Systems and methods for synthetic file scanning

1. A method for synthetic file scanning, the method comprising:

identifying, on a storage device, a plurality of files that are scanned periodically for malicious activity;

for each respective file in the plurality of files, determining a respective likelihood value of the respective file being targeted by the malicious activity;

including, in a subset of files, each respective file in the plurality of files with a respective likelihood value that is greater than a threshold likelihood value;

for each respective file in the subset of files, identifying at least one fragment of the respective file that is susceptible to the malicious activity, based on characteristics of the malicious activity;

extracting the at least one fragment from each respective file;

storing the extracted at least one fragment from each respective file in a synthetic file in encrypted form, wherein contents of the synthetic file are arranged in accordance with storage addresses of each respective file in the subset of files;

scanning the synthetic file periodically instead of the plurality of files, wherein the synthetic file is updated before each periodic scan;

determining, based on the scanning, that the synthetic file is uninfected, wherein determining that the synthetic file is uninfected is indicative that the subset of files in the plurality of files whose fragments make up the synthetic file are uninfected; and

marking each respective file in the subset of files whose fragment is included in the synthetic file as a clean file.

2. The method of claim 1 , wherein the synthetic file further comprises, for each respective fragment, a respective pointer that points to a respective storage address of the respective fragment.

3. The method of claim 2 , further comprising:

detecting a change in a fragment on the storage device; updating a corresponding fragment in the synthetic file in accordance with the change using a pointer for the corresponding fragment.

4. The method of claim 1 , further comprising: determining, based on the scanning, that a fragment in the synthetic file has been targeted by the malicious activity; identifying a file in the storage device that comprises a corresponding fragment; and performing a remediation action on the file, wherein the remediation action is one of: file removal and file quarantine.

5. The method of claim 1 , further comprising: storing an identifier of each respective file; and deleting the synthetic file.

6. The method of claim 5 , wherein the plurality of files are comprised in a first backup of the storage device, further comprising: receiving a second backup of the storage device; determining a first subset of files in the second backup that have been modified since the first backup; identifying, from the first subset of files, a second subset of files that match with the stored identifiers; and storing fragments from the second subset of files in a new synthetic file without re-determining likelihood values of the second subset of files being targeted by the malicious activity.

7. The method of claim 1 , wherein identifying the at least one fragment of the respective file that is susceptible to the malicious activity based on characteristics of the malicious activity further comprises: determining a target location of the malicious activity based on historic attacks; identifying the target location in the respective file in the subset of files; and identifying the at least one fragment of the respective file that comprises the target location.

8. The method of claim 1 , wherein the plurality of files are comprised in a backup, wherein a unique synthetic file is created for each backup.

9. A system for synthetic file scanning, the system comprising: a hardware processor configured to:

identify, on a storage device, a plurality of files that are scanned periodically for malicious activity;

for each respective file in the plurality of files, determine a respective likelihood value of the respective file being targeted by the malicious activity;

include, in a subset of files, each respective file in the plurality of files with a respective likelihood value that is greater than a threshold likelihood value;

for each respective file in the subset of files, identify at least one fragment of the respective file that is susceptible to the malicious activity, based on characteristics of the malicious activity;

extract the at least one fragment from each respective file;

store the extracted at least one fragment from each respective file in a synthetic file in encrypted form, wherein contents of the synthetic file are arranged in accordance with storage addresses of each respective file in the subset of files;

scan the synthetic file periodically instead of the plurality of files, wherein the synthetic file is updated before each periodic scan;

determine, based on the scanning, that the synthetic file is uninfected, wherein determining that the synthetic file is uninfected is indicative that the subset of files in the plurality of files whose fragments make up the synthetic file are uninfected; and

mark each respective file in the subset of files whose fragment is included in the synthetic file as a clean file.

10. The system of claim 9 , wherein the synthetic file further comprises, for each respective fragment, a respective pointer that points to a respective storage address of the respective fragment.

11. The system of claim 10 , wherein the hardware processor is further configured to: detect a change in a fragment on the storage device; update a corresponding fragment in the synthetic file in accordance with the change using a pointer for the corresponding fragment.

12. The system of claim 9 , wherein the hardware processor is further configured to: determine, based on the scanning, that a fragment in the synthetic file has been targeted by the malicious activity; identify a file in the storage device that comprises a corresponding fragment; and perform a remediation action on the file, wherein the remediation action is one of: file removal and file quarantine.

13. The system of claim 9 , wherein the hardware processor is further configured to: store an identifier of each respective file; and delete the synthetic file.

14. The system of claim 13 , wherein the plurality of files are comprised in a first backup of the storage device, wherein the hardware processor is further configured to: receive a second backup of the storage device; determine a first subset of files in the second backup that have been modified since the first backup; identify, from the first subset of files, a second subset of files that match with the stored identifiers; and store fragments from the second subset of files in a new synthetic file without re-determining likelihood values of the second subset of files being targeted by the malicious activity.

15. The system of claim 9 , wherein the hardware processor is further configured to identify the at least one fragment of the respective file that is susceptible to the malicious activity based on characteristics of the malicious activity by:

determining a target location of the malicious activity based on historic attacks; identifying the target location in the respective file in the subset of files; and identifying the at least one fragment of the respective file that comprises the target location.

16. The system of claim 9 , wherein the plurality of files are comprised in a backup, wherein a unique synthetic file is created for each backup.

17. A non-transitory computer readable medium storing thereon computer executable instructions for synthetic file scanning, including instructions for:

identifying, on a storage device, a plurality of files that are scanned periodically for malicious activity;

for each respective file in the plurality of files, determining a respective likelihood value of the respective file being targeted by the malicious activity;

including, in a subset of files, each respective file in the plurality of files with a respective likelihood value that is greater than a threshold likelihood value;

for each respective file in the subset of files, identifying at least one fragment of the respective file that is susceptible to the malicious activity, based on characteristics of the malicious activity;

extracting the at least one fragment from each respective file;

storing the extracted at least one fragment from each respective file in a synthetic file in encrypted form, wherein contents of the synthetic file are arranged in accordance with storage addresses of each respective file in the subset of files;

scanning the synthetic file periodically instead of the plurality of files, wherein the synthetic file is updated before each periodic scan;

determining, based on the scanning, that the synthetic file is uninfected, wherein determining that the synthetic file is uninfected is indicative that the subset of files in the plurality of files whose fragments make up the synthetic file are uninfected; and

marking each respective file in the subset of files whose fragment is included in the synthetic file as a clean file.

18. The non-transitory computer readable medium of claim 17 , wherein the synthetic file further comprises, for each respective fragment, a respective pointer that points to a respective storage address of the respective fragment.