Predictive real-time and scheduled anti-virus scanning
View Patent ↗Implementations are provided herein for systems, methods, and a non-transitory computer product configured to use predictive analysis of quantifiable parameters associated with individual files stored on a distributed file storage system. In some embodiments, parameters are analyzed by machine learning so that real-time and scheduled antivirus scanning can be intelligently conducted. We teach creating a sequential order for scheduled antivirus scanning such that the files most likely to be accessed or needed by users in the future will be scanned for viruses before those files less likely to be accessed. We reconcile scheduled antivirus scanning with predictive analysis for real-time antivirus scanning. Our teachings encompass the use of heuristic data compiled, in some instances through machine learning, and analyzed on a per-file basis. We enable system administrators to determine which parameters to prioritize and to set thresholds for antivirus scanning, such as time limits.
1. A method of combining predictive analytics from a real-time file access module and a scheduler module in order to enhance overall system performance for a distributed file system performing antivirus scanning comprising:
receiving a first access request at a node of the distributed file system for a first file stored on the node;
determining if the first file must undergo an anti-virus scan prior to allowing access to the first file;
placing the first file in a real-time anti-virus scan queue;
predicting at least a second file, which will be requested after the first file, wherein the prediction is based on a heuristic data set, the heuristic data set including a statistically significant likelihood that a second access request will be received for the second file based on a past pattern showing the second file being requested after the first file;
evaluating at a node of the distributed file system a plurality of parameters, each parameter being associated with a respective plurality of files stored in the distributed file storage system;
creating a sequentially ordered list of the plurality of stored files based on the plurality of parameters, wherein the sequentially ordered list comprising one or more files to undergo the anti-virus scan on a lower priority than files in the real-time anti-virus scan queue, and wherein the plurality of stored files are ordered according to at least one parameter;
placing the predicted at least the second file in a predictive scan queue, wherein the predicted at least the second file in the predictive scan queue will undergo the anti-virus scan on a lower priority than the files in the real-time anti-virus scan queue and on a higher priority than the files in the sequentially ordered list;
performing the anti-virus scan on the files in the real-time anti-virus scan queue, the predictive scan queue, and the sequentially ordered list, wherein the anti-virus scan on the files in the real-time anti-virus scan queue and the predictive scan queue are performed at an overlapping point in time.
2. The method according to claim 1 , wherein the heuristics data set is compiled by a machine learning module.
3. The method according to claim 1 , wherein a machine learning module analyzes the plurality of parameters in order to create an order of the sequentially ordered list.
4. The method according to claim 1 , wherein the parameter is one or more of: an access frequency for one of the stored files, a date of a last access request for one of the stored files, a time of a last access request for one of the stored files, a file extension for one of the stored files, a true type for one of the stored files, a hash value for one of the stored files, a reputation for one of the stored files, a publisher for one of the stored files, a size for one of the stored files, an access zone for one of the stored files, a base directory for one of the stored files, a permission bit for one of the stored files, a creation time for one of the stored files, a last modification time for one of the stored files, or a last definition update time for one of the stored files.
5. A system for combining predictive analytics from a real-time file access module and a scheduler module in order to enhance overall system performance for a distributed file system performing antivirus scanning comprising at least one storage device and at least one hardware processor configured to:
receive a first access request at a node of the distributed file system for a first file stored on the node;
determine if the first file must undergo an anti-virus scan prior to allowing access to the first file;
place the first file in a real-time anti-virus scan queue;
predict at least a second file, which will be requested after the first file, wherein the prediction is based on a heuristic data set, the heuristic data set including a statistically significant likelihood that a second access request will be received for the second file based on a past pattern showing the second file being requested after the first file;
evaluate at a node of the distributed file system a plurality of parameters, each parameter being associated with a respective plurality of files stored in the distributed file storage system;
create a sequentially ordered list of the plurality of stored files based on the plurality of parameters, wherein the sequentially ordered list comprising one or more files to undergo the anti-virus scan on a lower priority than files in the real-time anti-virus scan queue, and wherein the plurality of stored files are ordered according to at least one parameter;
place the predicted at least the second file in a predictive scan queue, wherein the predicted at least the second file in the predictive scan queue will undergo the anti-virus scan on a lower priority than the files in the real-time anti-virus scan queue and on a higher priority than the files in the sequentially ordered list;
perform the anti-virus scan on the files in the real-time anti-virus scan queue, the predictive scan queue, and the sequentially ordered list, wherein the anti-virus scan on the files in the real-time anti-virus scan queue and the predictive scan queue are performed at an overlapping point in time.
6. The system according to claim 5 , wherein the heuristics data set is compiled by a machine learning module.
7. The system according to claim 5 , wherein a machine learning module analyzes the plurality of parameters in order to create an order of the sequentially ordered list.
8. The system according to claim 5 , wherein the parameter is one or more of: an access frequency for one of the stored files, a date of a last access request for one of the stored files, a time of a last access request for one of the stored files, a file extension for one of the stored files, a true type for one of the stored files, a hash value for one of the stored files, a reputation for one of the stored files, a publisher for one of the stored files, a size for one of the stored files, an access zone for one of the stored files, a base directory for one of the stored files, a permission bit for one of the stored files, a creation time for one of the stored files, a last modification time for one of the stored files, or a last definition update time for one of the stored files.
9. A non-transitory computer readable medium for combining predictive analytics from a real-time file access module and a scheduler module in order to enhance overall system performance for a distributed file system performing antivirus scanning with program instructions stored thereon to perform the following acts:
receive a first access request at a node of the distributed file system for a first file stored on the node;
determine if the first file must undergo an anti-virus scan prior to allowing access to the first file; place the first file in a real-time anti-virus scan queue;
predict at least a second file, which will be requested after the first file, wherein the prediction is based on a heuristic data set, the heuristic data set including a statistically significant likelihood that a second access request will be received for the second file based on a past pattern showing the second file being requested after the first file;
evaluate at a node of the distributed file system a plurality of parameters, each parameter being associated with a respective plurality of files stored in the distributed file storage system;
create a sequentially ordered list of the plurality of stored files based on the plurality of parameters, wherein the sequentially ordered list comprising one or more files to undergo the anti-virus scan on a lower priority than files in the real-time anti-virus scan queue, and wherein the plurality of stored files are ordered according to at least one parameter;
place the predicted at least the second file in a predictive scan queue, wherein the predicted at least the second file in the predictive scan queue will undergo the anti-virus scan on a lower priority than the files in the real-time anti-virus scan queue and on a higher priority than the files in the sequentially ordered list;
perform the anti-virus scan on the files in the real-time anti-virus scan queue, the predictive scan queue, and the sequentially ordered list, wherein the anti-virus scan on the files in the real-time anti-virus scan queue and the predictive scan queue are performed at an overlapping point in time.
10. The non-transitory computer readable medium according to claim 9 , wherein the heuristics data set is compiled by a machine learning module.
11. The non-transitory computer readable medium according to claim 9 , wherein a machine learning module analyzes the plurality of parameters in order to create an order of the sequentially ordered list.