Method and system for delayed write scanning for detecting computer malwares
View Patent ↗A method, system, and computer program product provides on-access anti-virus scanning of data files, which can be performed without introducing significant performance degradation and provides delayed file write operation scanning upon interception of a file write operation. A method of detecting a malware comprises the steps of monitoring file access operations of a process, intercepting a file access operation of the process to a file, waiting a time interval, and scanning the file for a malware.
1. A method of detecting a malware comprising the steps of:
monitoring file access operations of a process;
intercepting a file access operation of the process to a file;
in response to the intercepting, waiting a time interval between the intercepting and scanning the file for a malware; and
scanning the file for the malware, after waiting the time interval;
wherein the process is associated with an application program and wherein the file access operation is a file write operation.
2. The method of claim 1 , wherein the file has a specified file type.
3. The method of claim 1 , wherein the time interval is predefined.
4. The method of claim 1 , wherein the time interval is user-defined.
5. The method of claim 1 , wherein the time interval is based on a file type of the file.
6. The method of claim 1 , wherein the time interval is based on the process.
7. The method of claim 1 , wherein the malware is a computer virus.
8. The method of claim 1 , wherein the malware is a computer worm.
9. The method of claim 1 , wherein the malware is a Trojan horse program.
10. The method of claim 1 , further comprising the step of:
allowing the intercepted file access operation of the process to a file to complete.
11. The method of claim 10 , further comprising the step of:
allowing at least one additional file access operation of the process to a file that occurs before the scanning of the file for a malware to complete.
12. The method of claim 1 , wherein at least a portion of the file access operations are completed before the scanning.
13. The method of claim 1 , wherein at least a portion of the file access operations are completed during the scanning.
14. The method of claim 1 , wherein the file access operations that occur on the file after the intercepting of a file write operation are completed before the scanning.
15. The method of claim 1 , wherein the file access operations that occur on the file after the intercepting of a file write operation are completed during the scanning.
16. The method of claim 1 , wherein, if a set of the file access operations lasts less than the time interval, only a last file access operation of the set is scanned.
17. The method of claim 1 , wherein only a sample of a set of the file access operations is scanned.
18. The method of claim 1 , wherein a final version of the file is scanned, after all of the file access operations of a set are complete.
19. The method of claim 1 , wherein the time interval is longer than at least one of an open cycle, a write cycle, and a close cycle associated with the file access operations.
20. The method of claim 1 , wherein the time interval is initiated after interception of a first file access operation such that, during the time interval, multiple subsequent file access operations are completed without the scanning, after which the file is scanned.
21. A system for detecting a malware comprising:
a processor operable to execute computer program instructions;
a memory operable to store computer program instructions executable by the processor; and
computer program instructions stored in the memory and executable to perform the steps of:
monitoring file access operations of a process;
intercepting a file access operation of the process to a file;
in response to the intercepting, waiting a time interval between the intercepting and scanning the file for a malware; and
scanning the file for the malware, after waiting the time interval;
wherein the process is associated with an application pro gram and wherein the file access operation is a file write operation.
22. The system of claim 21 , wherein the file has a specified file type.
23. The system of claim 21 , wherein the time interval is predefined.
24. The system of claim 21 , wherein the time interval is user-defined.
25. The system of claim 21 , wherein the time interval is based on a file type of the file.
26. The system of claim 21 , wherein the time interval is based on the process.
27. The system of claim 21 , wherein the malware is a computer virus.
28. The system of claim 21 , wherein the malware is a computer worm.
29. The system of claim 21 , wherein the malware is a Trojan horse program.
30. The system of claim 21 , further comprising the step of:
allowing the intercepted file access operation of the process to a file to complete.
31. The method of claim 30 , further comprising the step of:
allowing at least one additional file access operation of the process to a file that occurs before the scanning of the file for a malware to complete.
32. A computer program product for detecting a malware comprising:
a computer readable medium;
computer program instructions, recorded on the computer readable medium, executable by a processor, for performing the steps of
monitoring file access operations of a process;
intercepting a file access operation of the process to a file;
in response to the intercepting, waiting a time interval between the intercepting and scanning the file for a malware; and
scanning the file for the a malware, after waiting the time interval;
wherein the process is associated with an application program and wherein the file access operation is a file write operation.
33. The computer program product of claim 32 , wherein the file has a specified file type.
34. The computer program product of claim 32 , wherein the time interval is predefined.
35. The computer program product of claim 32 , wherein the time interval is user-defined.
36. The computer program product of claim 32 , wherein the time interval is based on a file type of the file.
37. The computer program product of claim 32 , wherein the time interval is based on the process.
38. The computer program product of claim 32 , wherein the malware is a computer virus.
39. The computer program product of claim 32 , wherein the malware is a computer worm.
40. The computer program product of claim 32 , wherein the malware is a Trojan horse program.
41. The computer program product of claim 32 , further comprising the step of:
allowing the intercepted file access operation of the process to a file to complete.
42. The computer program product of claim 41 , further comprising the step of:
allowing at least one additional file access operation of the process to a file that occurs before the scanning of the file for a malware to complete.