Priority scanning of files written by malicious users in a data storage system

Patent metadata

Field	Value
Publication number	US-11086994-B2
Application number	US-201816225878-A
Country	US
Kind code	B2
Filing date	Dec 19, 2018
Priority date	Dec 19, 2018
Publication date	Aug 10, 2021
Grant date	Aug 10, 2021

Abstract

Priority scanning of files written by malicious users in a data storage system is described herein. A data storage system as described herein can include a user lookup component that obtains identities of users that have made at least one modification to a first file stored on the data storage system, resulting in a set of modifying users; a comparison component that compares respective modifying users of the set of modifying users to respective malicious users of a set of malicious users; and a scan priority component that, in response to the comparison component identifying at least one match between a modifying user of the set of modifying users and a malicious user of the set of malicious users, assigns a first scan priority to the first file that is higher than a second scan priority assigned to a second, different file stored on the data storage system.

First claim

What is claimed is:

1. A data storage system, comprising:
a memory that stores computer executable components; and
a processor that executes computer executable components stored in the memory, wherein the computer executable components comprise:
a scan queue component that generates a malware scan queue that comprises a group of files stored on the data storage system, the group of files comprising a first file and a second file that is different from the first file;
a user lookup component that obtains identities of users that have made at least one modification to the first file, resulting in a set of modifying users;
a comparison component that compares respective modifying users of the set of modifying users to respective malicious users of a set of malicious users; and
a scan priority component that, in response to the comparison component identifying at least one match between a modifying user of the set of modifying users and a malicious user of the set of malicious users, assigns a first scan priority to the first file in the malware scan queue that is higher than a second scan priority assigned to the second file in the malware scan queue;
wherein the scan queue component, in response to the comparison component identifying the at least one match, locates respective unqueued files stored on the data storage system that have been modified by the malicious user, and wherein the scan queue component, in response to locating the respective unqueued files, adds the respective unqueued files to the malware scan queue.

2. The data storage system of claim 1 , wherein the computer executable components further comprise:
a file tracking component that records the set of modifying users as an attribute of the first file, wherein the user lookup component obtains the set of modifying users via the attribute of the first file.

3. The data storage system of claim 2 , wherein the file tracking component clears the set of modifying users in response to a malware scan of the first file indicating that the first file does not contain malware.

4. The data storage system of claim 1 , wherein the computer executable components further comprise:
a malware scanning component that directs a first malware scan of the first file and a second malware scan of the second file in an order defined by the malware scan queue.

5. The data storage system of claim 1 , wherein the scan queue component moves the first file ahead of the second file in the malware scan queue in response to the comparison component identifying the at least one match.

6. The data storage system of claim 4 , wherein the malware scanning component directs the first malware scan of the first file in response to the comparison component identifying the at least one match, and wherein the scan queue component removes the first file from the malware scan queue in response to completion of the first malware scan.

7. The data storage system of claim 4 , wherein the computer executable components further comprise:
a scan queue analysis component that identifies a third file in the malware scan queue that has been modified by the malicious user, wherein the third file is different from the first file and the second file, and wherein the scan priority component assigns the first scan priority to the third file in response to the scan queue analysis component identifying the third file.

8. The data storage system of claim 1 , wherein the first scan priority comprises a real-time scan priority and the second scan priority comprises a scheduled scan priority.

9. A method, comprising:
generating, by a device operatively coupled to a processor, a malware scan queue that comprises a group of files stored on a data storage system, the group of files comprising a first file and a second file that is different from the first file;
obtaining, by the device, user identities that are associated with having made at least one modification to the first file, resulting in a group of modifying user identities;
comparing, by the device, respective modifying user identities of the group of modifying user identities to respective malicious user identities of a group of malicious user identities;
in response to identifying at least one match between a modifying user identity of the group of modifying user identities and a malicious user identity of the group of malicious user identities, assigning, by the device, a first scan priority to the first file in the malware scan queue that is higher than a second scan priority assigned to the second file in the malware scan queue;
further in response to identifying the at least one match, locating, by the device, respective unqueued files stored on the data storage system that have been modified by the malicious user identity; and
in response to locating the respective unqueued files, adding, by the device, the respective unqueued files to the malware scan queue.

10. The method of claim 9 , further comprising:
recording, by the device, the group of modifying user identities as an attribute of the first file, wherein the obtaining the user identities comprises obtaining the group of modifying user identities via the attribute of the first file.

11. The method of claim 9 , further comprising:
directing, by the device, malware scans comprising a first malware scan of the first file and a second malware scan of the second file in an order defined by the malware scan queue.

12. The method of claim 9 , wherein the assigning the first scan priority comprises moving the first file ahead of the second file in the malware scan queue.

13. The method of claim 11 , wherein the directing the malware scans comprises directing the first malware scan of the first file in response to identifying the at least one match, and wherein the method further comprises:
removing, by the device, the first file from the malware scan queue in response to completion of the first malware scan.

14. The method of claim 11 , further comprising:
identifying, by the device, a third file in the malware scan queue that has been modified by the malicious user identity, wherein the third file is different from the first file and the second file, and wherein the assigning the first scan priority comprises assigning the first scan priority to the third file in response to the identifying the third file.

15. The method of claim 9 , wherein the first scan priority comprises a real-time scan priority and the second scan priority comprises a scheduled scan priority.

16. A non-transitory machine-readable medium comprising computer executable instructions that, when executed by a processor of a data storage system, facilitate performance of operations, the operations comprising:
generating a malware scan queue that comprises a group of files stored on the data storage system, the group of files comprising a first file and a second file that is distinct from the first file;
obtaining identities of users that have made at least one modification to the first file, resulting in modifying users;
comparing respective modifying users of the modifying users to respective malicious users of malicious users;
in response to identifying at least one match between a modifying user of the modifying users and a malicious user of the malicious users, assigning a first scan priority to the first file in the malware scan queue that is higher than a second scan priority assigned to the second file in the malware scan queue;
further in response to identifying the at least one match, locating respective unqueued files stored on the data storage system that have been modified

Assignees

• Emc Ip Holding Co Llc

Inventors

• Gahlot Jai Prakash
• Chauhan Amit Kumar
• Kumar Shiv Shankar

Classifications

• G06F16/1824

  implemented using Network-attached Storage [NAS] architecture (distributed or networked storage systems G06F3/067; protocols for distributed storage of data in a network H04L67/1097) · CPC title

• G06F16/1734 Primary

  Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/565 Primary

  by checking file integrity · CPC title

• G06F21/562

  Static detection · CPC title