Process-based selection of virus detection actions system, method and computer program product
View Patent ↗A system, method and computer program product are provided for efficient on-access computer virus scanning of files. Initially, a process for accessing files is identified. Thereafter, virus detection actions are selected based at least in part on the process. The virus detection actions are then performed on the files.
1. A method for on-access computer virus scanning of files, comprising:
identifying a process for accessing files;
selecting virus detection actions based at least in part on the process; and
performing the virus detection actions on the files;
wherein the process is carried out in association with an application program;
wherein the virus detection actions are tailored based on the application program that attempts to access the files.
2. The method as recited in claim 1 , wherein the application program is selected from the group consisting of a network browser application and a word processor application.
3. The method as recited in claim 1 , wherein the virus detection actions are selected by determining a category associated with the process, and selecting a set of virus detection actions based on the determined category.
4. The method as recited in claim 1 , and further comprising identifying the files being accessed, and selecting the virus detection actions based at least in part on the identity of the files.
5. The method as recited in claim 1 , wherein the process is identified by inspecting at least one of a name of the process, a path of the process, a file signature associated with the process, a version of the process, a manufacturer of the process, a function being called during the process, an owner of the process, a name of an executable file associated with the process, a method in which files are being accessed by the process, type(s) of shared libraries used by the identified process, and a user of the process.
6. The method as recited in claim 1 , wherein no virus detection actions are selected upon the identification of a predetermined process.
7. A computer program product embodied on a computer for on-access computer virus scanning, comprising:
computer code for identifying a process for accessing at least one file;
computer code for selecting at least one of a plurality of virus detection actions based at least in part on the process; and
computer code for performing the at least one virus detection action on the file;
wherein the process is carried out in association with an application program;
wherein the at least one virus detection action is tailored based on the application program that attempts to access the file.
8. The computer program product as recited in claim 7 , wherein the application program is selected from the group consisting of a network browser application and a word processor application.
9. The computer program product as recited in claim 7 , wherein the virus detection actions are selected by determining a category associated with the process, and selecting a set of virus detection actions based on the determined category.
10. The computer program product as recited in claim 7 , and further comprising computer code for identifying the file being accessed, and selecting the virus detection actions based at least in part on the identity of the file.
11. The computer program product as recited in claim 7 , wherein the process is identified by inspecting at least one of a name of the process, a path of the process, a file signature associated with the process, a version of the process, a manufacturer of the process, a function being called during the process, an owner of the process, a name of an executable file associated with the process, a method in which files are being accessed by the process, type(s) of shared libraries used by the process, and a user of the process.
12. The computer program product as recited in claim 7 , wherein no virus detection actions are selected upon the identification of a predetermined process.
13. A system for on-access computer virus scanning of files, comprising:
logic for identifying a process for accessing files;
logic for selecting virus detection actions based at least in part on the process; and
logic for performing the virus detection actions on the files;
wherein the process is carried out in association with an application program;
wherein the virus detection actions are tailored based on the application program that attempts to access the files, wherein the logic embodied on a computer.
14. The system as recited in claim 13 , wherein the application program is selected from the group consisting of a network browser application and a word processor application.
15. The system as recited in claim 13 , wherein the virus detection actions are selected by determining a category associated with the process, and selecting a set of virus detection actions based on the determined category.
16. The system as recited in claim 13 , and further comprising logic for identifying the files being accessed, and selecting the virus detection actions based at least in part on the identity of the files.
17. The system as recited in claim 13 , wherein the process is identified by inspecting at least one of a name of the process, a path of the process, a file signature associated with the process, a version of the process, a manufacturer of the process, a function being called during the process, an owner of the process, a name of an executable file associated with the process, a method in which files are being accessed by the process, type(s) of shared libraries used by the process, and a user of the process.
18. The system as recited in claim 13 , wherein no virus detection actions are selected upon the identification of a predetermined process.