System, method and computer program product for selecting virus detection actions based on a process by which files are being accessed
View Patent ↗A system, method and computer program product are provided for on-access computer virus scanning of files in an efficient manner. If no identifier is assigned to a process for accessing files, virus detection actions are selected based at least in part on the identification of the process. Further, an identifier is assigned to the process. Thereafter, virus detection actions may be selected based at least in part on the identifier for accelerating the selection process. In operation, the selected virus detection actions are performed on the files.
1. A method for on-access computer virus scanning of files in an efficient manner, comprising the steps of:
(a) identifying a process for accessing files and selecting virus detection actions based at least in part on the identified process if no identifier is assigned thereto;
(b) assigning an identifier to the process if no identifier is assigned thereto;
(c) selecting virus detection actions based at least in part on the identifier if existent; and
(d) performing the virus detection actions on the files;
(e) wherein the process is associated with an application program, and different identifiers are assigned to different application programs so that the virus detection actions are tailored for the processes associated with the application programs.
2. The method as recited in claim 1 , wherein the identifier is cleared upon the occurrence of a predetermined event.
3. The method as recited in claim 2 , wherein the identifier is reused after being cleared.
4. The method as recited in claim 2 , wherein the event is the termination of an application.
5. The method as recited in claim 4 , wherein the identifier is assigned by the application.
6. The method as recited in claim 4 , wherein the application is adapted for executing the process.
7. A computer program product for on-access computer virus scanning of files in an efficient manner, comprising:
(a) computer code for identifying a process for accessing files and selecting virus detection actions based at least in part on the identified process if no identifier is assigned thereto;
(b) computer code for assigning an identifier to the process if no identifier is assigned thereto;
(c) computer code for selecting virus detection actions based at least in part on the identifier if existent; and
(d) computer code for performing the virus detection actions on the files;
(e) wherein the process is associated with an application program, and different identifiers are assigned to different application programs so that the virus detection actions are tailored for the processes associated with the application programs.
8. The computer program product as recited in claim 7 , wherein the identifier is cleared upon the occurrence of a predetermined event.
9. The computer program product as recited in claim 8 , wherein the identifier is reused after being cleared.
10. The computer program product as recited in claim 8 , wherein the event is the termination of an application.
11. The computer program product as recited in claim 10 , wherein the identifier is assigned by the application.
12. The computer program product as recited in claim 10 , wherein the application is adapted for executing the process.
13. A system for on-access computer virus scanning of files in an efficient manner, comprising:
(a) logic for identifying a process for accessing files and selecting virus detection actions based at least in part on the identified process if no identifier is assigned thereto;
(b) logic for assigning an identifier to the process if no identifier is assigned thereto;
(c) logic for selecting virus detection actions based at least in part on the identifier if existent; and
(d) logic for performing the virus detection actions on the files;
(e) wherein the process is associated with an application program, and different identifiers are assigned to different application programs so that the virus detection actions are tailored for the processes associated with the application programs.
14. The system as recited in claim 13 , wherein the identifier is cleared upon the occurrence of a predetermined event.
15. The system as recited in claim 14 , wherein the identifier is reused after being cleared.
16. The system as recited in claim 14 , wherein the event is the termination of an application.
17. The system as recited in claim 16 , wherein the identifier is assigned by the application.
18. The system as recited in claim 16 , wherein the application is adapted for executing the process.
19. The method as recited in claim 1 , wherein the virus detection actions are selected by determining a category associated with the process based on the identifier, and selecting a set of virus detection actions based on the determined category.
20. The method as recited in claim 19 , wherein the identifier reflects a risk level associated with the application program, and a plurality of categories each have virus detection actions tailored for an associated risk level.