Multi-purpose agent for endpoint scanning
View Patent ↗Methods, apparatuses, and storage media storing instructions for scanning electronically-stored files are provided. A file stored in a computer-readable storage medium is scanned. Based on the scanning, a common analysis is performed on the file for two or more software functions. Based on the scanning, a software function-specific analysis is performed on the file for a respective software function. Two or more decisions on the file is made for the two or more software functions based on the common analysis and the software function-specific analysis.
1. A method comprising:
executing a multi-purpose one-time scanning on a file stored in a computer-readable storage medium, wherein the multi-purpose one-time scanning comprises:
performing a common analysis on the file by:
extracting content of the file to obtain a string of characters of the file;
dividing the string of characters of the file into a plurality of sequences;
generating a plurality of hashes corresponding to the plurality of sequences and aggregating the plurality of hashes into a hash list; and
generating a fingerprint of the file based on the hash list; and performing multiple software function-specific analyses on the file without scanning the file for multiple times, wherein the multiple software function-specific analyses comprises a first analysis and a second analysis, the first analyses comprises determining whether the file is a confidential file by matching the fingerprint of the file with a fingerprint of a reference confidential file, and the second analysis comprises determining whether the file is a virus-infected file by matching the fingerprint of the file with a fingerprint of a reference virus-infected.
2. The method according to claim 1 , wherein the common analysis further includes one of file type recognition, file content extraction, unpacking the file, unzipping the file, and file content matching with content of a library.
3. The method according to claim 1 , wherein the multi-purpose one-time scanning on the file comprises:
identifying a plurality of root folders for scanning;
traversing each of the root folders recursively to determine whether a respective root folder includes a sub-folder or the file;
in response to determining that the respective root folder includes a sub-folder, traversing the sub-folder recursively; and
in response to determining that the respective root folder includes the file, scanning the file.
4. The method according to claim 1 , wherein the generating a plurality of hashes corresponding to the plurality of sequences comprises:
obtaining a first sequence from the plurality of sequences;
generating a first hash based on the first sequence;
obtaining a second sequence from the plurality of sequences, the second sequence being shifted from the first sequence;
generating a second hash based on the second sequence; and
adding the first hash and the second hash into the hash list.
5. The method according to claim 4 , wherein the first sequence and the second sequence are shifted from each other by a predetermined length of characters.
6. The method according to claim 4 , further comprising:
using a same hash function to generate the first hash and the second hash.
7. An apparatus comprising:
one or more processors;
a memory configured to store instructions executable by the one or more processors, wherein the one or more processors are configured to execute the instructions to perform operations including:
executing a multi-purpose one-time scanning on a file stored in a computer-readable storage medium, wherein the multi-purpose one-time scanning comprises:
performing a common analysis on the file by:
extracting content of the file to obtain a string of characters of the file;
dividing the string of characters of the file into a plurality of sequences;
generating a plurality of hashes corresponding to the plurality of sequences and aggregating the plurality of hashes into a hash list; and
generating a fingerprint of the file based on the hash list; and, performing multiple software function-specific analyses on the file without scanning the file for multiple times, wherein the multiple software function-specific analyses comprises a first analysis and a second analysis, the first analysis comprises determining whether the file is a confidential file by matching the fingerprint of the file with a fingerprint of a reference confidential file, and the second analysis comprises determining whether the file is a virus-infected file by matching the fingerprint of the file with a fingerprint of a reference virus-infected file.
8. The apparatus according to claim 7 , wherein the common analysis further includes one of file type recognition, file content extraction, unpacking the file, unzipping the file, and file content matching with content of a library.
9. The apparatus according to claim 7 , wherein the multi-purpose one-time scanning on the file comprises:
identifying a plurality of root folders for scanning;
traversing each of the root folders recursively to determine whether a respective root folder includes a sub-folder or the file;
in response to determining that the respective root folder includes a sub-folder, traversing the sub-folder recursively; and
in response to determining that the respective root folder includes the file, scanning the file.
10. The apparatus according to claim 7 , wherein the generating a plurality of hashes corresponding to the plurality of sequences comprises:
obtaining a first sequence from the plurality of sequences;
generating a first hash based on the first sequence;
obtaining a second sequence from the plurality of sequences, the second sequence being shifted from the first sequence;
generating a second hash based on the second sequence; and
adding the first hash and the second hash into the hash list.
11. The apparatus according to claim 10 , wherein the first sequence and the second sequence are shifted from each other by a predetermined length of characters.
12. The apparatus according to claim 10 , further comprising:
using a same hash function to generate the first hash and the second hash.
13. A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:
executing a multi-purpose one-time scanning on a file stored in a computer-readable storage medium, wherein the multi-purpose one-time scanning comprises;
performing a common analysis on the file by:
extracting content of the file to obtain a string of characters of the file;
dividing the string of characters of the file into a plurality of sequences;
generating a plurality of hashes corresponding to the plurality of sequences and aggregating the plurality of hashes into a hash list; and
generating a fingerprint of the file based on the hash list; and performing multiple software function-specific analyses analysis on the file without scanning the file for multiple times, wherein the multiple software function-specific analyses comprises a first analysis and a second analysis, the first analysis comprises determining whether the file is a confidential file by matching the fingerprint of the file with a fingerprint of a reference confidential file, and the second analysis comprises determining whether the file is a virus- infected file by matching the fingerprint of the file with a fingerprint of a reference virus-infected file.
14. The non-transitory computer-readable storage medium according to claim 13 , wherein the common analysis further includes one of file type recognition, file content extraction, unpacking the file, unzipping the file, and file content matching with content of a library.
15. The non-transitory computer-readable storage medium according to claim 13 , wherein the multi-purpose one-time scanning on the file comprises:
identifying a plurality of root folders for scanning;
traversing each of the root folders recursively to determine whether a respective root folder includes a sub-folder or the file;
in response to determining that the respective root folder includes a sub-folder, traversing the sub-folder recursively; and
in response to determining that the respective root folder includes the file, scanning the file.
16. The non-transitory computer-readable storage medium according to claim 13 , wherein the generating a plurality of hashes corresponding to the plurality of sequences comprises:
obtaining a first sequence from the plurality of sequences;
generating a first hash based on the first sequence;
obtaining a second sequence from the plurality of sequences, the second sequence being shifted from the first sequence;
generating a second hash based on the second sequence; and
adding the first hash and the second hash into the hash list.
17. The non-transitory computer-readable storage medium according to claim 16 , wherein the first sequence and the second sequence are shifted from each other by a predetermined length of characters.
18. The non-transitory computer-readable storage medium according to claim 16 , wherein the operations further comprise:
using a same hash function to generate the first hash and the second hash.