Method of speeding up a full antivirus scan of files on a mobile device

Systems and methods for performing a repeat antivirus scan of a file are disclosed. A local database is saved on a mobile device, where each record is added to the database when the corresponding file is recognized as being non-malicious as a result of an antivirus scan. A short hash sum of the file is computed and the long hash sum of the file and information about the antivirus scan performed and corresponding to the first hash sum of the file are found in the aforementioned database. Using the long hash sum, a verdict on the file is requested from the cloud services. An antivirus scan of the file is performed, except when the verdict obtained is unchanged (as compared to the verdict contained in the information about the antivirus scan performed of the obtained record corresponding to the file), and no updating of the antivirus databases has occurred since the date of performing the antivirus scan.

CROSS REFERENCE TO RELATED APPLICATIONS

The present application claims priority to Russian Patent Application No. 2019111143, filed on Apr. 15, 2019, the entire content of which is incorporated herein by reference.

FIELD OF TECHNOLOGY

The present disclosure relates to antivirus technologies, and more specifically to methods of selective performance of a repeat antivirus scan of archive files on a mobile device.

BACKGROUND

At present, mobile devices—smartphones, tablets, and so forth—have become a mandatory accessory of almost every person. With the aid of such devices, people perform a multitude of everyday tasks: from communicating by email to paying for purchases in shops. The widespread use of such devices is motivating criminals to create malicious programs—programs designed for unlawful access to user data, and also to the resources of mobile devices as a whole.

At present, antivirus software and services are widely used to combat malicious programs. These antivirus software and services are programs designed to protect computing devices against malicious programs. Different approaches and technologies are used to provide such protection: signature analysis, behavioral analysis, heuristic rules, and so forth. The performance of a full antivirus scan of a mobile device is a resource-hungry operation. Regular full antivirus scans result in rapid discharging of the battery of the mobile device, which in turn has a negative impact on the perception of antivirus products by users. On Android devices, because of the specifics of the OS, the majority of the files being scanned are archives in ZIP format. Unpacking the archives and checking the objects embedded in the archives takes up the vast majority of the total scan time. Thus, there is a need to develop antivirus technologies to optimize the consumption of resources when performing repeated antivirus scans on a mobile device. The use of the proposed technology makes it possible to both shorten the time for repeat scans of archive files and reduce the overall consumption of electricity on Android devices.

SUMMARY

The present disclosure is designed for the selective performance of a repeat antivirus scan of files. The technical result of the present disclosure is to reduce the consumption of resources of a mobile device when performing repeat antivirus scans of files. Yet another technical result of the present disclosure is to shorten the time for repeat antivirus scans of files.

In one aspect, a method of performing a repeat antivirus scan of a file is realized, and realized with the aid of a computing device, wherein: (a) the local database for files is saved, where each record is added to the database when the corresponding file is recognized as being not malicious as a result of the antivirus scan, and contains the first hash sum of the file, the second hash sum of the file, and information about the antivirus scan performed, which includes at least the date of the performance of the antivirus scan of the file and the verdict from cloud services; (b) the first hash sum of the file is computed and the second hash sum of the file and information about the antivirus scan performed, corresponding to the first hash sum of the file is found in said database; (c) using the second hash sum of the file, a verdict on the file is requested from cloud services; and (d) an antivirus scan of the file is always performed, except when the verdict obtained is unchanged, and no updating of the antivirus databases has occurred since the date of the performance of the antivirus scan.

In another aspect, the computing device is a mobile device.

In yet another aspect, the file is an archive file.

In another aspect, the antivirus scan of the file includes one or more of signature analysis of the file and heuristic analysis of the file.

In another aspect, the antivirus scan of the file includes one or a combination of requesting a verdict on the file from cloud services and an antivirus scan.

In another aspect, the verdict on the file from cloud services is one of the following: a malicious file; a non-malicious file; an unknown file.

In yet another aspect, the cloud services include: regularly updated knowledge databases on the reputation of files, databases of malicious files, and databases of trusted files.

In another aspect, the first hash sum is computed from part of the content of the file.

In another aspect, the second hash sum is computed from the entire content of the file.

In yet another aspect, the time to calculate the first hash sum of the file is less than the time to calculate the second hash sum of the file.

In one aspect, a computer-implemented method for performing a repeat antivirus scan of a file is provided. The method includes adding, to a local database on a computing device, a record for a corresponding file in response to determining that the corresponding file is not malicious based on a previous antivirus scan. The record includes a first hash sum of the file, a second hash sum of the file, and information about the antivirus scan performed including at least a date of performance of the previous antivirus scan of the file and a verdict from cloud services. The method further includes performing a repeat antivirus scan of the file by calculating the first hash sum of the file; retrieving, using the calculated first hash sum of the file, the second hash sum of the file and information about the previous antivirus scan performed, from the local database of the computing device; requesting from the cloud services, a verdict on the file using the second hash sum of the file; and refraining from performing the repeat antivirus scan of the file in response to determining that the verdict obtained is unchanged and that no updates to antivirus databases has occurred since the date of the performance of the previous antivirus scan; otherwise, performing the repeat antivirus scan of the file.

In another aspect, a system for performing a repeat antivirus scan of a file is provided. The system includes a memory device configured to store a local database, wherein the local database comprises a record for a corresponding file added in response to determining that the corresponding file is not malicious based on a previous antivirus scan, wherein the record comprises a first hash sum of the file, a second hash sum of the file, and information about the antivirus scan performed including at least a date of performance of the previous antivirus scan of the file and a verdict from cloud services. The system further includes a hardware processor communicatively coupled to the memory device. The processor is configured to performing a repeat antivirus scan of the file by calculate the first hash sum of the file; retrieve, using the calculated first hash sum of the file, the second hash sum of the file and information about the previous antivirus scan performed, from the local database of the computing device; request from the cloud services, a verdict on the file using the second hash sum of the file; and refrain from performing the repeat antivirus scan of the file in response to determining that the verdict obtained is unchanged and that no updates to antivirus databases has occurred since the date of the performance of the previous antivirus scan; otherwise, perform the repeat antivirus scan of the file.

According to another aspect, a computer-readable medium is provided comprising instructions that comprises computer executable instructions for performing any of the methods disclosed herein.

DETAILED DESCRIPTION

A number of definitions and concepts which will be used in the description of variant embodiments of the present disclosure are described as follows.

Hashing is a transformation of an array of input data of arbitrary length into an (output) bit string of definite length, performed by a particular algorithm.

A hash function (or convolution function) is a function incorporating a hashing algorithm and performing the transformation.

A hash code (or hash sum, convolution) is the result of a hashing. A hash code is generally written in hexadecimal form. Thus, for a certain given file the value of the MD5 hash function will be a string of 32 hexadecimal digits, such as 026f8e459c8f89ef75fa7a78265a0025. For the CRC32 hash function, the hash code will be F6DE2FEA, and for SHA-1 the hash code will be 7DD987F846400079F4B03C058365A4869047B4A0.

A malicious application is an application capable of doing harm to a computer or to the data of the computer's user (in other words, a computer system, such as the one depicted inFIG. 4), for example: an Internet worm, a keylogger, a computer virus. The harm done might be unlawful or unauthorized access to the resources of the computer, including the data saved on the computer, for the purpose of stealing it, and also unlawful use of the resources, including those for storing data, performing computations, and so forth.

A trusted application (a non-malicious application) is an application which does not do harm to a computer or to its user. A trusted application may be considered to be an application developed by a trusted software manufacturer, downloaded from a trusted source (such as a site entered in a database of trusted sites), or an application whose identifier (or other data by which the application may be uniquely identified, such as the hash sum of the application file) is kept in a database of trusted applications. The identifier of the manufacturer, such as a digital certificate, may also be kept in the database of trusted applications.

A non-trusted application (unknown application) is an application which is not trusted, but neither is it recognized as being malicious, for example, with the aid of an antivirus application. Furthermore, a non-trusted application may afterwards be recognized as being malicious, for example, with the aid of an antivirus scan.

A malicious file is a file which is a component of a malicious application and contains program code (executable or interpretable code).

A non-trusted file (unknown file) is a file which is a component of a non-trusted application and contains program code (executable or interpretable code).

A trusted file (non-malicious file) is a file which is a component of a trusted application.

An archive file is a specially organized file, containing one or more files in compressed or non-compressed form and service information as to the names of the files, the date and time of their creation or modification, their size, and so forth.

FIG. 1shows the structure of an archive file110according to aspects of the present disclosure. For purposes of discussion, the archive file110may be formatted as an Android Package (APK) file for the Android operating system (OS), but it is understood that aspects of the present disclosure may be applied to other types of file formats, including formats for packaging, distributing, and installing of applications on a computing device. Distributions for the Android OS are provided in the form of executable archive APK (Android Package) files. Each Android application is compiled and packaged in a single file, which includes the entire code of the application (DEX files), the resources and the .manifest file, as well as the CERT.RSA—the certificate with which the application is signed—and CERT.SF—file information about the resources and the certificate. Files of APK format are not encrypted; they are a subset of ZIP archive format. Each APK file is a compressed archive for execution by a virtual machine (such as DalvikVM), which may be installed not just on the Android operating system.

In one aspect, each ZIP archive110(and consequently APK file) contains a so-called “central directory”120, which comes at the end of the archive to make possible the adding of new files to the archive. This directory contains a list of the records125(names of files and directories) appearing in the archive, as well as the headers of the records. Each header within the central directory may contain, for the file(s) contained within the archive: the size (of a file within the archive) after compression; the size before compression; the length of the file name (of a file within the archive110); the size of additional data on the file; the size of the commentary on the file; the disk number where the file begins; the relative offset to the local file header (the number of bytes from the start of the disk, where the file begins, to the local header for the file); the file name; additional data about the file; and the commentary on the file.

In one aspect, the central directory120ends with an end record126(end of central directory or “EOCD” record), which may contain: the number of the current disk; the number of the disk where the central directory begins; the number of records in the central directory on this disk; the total number of records in the central directory; the size of the central directory; the offset to the central directory relative to the start of the archive; the size of the commentary; and the commentary.

Thus, after the reading and analysis of the central directory, it is possible to gain access directly to the compressed data of any record140(to the compressed files) stored in the central directory by the offset as described in the header. The data of the record also starts from the local file header141. The local file header partly includes information which is contained in the central directory, namely: the size (of the corresponding file within the archive) after compression; the size before compression; the length of the file name; the size of additional data on the file; the file name; and additional data about the file. In a record140, the compressed file data142begins (i.e., is arranged) immediately after the corresponding header141. The data of the records inside the archive110may be saved in an order different from their sequence within the central directory.

In order to speed up repeat antivirus scans of archive files in the context of the present disclosure, a pair of “long”/“short” hash codes is used, which are saved in a local database together with information about a previously performed antivirus scan.

In one aspect, the “short” hash code (or first hash sum) is a hash code computed solely from part of an archive file (for example, from the entire central directory120or any portion thereof), while the computing of the “short” hash code may also make use of meta-information about the archive file110, such as the time of creation/access/modification of the archive file110, the corresponding digital certificate, the verification hash codes for the embedded objects140, and so forth.

In one aspect, the “long” hash code (or second hash sum) is a hash code computed from the entire contents of an archive file110. It is understood that the time for its computation is significantly longer (by orders of magnitude for large archive files) than the time to compute the “short” hash code.

FIG. 2presents a system for performing a repeat antivirus scan of an archive file110(hereinafter in the text, a file110) in the framework of the present disclosure. In the general case, the described system includes a computing device (such as the computer shown inFIG. 4, or a particular variant of a general-purpose computer—a mobile device200), containing: at least one processor; network access means, interacting with at least one processor; and an information storage medium, containing an operating system (such as the Android OS), as well as a set of instructions, upon the execution of which on at least one processor the method of performing a repeat antivirus scan of a file110is realized.

In a particular variant, the system designed to realize the method of performing a repeat antivirus scan of a file110includes: a mobile device200, containing a security module210, a database220and antivirus databases230, and cloud services240.

The cloud services240may include: regularly updated knowledge databases on the reputation of files (such as KSN or Kaspersky Security Network), databases of malicious files (so-called “black lists”), and databases of trusted files (“white lists”). The cloud services240allow the security module210to obtain one of the following verdicts on the hash code of the file110: malicious file, non-malicious file (if the file110is a trusted file), and unknown file.

In one aspect, the security module210is a security application (such as an antivirus application), installed on the operating system of the mobile device200. The security module is designed to perform an antivirus scan of the file110.

The antivirus scan of the file110includes a complex of security measures intended to determine whether the file110is a malicious file. In one aspect, the antivirus scan of the file110involves requesting a verdict on the file110from the cloud services240and an antivirus scan of the file110. In one aspect, the requesting of a verdict is performed by sending with the aid of the security module210the “long” hash code of the file110to the cloud services240. The antivirus scan of the file110involves at least two methods for analysis of the content of a file110: signature analysis of the file110and heuristic analysis of the file110. Signature analysis involves searching for correspondences of any section of code of the application being analyzed or a component thereof to known code (a signature) from a database of signatures of malicious applications and their components. Heuristic analysis involves emulating the working of the applications being analyzed and their components, creating emulation logs (containing data on API function calls, parameters sent, sections of code of the applications being analyzed, and so forth) and searching for correspondences between the data of the logs created and the data from a database of behavioral signatures of malicious applications and their components.

The antivirus databases230contain regularly updated databases of signatures of malicious applications and their components which are used by the security module210to perform the aforementioned signature analysis, as well as databases of behavioral signatures of malicious applications and their components which are used by the security module210to perform the aforementioned heuristic analysis. In one aspect, the antivirus databases230contain information about the date of each update.

The database220is designed to save the information obtained from the security module210. The database consists of records, each of which is added to the database when the corresponding file (such as the file110) is recognized as being non-malicious as a result of an antivirus scan, and it contains information identifying the file (the pair of “long”/“short” hash codes), as well as information about the antivirus scan performed, which includes at least the date of the performance of the antivirus scan of the file and the verdict on the file obtained from the cloud services240. Since the time to compute the “short” hash code of the file is less than the time to compute the “long” hash code of the file, the “short” hash code is used by the security module210for quick access to the information from the database220, and the “long” hash code of the file is used by the security module210when conducting an antivirus scan.

The dates of the updating of the antivirus databases and the dates of the performance of an antivirus scan of the files are time markers containing information about the time of occurrence of the aforementioned events with the necessary accuracy for the realization of aspects of the present disclosure.

The above-described variants of the system (the general and the particular variant) make it possible to carry out in the context of the present disclosure the following methods, which will be described in detail below: a method of performing a repeat antivirus scan of a file and a method of partial resetting of the results of a previous antivirus scan of files.

The method of performing a repeat antivirus scan of a file101that is realized with the aid of the systems described above includes steps during which the following occurs. A local database220is saved on a mobile device200, where each record is added to the database220when the corresponding file (the file110) is recognized as being non-malicious as a result of an antivirus scan with the aid of module210, and contains the first hash sum of the file110, the second hash sum of the file110, and information about the antivirus scan performed, which includes at least the date of the performance of the antivirus scan of the file and the verdict from cloud services240. The first hash sum of the file110is computed and the second hash sum of the file110and information about the antivirus scan performed and corresponding to the first hash sum of the file110is found in the aforementioned database. Using the second hash sum of the file110, a verdict on the file110is requested from the cloud services240. An antivirus scan of the file110is performed with the aid of the security module210, except when the verdict obtained is unchanged (as compared to the verdict contained in the information about the antivirus scan performed of the obtained record corresponding to the file110), and no updating of the antivirus databases has occurred since the date of performing the antivirus scan (which is verified by the security module210by comparing that date of the antivirus scan of the file110to the date of the last updating of the antivirus databases230).

According to an aspect, a method of partial resetting of the results of a previous antivirus scan of files is provided, where files without information about an antivirus scan performed by a security module210contained in a database220are again subjected to an antivirus scan with the aid of the security module210. In such a method of partial resetting, the following steps may be involved. A local database220is saved on a mobile device200, where each record is added to the database220when the corresponding file is recognized as being non-malicious as a result of an antivirus scan with the aid of the module210, and contains information identifying the file, and information about the antivirus scan performed, which includes at least the date of the performance of the antivirus scan of the file. With the aid of the security module210, a threshold is set for resetting of the records (or a remotely established threshold is obtained with the aid of the security module210, for example one computed in accordance with a particular user profile). After updating the antivirus databases230, with the aid of the security module210, an estimate is made of the probability of resetting the results of the previous antivirus scan for each record from the database220. In some aspects, the estimate will be higher as more time has passed since the aforementioned date of the performance of the antivirus scan of the corresponding file, and the more updates of the antivirus databases have occurred since the aforementioned date of the performance of the antivirus scan of the corresponding file (being computed by the security module210based on information from the antivirus databases230on the dates of all updates). With the aid of the security module210those records for which the aforementioned estimate of the probability of a reset exceeds the established threshold for resetting of the records are removed from the database220.

In one aspect, the threshold is a certain numerical value, such as one from 0 to 100. The lower the threshold value, the more records will be removed from the database220after the security module210performs the aforementioned estimate of the probability of resetting the results of the previous antivirus scans. The threshold may be dynamically changed by the security module210. In another aspect, the threshold may be determined remotely and sent to the security module210.

FIG. 3is a flowchart illustrating a method300for performing a repeat antivirus scan of a file according to an exemplary aspect. It is noted that the following description of the exemplary method makes reference to the system and components described above. In some aspects, the computing device is a mobile device, and the file is an archive file comprised of a plurality of files in compressed form and a central directory portion.

The method300begins at step302, in which records are added to a local database on a computing device200for files. In one aspect, a record for a corresponding file in response to determining that the corresponding file is not malicious based on a previous antivirus scan. In some aspects, a record may include a first hash sum of the file, a second hash sum of the file, and information about the antivirus scan performed including at least a date of performance of the previous antivirus scan of the file and a verdict from cloud services.

At step304, the security module210may calculate the first hash sum of the file. In some aspects, the first hash sum is computed from a portion of content of the file (in contrast to the second hash sum being computed from an entirety of the content of the file.) In aspects in which the file is an archive file, the first hash sum is computed as a “short” hash sum derived from the central directory portion of the archive file, in contrast to the second “long” hash sum is computed from an entirety of the content of the archive file. In some aspects, a time to calculate the first hash sum of the file is less than a time to calculate the second hash sum of the file.

At step306, the security module210may retrieve, using the calculated first hash sum of the file, the second hash sum of the file and information about the previous antivirus scan performed, from the local database of the computing device. At step308, the security module210may request from the cloud services, a verdict on the file using the second hash sum of the file. In some aspects, the verdict on the file from cloud services is one of the following: a malicious file; a non-malicious file; an unknown file. In some aspects, the cloud services includes regularly updated knowledge databases on the reputation of files, databases of malicious files, and databases of trusted files.

At step309, the security module210may determine whether the verdict obtained is unchanged and that no updates to antivirus databases has occurred since the date of the performance of the previous antivirus scan. If so, at step310, the security module210may refrain from performing the repeat antivirus scan of the file (and rather, rely on the prior verdict and results of the previous antivirus scans) in response to determining that the verdict obtained is unchanged and that no updates to antivirus databases has occurred since the date of the performance of the previous antivirus scan. Otherwise, at step312, the security module210may perform the repeat antivirus scan. In some aspects, the antivirus scan of the file includes one or more of signature analysis of the file and heuristic analysis of the file. In some aspects, the antivirus scan of the file includes one or a combination of requesting a verdict on the file from the cloud services and an antivirus scan by a security module executing on the computing device.

In some aspects, the security module210may perform a partial resetting results of previous antivirus scans of files. The resetting may include determining, for each record in the local database, an estimated probability that the corresponding result of the previous antivirus scans should be reset; and removing records from the local database having a corresponding estimated probability that exceeds a pre-determined reset-record threshold. In some aspects, the estimated probability is determined to be higher based on more time passing since the corresponding date of the performance of the previous antivirus scan of the corresponding file, and the more updates of the antivirus databases have occurred since the corresponding date of the performance of the pervious antivirus scan of the corresponding file.

FIG. 4is a block diagram illustrating a computer system20on which aspects of systems and methods for performing a repeat antivirus scan of a file may be implemented in accordance with an exemplary aspect. It should be noted that the computer system20can correspond to mobile device200, for example, described earlier. The computer system20can be in the form of multiple computing devices, or in the form of a single computing device, for example, a desktop computer, a notebook computer, a laptop computer, a mobile computing device, a smart phone, a tablet computer, a server, a mainframe, an embedded device, and other forms of computing devices.

The computer system20may include one or more storage devices such as one or more removable storage devices27, one or more non-removable storage devices28, or a combination thereof. The one or more removable storage devices27and non-removable storage devices28are connected to the system bus23via a storage interface32. In an aspect, the storage devices and the corresponding computer-readable storage media are power-independent modules for the storage of computer instructions, data structures, program modules, and other data of the computer system20. The system memory22, removable storage devices27, and non-removable storage devices28may use a variety of computer-readable storage media. Examples of computer-readable storage media include machine memory such as cache, static random access memory (SRAM), dynamic random access memory (DRAM), zero capacitor RAM, twin transistor RAM, enhanced dynamic random access memory (eDRAM), extended data output random access memory (EDO RAM), double data rate random access memory (DDR RAM), electrically erasable programmable read-only memory (EEPROM), NRAM, resistive random access memory (RRAM), silicon-oxide-nitride-silicon (SONOS) based memory, phase-change random access memory (PRAM); flash memory or other memory technology such as in solid state drives (SSDs) or flash drives; magnetic cassettes, magnetic tape, and magnetic disk storage such as in hard disk drives or floppy disks; optical storage such as in compact disks (CD-ROM) or digital versatile disks (DVDs); and any other medium which may be used to store the desired data and which can be accessed by the computer system20.