Fingerprint analysis for anti-virus scan
View Patent ↗Disclosed are systems and methods for fingerprint analysis for anti-virus scanning. In an embodiment, a method of scanning for infected data items is disclosed. The method provides identifying a plurality of changed data items on a server machine. The method further provides, from a data system in communication with the server machine, performing a virus scan on the plurality of changed data items. The method further provides that the data system maintains a list of data items that the virus scan found to be infected.
1. A method of scanning for infected data items, the method comprising:
identifying a first plurality of changed data blocks of a first virtual machine file stored on a server machine;
from a data system in communication with the server machine, performing a virus scan on the first plurality of changed data blocks, wherein performing the virus scan comprises:
processing the plurality of changed data blocks to generate a plurality of fingerprints;
identifying a target fingerprint from the plurality of fingerprints using a reference fingerprint, wherein the reference fingerprint is generated from a second plurality of changed data blocks of a second virtual machine file representing an infected data item in the second virtual machine file; and
identifying the infected data item corresponding to the target fingerprint within a plurality of data items in the first virtual machine file; and
in the data system, adding the infected data item to a list of data items in the first virtual machine file that the virus scan found to be infected.
2. The method of claim 1 , wherein the reference fingerprint is one of a plurality of reference fingerprints.
3. The method of claim 1 , further comprising:
receiving the plurality of changed data blocks in the data system from the server machine.
4. A non-transitory computer readable medium having instructions stored thereon for operating a data system that, when executed by the data system, direct the data system to perform a method of scanning for infected data items, the method comprising:
identifying a first plurality of changed data blocks of a first virtual machine file stored on a server machine;
performing a virus scan on the first plurality of changed data blocks, wherein performing the virus scan comprises:
processing the plurality of changed data blocks to generate a plurality of fingerprints;
identifying a target fingerprint from the plurality of fingerprints using a reference fingerprint, wherein the reference fingerprint is generated from a second plurality of changed data blocks of a second virtual machine file representing an infected data item in the second virtual machine file; and
identifying the infected data item corresponding to the target fingerprint within a plurality of data items in the first virtual machine file; and
adding the infected data item to a list of data items in the first virtual machine file that the virus scan found to be infected.
5. The non-transitory computer readable medium of claim 4 , wherein the reference fingerprint is one of a plurality of reference fingerprints.
6. The non-transitory computer readable medium of claim 4 , further comprising:
receiving the plurality of changed data blocks from the server machine.
7. A data system comprising:
a processor configured to identify a first plurality of changed data blocks of a first virtual machine file stored on a server machine, and perform a virus scan on the first plurality of changed data blocks, wherein performing the virus scan comprises:
processing the plurality of changed data blocks to generate a plurality of fingerprints;
identifying a target fingerprint from the plurality of fingerprints using a reference fingerprint, wherein the reference fingerprint is generated from a second plurality of changed data blocks of a second virtual machine file representing an infected data item in the second virtual machine file; and
identifying the infected data item corresponding to the target fingerprint within a plurality of data items in the first virtual machine file; and
a storage system configured to add the infected data item to a list of data items in the first virtual machine file that the virus scan found to be infected.
8. The data system of claim 7 , wherein the reference fingerprint is one of a plurality of reference fingerprints.
9. The data system of claim 7 , further comprising:
a communication interface configured to receive the plurality of changed data blocks from the server machine.