A scan-on-read manager efficiently scans received data. The scan-on-read manager detects attempts by applications to read received data. The scan-on-read manager scans received data only responsive to an application attempting to read it. The scan-on-read manager only allows the application to read received data that has been scanned.
1. A computer implemented method for efficiently scanning received data, the method comprising the steps of:
detecting attempts by at least one application to read received data;
only responsive to an application attempting to read received data, scanning the received data that the application is attempting to read;
responsive to results of the scanning comprising detecting malicious code in the received data, not allowing the application to read the received data that has been scanned; and
responsive to the results of the scanning comprising not detecting malicious code in the received data, allowing the application to read the received data that has been scanned.
2. The method of claim 1 , wherein detecting an attempt by an application to read received data comprises:
causing a fault in response to an attempt by the application to read the received data.
3. The method of claim 1 , wherein scanning the received data comprises:
copying the received data directly into a target application buffer; and
scanning the received data stored in the target application buffer.
4. The method of claim 1 , wherein not allowing the application to read the received data that has been scanned comprises:
cleaning the malicious code from the received data to produce cleaned data; and
allowing the application to read the cleaned data.
5. The method of claim 1 , wherein allowing the application to read the received data that has been scanned comprises:
after scanning a page of the received data, modifying an associated page table entry to permit read operations.
6. A computer readable medium containing a computer program product for efficiently scanning received data, the computer program product comprising:
program code for detecting attempts by at least one application to read received data;
program code for, only responsive to an application attempting to read received data, scanning the received data that the application is attempting to read;
program code for, responsive to results of the scanning comprising detecting malicious code in the received data, not allowing the application to read the received data that has been scanned; and
program code for, responsive to the results of the scanning comprising not detecting malicious code in the received data, allowing the application to read the received data that has been scanned.
7. The computer readable medium of claim 6 , wherein the program code for detecting attempts by at least one application to read received data comprises:
program code for causing a fault in response to an attempt by the application to read the received data.
8. The computer readable medium of claim 6 , wherein the program code for scanning the received data that the application is attempting to read comprises:
program code for copying the received data directly into a target application buffer; and
program code for scanning the received data stored in the target application buffer.
9. The computer readable medium of claim 6 , wherein the program code for not allowing the application to read the received data that has been scanned comprises:
program code for cleaning the malicious code from the received data to produce cleaned data; and
allowing the application to read the cleaned data.
10. The computer program product of claim 6 , wherein the program code for allowing the application to read the received data that has been scanned further comprises:
program code for, after scanning a page of data, modifying the associated page table entry to permit at least read operations.