Malware scan status determination for network-attached storage systems
View Patent ↗Malware scan status determination for network-attached storage systems is provided herein. A data storage system as described herein can include a memory that stores computer executable components and a processor that executes computer executable components stored in the memory. The computer executable components can include a data creation component that creates a scan status data structure associated with a network-attached storage (NAS) device, the scan status data structure comprising respective records that indicate a file identifier and a malware scan status for respective files stored on the NAS device, and a data update component that updates a record in the scan status data structure corresponding to a target file stored on the NAS device in response to receiving a malware scan result for the target file.
1. A data storage system, comprising:
a memory that stores computer executable components; and
a processor that executes computer executable components stored in the memory, wherein the computer executable components comprise:
a data creation component that, in response to determining that a deduplication data structure is not associated with a network attached storage (NAS) device, creates a scan status data structure associated with the NAS device as a new data structure, the scan status data structure comprising respective records that indicate a file identifier and a malware scan status for respective files stored on the NAS device; and
a data update component that updates a record in the scan status data structure corresponding to a target file stored on the NAS device in response to receiving a malware scan result for the target file.
2. The data storage system of claim 1 , wherein the data creation component, in response to determining that a deduplication data structure is associated with the NAS device, creates the scan status data structure by appending a file scan status field to the deduplication data structure.
3. The data storage system of claim 1 , wherein the scan status data structure comprises at least one of a file identifier field, a file path field, a file size field, a scan status field, or a last scan time field.
4. The data storage system of claim 1 , wherein the computer executable components further comprise:
a data lookup component that obtains an identifier for the target file and determines whether a record corresponding to the identifier for the target file exists in the scan status data structure in response to obtaining the identifier.
5. The data storage system of claim 4 , wherein the data update component, in response to the data lookup component determining that an existing record in the scan status data structure for the target file exists, updates the existing record of the scan status data structure corresponding to the target file in response to receiving the malware scan result for the target file.
6. The data storage system of claim 4 , wherein the data update component, in response to the data lookup component determining that an existing record in the scan status data structure for the target file does not exist, creates a new record in the scan status data structure corresponding to the target file in response to receiving the malware scan result for the target file.
7. The data storage system of claim 1 , wherein the computer executable components further comprise:
a statistics component that generates a statistical report based on scan status information stored in the scan status data structure.
8. The data storage system of claim 1 , wherein the computer executable components further comprise:
a filter component that classifies respective ones of the files represented by the scan status data structure based on scan status information stored in the scan status data structure.
9. The data storage system of claim 8 , wherein the filter component and the scan status data structure reside on a device that is distinct from the NAS device, and wherein the filter component further prevents transfer of one or more files that are indicated by the scan status data structure as being infected with malware to the NAS device.
10. The data storage system of claim 8 , wherein the filter component further prevents malware scanning of one or more files that have a previous scan status indicated by the scan status data structure.
11. A method, comprising:
creating, by a device operatively coupled to a processor, a scan status data structure associated with a network-attached storage (NAS) device as a new data structure in response to determining that a deduplication data structure is not associated with the NAS device, the scan status data structure comprising respective records that indicate a file identifier and a malware scan status for respective files stored on the NAS device; and
updating, by the device, a record in the scan status data structure corresponding to a target file stored on the NAS device in response to receiving a malware scan result for the target file.
12. The method of claim 11 , wherein the creating comprises:
creating, in response to determining that a deduplication data structure is associated with the NAS device, the scan status data structure by appending a file scan status field to the deduplication data structure.
13. The method of claim 11 , wherein the scan status data structure comprises at least one of a file identifier field, a file path field, a file size field, a scan status field, or a last scan time field.
14. The method of claim 11 , further comprising:
obtaining, by the device, an identifier for the target file; and
determining, by the device, whether a record corresponding to the identifier for the target file exists in the scan status data structure in response to obtaining the identifier.
15. The method of claim 14 , wherein the updating comprises:
creating, in response to determining that an existing record in the scan status data structure for the target file does not exist, a new record in the scan status data structure corresponding to the target file in response to receiving the malware scan result for the target file.
16. The method of claim 11 , further comprising:
generating, by the device, a statistical report based on scan status information stored in the scan status data structure.
17. The method of claim 11 , further comprising:
classifying, by the device, respective ones of the files represented by the scan status data structure based on scan status information stored in the scan status data structure.
18. A non-transitory machine-readable medium comprising computer executable instructions that, when executed by a processor, facilitate performance of operations, the operations comprising:
creating a scan status data structure associated with a network-attached storage (NAS) device as a new data structure in response to determining that a deduplication data structure is not associated with the NAS device, the scan status data structure comprising respective records that indicate a file identifier and a malware scan status for respective files stored on the NAS device; and
updating a record in the scan status data structure corresponding to a target file stored on the NAS device in response to receiving a malware scan result for the target file.
19. The non-transitory machine-readable medium of claim 18 , wherein the operations further comprise:
creating, in response to determining that a deduplication data structure is associated with the NAS device, the scan status data structure by appending a file scan status field to the deduplication data structure.
20. The non-transitory machine-readable medium of claim 18 , wherein the scan status data structure comprises at least one of a file identifier field, a file path field, a file size field, a scan status field, or a last scan time field.