Cache hint correction for security scanning
View Patent ↗A computer includes a filter module providing a standardized interface for intercepting file access requests. The computer also includes a cache manager that manages the caching mode used with the requests. An application on the computer issues a file access request and explicitly or implicitly specifies a cache hint informing the cache manager of a desired caching mode. A security scanner module scans files on the computer for malicious software. The security scanner module intercepts a file access request and alters the caching mode, if necessary, to one optimized for security scanning. The security scanner module performs the file scan using the optimal caching mode, and, if necessary, resets the caching mode to its original state.
1. A system for scanning a computer file for malicious software, comprising:
a computer-readable storage medium storing executable computer program code comprising:
an interface module for receiving a file access request issued by a process executing on the computer, the file access request having an associated original caching mode;
a caching mode determination module for determining the original caching mode associated with the file access request; and
a caching mode alteration module for altering the original caching mode associated with the file access request to an optimal caching mode optimal for scanning the file for malicious software and for resetting the caching mode associated with the file access request to the original caching mode upon completion of the scanning; and
a processor for executing the computer program code.
2. The system of claim 1 , further comprising:
a filter registration module adapted to register with a filter module executing on the computer to intercept file access requests by the process;
wherein the interface module is adapted to receive the file access request issued by the process responsive to the registration.
3. The system of claim 2 , wherein the file access request received by the interface module includes a cache hint parameter having a value specifying the original caching mode, wherein the caching mode determination module is adapted to determine the value of the cache hint parameter, and wherein the caching mode alteration module is adapted to alter the value of the cache hint parameter.
4. The system of claim 1 , further comprising:
a filter registration module adapted to register with a filter module executing on the computer to intercept file access requests by the process;
wherein the interface module is adapted to receive a file handle issued in response to the file access request issued by the process, the file handle associated with the original caching mode, and wherein the caching mode determination module is adapted to examine data structures associated with a cache manager executing on the computer system to determine the original caching mode.
5. The system of claim 4 , wherein the caching mode alteration module is adapted to alter the data structures associated with the cache manager to alter the caching mode to the optimal caching mode.
6. A computer program product having a computer-readable medium having computer program instructions recorded thereon for scanning a computer file for malicious software, comprising:
an interface module for receiving a file access request issued by a process executing on the computer, the file access request having an associated original caching mode;
a caching mode determination module for determining the original caching mode associated with the file access request; and
a caching mode alteration module for altering the original caching mode associated with the file access request to an optimal caching mode optimal for scanning the file for malicious software and for resetting the caching mode associated with the file access request to the original caching mode upon completion of the scanning.
7. The computer program product of claim 6 , further comprising:
a filter registration module adapted to register with a filter module executing on the computer to intercept file access requests by the process;
wherein the interface module is adapted to receive the file access request issued by the process responsive to the registration.
8. The computer program product of claim 7 , wherein the file access request received by the interface module includes a cache hint parameter having a value specifying the original caching mode, wherein the caching mode determination module is adapted to determine the value of the cache hint parameter, and wherein the caching mode alteration module is adapted to alter the value of the cache hint parameter.
9. The computer program product of claim 6 , further comprising:
a filter registration module adapted to register with a filter module executing on the computer to intercept file access requests by the process;
wherein the interface module is adapted to receive a file handle issued in response to the file access request issued by the process, the file handle associated with the original caching mode, and wherein the caching mode determination module is adapted to examine data structures associated with a cache manager executing on the computer system to determine the original caching mode.
10. The computer program product of claim 9 , wherein the caching mode alteration module is adapted to alter the data structures associated with the cache manager to alter the caching mode to the optimal caching mode.
11. A computer-implemented method of accessing a computer file, comprising:
using a computer having a processor to perform steps comprising:
intercepting a file access request for the computer file issued by a process executing on the computer, the intercepted file access request having an associated original caching mode;
determining whether the original caching mode associated with the file access request is optimal for scanning the computer file for malicious software; and
responsive to a determination that the original caching mode is not optimal for scanning the file, temporarily changing the caching mode associated with the file access request to an optimal mode for the scanning and resetting the caching mode associated with the file access request to the original caching mode upon completion of the scanning.
12. The computer-implemented method of claim 11 , wherein intercepting a file access request comprises:
registering with a filter module executing on the computer to receive the file access requests.
13. The computer-implemented method of claim 11 , wherein determining whether the original caching mode associated with the file access request is optimal comprises:
determining a value of a cache hint parameter associated with the file access request.
14. The computer-implemented method of claim 11 , wherein a cache manager executing on the computer associates a caching mode with the file access request, and wherein determining whether the original caching mode associated with the file access request is optimal comprises:
examining data structures associated with the cache manager to determine the caching mode associated with the file access request.
15. The computer-implemented method of claim 11 , wherein the file access request includes a cache hint parameter having a value specifying a cache mode and wherein temporarily changing the caching mode to an optimal mode for the scanning comprises:
altering the value of the cache hint parameter to specify the optimal caching mode for the scanning.
16. The computer-implemented method of claim 11 , wherein a cache manager executing on the computer associates a caching mode with the file access request and wherein temporarily changing the caching mode to an optimal mode for the scanning comprises:
altering data structures associated with the cache manager to associate the optimal caching mode for the scanning with the file access request.
17. A system for accessing a computer file, comprising:
a computer-readable storage medium storing executable computer program code means comprising:
means for intercepting a file access request for the computer file issued by a process executing on the system, the intercepted file access request having an associated original caching mode;
means for determining whether the original caching mode associated with the file access request is optimal for scanning the computer file for malicious software; and
means for temporarily changing the caching mode associated with the file access request from the original caching mode to an optimal caching mode for scanning the file and resetting the caching mode associated with the file access request to the original caching mode upon completion of the scanning responsive to a determination that the original caching mode associated with the file access request is not optimal.
18. The system of claim 4 , wherein the caching mode determination module determines that the original caching mode associated with the file access request is not the optimal caching mode and wherein the caching mode alteration module is adapted to issue a new file access request for the file, the new file access request specifying the optimal caching mode.
19. The system of claim 1 , wherein the file access request issued by the process includes a cache hint specifying the original caching mode.