Malware scanning for network-attached storage systems
Malware scanning for network-attached storage systems is provided herein. A data storage system as described herein can include a memory that stores computer executable components and a processor that executes computer executable components stored in the memory. The computer executable components can include a file identification component that obtains an identifier for a target file stored by the data storage system; a lookup component that searches a scan status data structure for a malware scan result corresponding to the identifier for the target file; and a file access component that grants access to the target file in response to the lookup component obtaining the malware scan result from the scan status data structure and the malware scan result indicating that the target file contains no malware.
1. A data storage system, comprising:
a memory that stores computer executable components; and
a processor that executes the computer executable components stored in the memory, wherein the computer executable components comprise:
a data creation component that, in response to determining that deduplication metadata is not present on the data storage system, creates a scan status data structure for the data storage system that comprises a scan status field and is separate from the deduplication metadata;
a file identification component that creates, at a first time, an identifier for a target file stored by the data storage system;
a recording component that records the identifier for the target file in attribute data contained in the target file in response to the file identification component creating the identifier, wherein the file identification component further obtains the identifier for the target file from the attribute data at a second time that is after the first time instead of computing the identifier for the target file at the second time;
a lookup component that searches the scan status data structure for a malware scan result corresponding to the identifier for the target file in response to the file identification component successfully obtaining the identifier for the target file; and
a file access component that grants access to the target file in response to the lookup component obtaining the malware scan result from the scan status data structure and the malware scan result indicating that the target file contains no malware, wherein the recording component stores the malware scan result in the attribute data contained in the target file further in response to the lookup component obtaining the malware scan result from the scan status data structure.
2. The data storage system of claim 1 , wherein the file identification component creates the identifier for the target file at the first time in response to the identifier being determined not to be present in the attribute data contained in the target file at the first time.
3. The data storage system of claim 1 , wherein the identifier for the target file comprises a result of a hash of the target file.
4. The data storage system of claim 1 , wherein the file access component initiates a scan of the target file by an antivirus server in response to the malware scan result corresponding to the identifier for the target file being determined not to be present in the scan status data structure.
5. The data storage system of claim 4 , wherein the computer executable components further comprise:
a data structure upkeep component that records a relationship between the identifier for the target file and the scan of the target file by the antivirus server in the scan status data structure.
6. The data storage system of claim 1 , wherein the file access component denies access to the target file in response to the malware scan result indicating that the target file comprises malware.
7. The data storage system of claim 1 , wherein the lookup component searches the scan status data structure in response to a request for at least one of a write access to the target file or a read access to the target file.
8. A method, comprising:
generating, by a device operatively coupled to a processor, a scan status table for a group of files stored by a data storage system in response to determining that deduplication metadata is not present on the data storage system, wherein the scan status table comprises a scan status field and is separate from the deduplication metadata;
creating, by the device, an identifier for a target file of the group of files at a first time;
recording, by the device, the identifier in attribute data of the target file in response to creating the identifier for the target file;
obtaining, by the device, the identifier for the target file from the attribute data at a second time that is after the first time instead of computing the identifier for the target file at the second time;
searching, by the device, the scan status table for a malware scan result corresponding to the identifier for the target file in response to obtaining the identifier;
storing, by the device, the malware scan result in the attribute data of the target file in response to the malware scan result being present in the scan status table; and
granting, by the device, access to the target file in response to the malware scan result being present in the scan status table and the malware scan result indicating that the target file comprises no malware.
9. The method of claim 8 , wherein creating the identifier for the target file comprises:
creating, by the device, the identifier for the target file at the first time in response to the identifier not being present in the attribute data of the target file at the first time.
10. The method of claim 8 , wherein the identifier for the target file comprises a hash of the target file.
11. The method of claim 8 , further comprising:
initiating, by the device, a scan of the target file by an antivirus server in response to the malware scan result corresponding to the identifier for the target file not being present in the scan status table; and
recording, by the device, a relationship between the identifier for the target file and the scan of the target file by the antivirus server in the scan status table.
12. A non-transitory machine-readable medium comprising computer executable instructions that, when executed by a processor, facilitate performance of operations, the operations comprising:
creating a scan status data structure for files stored by a data storage system in response to determining that deduplication metadata is not present on the data storage system, wherein the scan status data structure comprises a scan status field and is separate from the deduplication metadata;
creating an identifier for a target file of the files at a first time;
recording the identifier as a first attribute of the target file in response to creating the identifier;
obtaining the identifier from the first attribute of the target file at a second time that is subsequent to the first time instead of obtaining the identifier at the first time;
searching the scan status data structure for a malware scan result corresponding to the identifier for the target file in response to obtaining the identifier at the second time;
storing the malware scan result as a second attribute of the target file in response to the malware scan result being determined to be present in the scan status data structure; and
granting access to the target file in response to the malware scan result being determined to be present in the scan status data structure and the malware scan result indicating that the target file contains no malware.
13. The non-transitory machine-readable medium of claim 12 , wherein the operations further comprise:
creating the identifier for the target file at the first time in response to the identifier being determined not to be present as the first attribute of the target file at the first time.
14. The non-transitory machine-readable medium of claim 12 , wherein the operations further comprise:
initiating a scan of the target file by an antivirus server in response to the malware scan result corresponding to the identifier for the target file being determined not to be present in the scan status data structure; and
recording a relationship between the identifier for the target file and the scan of the target file by the antivirus server in the scan status data structure.
15. The data storage system of claim 1 , wherein the first time corresponds to a time at which the target file is created.
16. The data storage system of claim 1 , wherein the first time corresponds to a time at which the target file is modified.
17. The data storage system of claim 1 , wherein the second time corresponds to a time at which a request to open the target file is received by the file access component.
18. The data storage system of claim 1 , wherein the scan status data structure further comprises at least one field selected from a group comprising a file identifier field, a file path field, a file size field, and a last scan time field.
19. The method of claim 8 , wherein the scan status table comprises at least one field selected from a group comprising a file identifier field, a file path field, a file size field, and a last scan time field.
20. The non-transitory machine-readable medium of claim 12 , wherein the scan status data structure comprises at least one field selected from a group comprising a file identifier field, a file path field, a file size field, and a last scan time field.