Systems and methods for detecting malware
View Patent ↗A computer-implemented method for detecting malware may include 1) identifying a file represented within a file system by a file name, 2) identifying a creation of a hard link to the file that uses an additional file name, 3) updating a database with an association between the file name and the additional file name, 4) identifying a file-closing operation within the file system and determining that the target file name of the file-closing operation was removed from the file system after the file-closing operation, 5) querying the database with the target file name and identifying an existing file name representing the file based on the association, and 6) scanning the existing file name for malware in response to the file-closing operation instead of scanning the target file name because the target file name was removed from the file system. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for detecting malware, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying a file represented within a file system by a file name;
identifying a creation of a hard link to the file, the hard link representing the file within the file system by an additional file name;
updating a database with an association between the file name and the additional file name in response to the creation of the hard link to the file;
identifying a file-closing operation within the file system and then determining that a target file name used in the file-closing operation was removed from the file system after the file-closing operation;
querying the database using the target file name in response to determining that the target file name was removed after the file-closing operation and, in response to the querying and based on the association, identifying an existing file name representing the file, the target file name matching one of the file name and the additional file name and the existing file name comprising one of the file name and the additional file name that does not match the target file name;
scanning the existing file name for malware in response to the file-closing operation instead of scanning the target file name because the target file name was removed from the file system.
2. The computer-implemented method of claim 1 , further comprising:
identifying a file-renaming operation within the file system to change the file name to a new file name;
updating the association within the database to associate the new file name with the additional file name in response to the file-renaming operation.
3. The computer-implemented method of claim 1 , further comprising:
identifying a file-renaming operation within the file system to change the additional file name to a new file name;
updating the association within the database to associate the new file name with the file name in response to the file-renaming operation.
4. The computer-implemented method of claim 1 , wherein updating the database with the association between the file name and the additional file name comprises associating the additional file name with an inode of the file within the database.
5. The computer-implemented method of claim 1 , wherein the file-closing operation closes the file via the target file name after modifying the file via the target file name to introduce malware to the file.
6. The computer-implemented method of claim 1 , wherein determining that the target file name of the file-closing operation was removed from the file system after the file-closing operation comprises attempting and failing to access the target file name.
7. The computer-implemented method of claim 6 , wherein attempting and failing to access the target file name comprises attempting to scan the target file name for malware in response to the file-closing operation.
8. The computer-implemented method of claim 1 , wherein identifying the creation of the hard link to the file comprises creating the hard link to the file in response to identifying a previous creation of a prior hard link to the file.
9. The computer-implemented method of claim 8 , further comprising:
identifying a removal of a penultimate hard link to the file;
removing the hard link to the file in response to identifying the removal of the penultimate hard link.
10. The computer-implemented method of claim 1 , further comprising:
identifying a removal of the hard link to the file;
updating the database to remove the association between the file name and the additional file name.
11. A system for detecting malware, the system comprising: an identification module programmed to:
identify a file represented within a file system by a file name; identify a creation of a hard link to the file, the hard link representing the file within the file system by an additional file name;
an update module programmed to update a database with an association between the file name and the additional file name in response to the creation of the hard link to the file;
a determination module programmed to identify a file-closing operation within the file system and then determine that a target file name used in the file-closing operation was removed from the file system after the file-closing operation;
a querying module programmed to query the database using the target file name in response to determining that the target file name was removed after the file-closing operation and, in response to the querying and based on the association, identify an existing file name representing the file, the target file name matching one of the file name and the additional file name and the existing file name comprising one of the file name and the additional file name that does not match the target file name;
a scanning module programmed to scan the existing file name for malware in response to the file-closing operation instead of scanning the target file name because the target file name was removed from the file system;
at least one hardware processor configured to execute the identification module, the update module, the determination module, the querying module, and the scanning module.
12. The system of claim 11 , further comprising a renaming-update module programmed to:
identify a file-renaming operation within the file system to change the file name to a new file name;
update the association within the database to associate the new file name with the additional file name in response to the file-renaming operation.
13. The system of claim 11 , further comprising a renaming-update module programmed to:
identify a file-renaming operation within the file system to change the additional file name to a new file name;
update the association within the database to associate the new file name with the file name in response to the file-renaming operation.
14. The system of claim 11 , wherein the update module is programmed to update the database with the association between the file name and the additional file name by associating the additional file name with an inode of the file within the database.
15. The system of claim 11 , wherein the file-closing operation closes the file via the target file name after modifying the file via the target file name to introduce malware to the file.
16. The system of claim 11 , wherein the determination module is programmed to determine that the target file name of the file-closing operation was removed from the file system after the file-closing operation by attempting and failing to access the target file name.
17. The system of claim 16 , wherein the determination module is programmed to attempt to access the target file name by attempting to scan the target file name for malware in response to the file-closing operation.
18. The system of claim 11 , wherein the identification module is programmed to identify the creation of the hard link to the file by creating the hard link to the file in response to identifying a previous creation of a prior hard link to the file.
19. The system of claim 18 , wherein the identification module is further programmed to:
identify a removal of a penultimate hard link to the file;
remove the hard link to the file in response to identifying the removal of the penultimate hard link.
20. A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
identify a file represented within a file system by a file name;
identify a creation of a hard link to the file, the hard link representing the file within the file system by an additional file name;
update a database with an association between the file name and the additional file name in response to the creation of the hard link to the file;
identify a file-closing operation within the file system and then determine that a target file name used in the file-closing operation was removed from the file system after the file-closing operation;
query the database using the target file name in response to determining that the target file name was removed after the file-closing operation and, in response to the querying and based on the association, identify an existing file name representing the file, the target file name matching one of the file name and the additional file name and the existing file name comprising one of the file name and the additional file name that does not match the target file name;
scan the existing file name for malware in response to the file-closing operation instead of scanning the target file name because the target file name was removed from the file system.