Systems and methods for anti-malware scanning using automatically-created white lists

Patent metadata

Field	Value
Publication number	US-11822659-B2
Application number	US-202318150226-A
Country	US
Kind code	B2
Filing date	Jan 5, 2023
Priority date	Mar 29, 2019
Publication date	Nov 21, 2023
Grant date	Nov 21, 2023

Abstract

Disclosed herein are systems and method for anti-malware scanning, including identifying a plurality of objects in a backup archive that is connected to a first network comprising a plurality of computing devices; scanning the plurality of objects in the backup archive to generate a whitelist indicating a subset of the plurality of objects that do not need to be scanned at a subsequent time; performing, using the whitelist, a first malware scan in a computing device of the plurality of computing devices; detecting that the computing device has left the first network to join a second network; and performing a second malware scan on the computing device, wherein the second malware scan uses a different whitelist of the second network, and wherein the second malware scan comprises scanning a first object that is not in the different whitelist and was not scanned in the first malware scan.

First claim

The invention claimed is:

1. A method for anti-malware scanning, the method comprising:
identifying a plurality of objects in a backup archive that is connected to a first network comprising a plurality of computing devices;
scanning the plurality of objects in the backup archive to generate a whitelist indicating a subset of the plurality of objects that do not need to be scanned at a subsequent time;
performing, using the whitelist, a first malware scan in a computing device of the plurality of computing devices;
detecting that the computing device has left the first network to join a second network; and
performing a second malware scan on the computing device, wherein the second malware scan uses a different whitelist of the second network, and wherein the second malware scan comprises scanning a first object that is not in the different whitelist and was not scanned in the first malware scan due to being in the whitelist.

2. The method of claim 1 , wherein the whitelist further indicates respective hash values of objects in the subset.

3. The method of claim 1 , wherein the first malware scan comprises for each object of the computing device,
computing a hash value of the object,
determining whether the object is in the whitelist by comparing the hash value of the object with respective hash values of the objects identified in the whitelist, and
in response to determining that the object is in the whitelist, not scanning the object in the first malware scan.

4. The method of claim 1 , further comprising providing a result of the first malware scan to a provider of a protection service.

5. The method of claim 1 , wherein scanning the plurality of objects in the backup archive to generate the whitelist further comprises:
for each respective object of the plurality of objects, scanning the respective object, obtaining metadata associated with the respective object, and storing the obtained metadata in a database.

6. The method of claim 5 , wherein the metadata associated with a respective object of the plurality of objects includes at least a parameter for storing a respective hash value of the respective object.

7. The method of claim 6 , wherein the metadata associated with the respective object of the plurality of objects further includes parameters for storing one or more of: a name of the respective object, a size of the respective object, a digital signature of the respective object, a number of the plurality of computing devices where the respective object is used, a number of the plurality of computing devices where the respective object is installed, a time at which the respective object first appears in the first network, flags for anti-malware scanning when the respective object was previously scanned by an anti-malware scanner.

8. A system for anti-malware scanning, the system comprising:
at least one hardware processor of a server configured to:
identify a plurality of objects in a backup archive that is connected to a first network comprising a plurality of computing devices;
scan the plurality of objects in the backup archive to generate a whitelist indicating a subset of the plurality of objects that do not need to be scanned at a subsequent time;
perform, using the whitelist, a first malware scan in a computing device of the plurality of computing devices;
detect that the computing device has left the first network to join a second network; and
perform a second malware scan on the computing device, wherein the second malware scan uses a different whitelist of the second network, and wherein the second malware scan comprises scanning a first object that is not in the different whitelist and was not scanned in the first malware scan due to being in the whitelist.

9. The system of claim 8 , wherein the whitelist further indicates respective hash values of objects in the subset.

10. The system of claim 8 , wherein the first malware scan comprises for each object of the computing device,
computing a hash value of the object,
determining whether the object is in the whitelist by comparing the hash value of the object with respective hash values of the objects identified in the whitelist, and
in response to determining that the object is in the whitelist, not scanning the object in the first malware scan.

11. The system of claim 8 , wherein the hardware processor is further configured to provide a result of the first malware scan to a provider of a protection service.

12. The system of claim 8 , wherein the hardware processor is further configured to scan the plurality of objects in the backup archive to generate the whitelist by:
for each respective object of the plurality of objects, scanning the respective object, obtaining metadata associated with the respective object, and storing the obtained metadata in a database.

13. The system of claim 12 , wherein the metadata associated with a respective object of the plurality of objects includes at least a parameter for storing a respective hash value of the respective object.

14. The system of claim 13 , wherein the metadata associated with the respective object of the plurality of objects further includes parameters for storing one or more of: a name of the respective object, a size of the respective object, a digital signature of the respective object, a number of the plurality of computing devices where the respective object is used, a number of the plurality of computing devices where the respective object is installed, a time at which the respective object first appears in the first network, flags for anti-malware scanning when the respective object was previously scanned by an anti-malware scanner.

15. A non-transitory computer readable medium storing thereon computer executable instructions for anti-malware scanning, comprising instructions for:
identifying a plurality of objects in a backup archive that is connected to a first network comprising a plurality of computing devices;
scanning the plurality of objects in the backup archive to generate a whitelist indicating a subset of the plurality of objects that do not need to be scanned at a subsequent time;
performing, using the whitelist, a first malware scan in a computing device of the plurality of computing devices;
detecting that the computing device has left the first network to join a second network; and
performing a second malware scan on the computing device, wherein the second malware scan uses a different whitelist of the second network, and wherein the second malware scan comprises scanning a first object that is not in the different whitelist and was not scanned in the first malware scan due to being in the whitelist.

16. The non-transitory computer readable medium of claim 15 , wherein the whitelist further indicates respective hash values of objects in the subset.

17. The non-transitory computer readable medium of claim 15 , wherein the first malware scan comprises for each object of the computing device,
computing a hash value of the object,
determining whether the object is in the whitelist by comparing the hash value of the object with respective hash values of the objects identified in the whitelist, and
in response to determining that the object is in the whitelist, not scanning the object in the first malware scan.

18. The non-transitory computer readable medium of claim 15 , further comprising instructions for providing a result of the first malware scan to a provider of a protection service.

19. The non-transitory computer readable medium of claim 15 , wherein the i

Assignees

• Acronis Int Gmbh

Inventors

• Gryaznov Dmitry
• Ishanov Oleg
• Strogov Vladimir
• Kulaga Andrey
• Kornachev Igor
• Protasov Stanislav
• Beloussov Serguei

Classifications

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/561

  Virus type analysis · CPC title

• G06F21/562

  Static detection · CPC title

• G06F21/568

  eliminating virus, restoring damaged files · CPC title

• G06F21/565 Primary

  by checking file integrity · CPC title