware in both standard and virtualized files without requiring separate complex handling routines.
4Reliability
If a full file system scan is performed, then comprehensive malware detection is achieved, but system resource consumption increases
Solution Approach 1:
The patent implements periodic scanning intervals for different file system segments based on their risk profiles. Frequently accessed areas like startup folders and desktop are scanned more frequently (e.g., daily or on-demand), while less critical areas are scanned less frequently (e.g., weekly or monthly). This periodic action strategy maintains high malware detection coverage in high-risk areas while significantly reducing overall system resource consumption compared to continuous full-system scanning.
Data Source
AI summary
A computer includes a file system that supports virtualization. A scanning module identifies a file to be scanned for malware and a virtualized file detection module determines whether the file is virtualized. A file retrieval module locates a virtualized version of the file if the file is determined to be virtualized, and a malware detection module determines whether the virtualized version of the file contains malware. If malware is found, the malware detection module takes remedial action to address any security threat posed by the malware.