Abstract:
A scanning optimization manager scans files for malicious code. The scanning optimization manager creates listings of the portions of scanned files accessed during the scanning. The scanning optimization manager proceeds to utilize these listings of accessed portions of files as I/O hints to optimize subsequent scans of the files for malicious code.

Description:
TECHNICAL FIELD 
     This invention pertains generally to computer security, and more specifically to using input-output hints to efficiently scan files for malicious code. 
     BACKGROUND 
     The time required to scan files for malicious code is a significant performance issue for anti-malicious code software. Therefore, decreasing the amount of time required for such scanning would be highly desirable. When scanning a file for a specific malicious code signature, only a small percentage of the file actually needs to be examined to determine whether the file is infected with the malicious code. However, it is very difficult to predict in advance which portions of the file will need to be examined. Thus, a lot of time is spent reading the relevant portions of the file from media (e.g., a local or network hard disk) into dynamic memory as the file is being scanned. Because media input-output (I/O) is relatively slow, this process decreases the performance of anti-malicious code scanning significantly. 
     What is needed are computer implemented methods, computer readable media and computer systems for reducing the amount of time spent on I/O during anti-malicious code scanning. 
     DISCLOSURE OF INVENTION 
     Computer-implemented methods, computer systems and computer-readable media efficiently scan files. More specifically, a scanning optimization manager scans files for malicious code. The scanning optimization manager creates listings of the portions of scanned files accessed during the scanning. The scanning optimization manager proceeds to utilize these listings of accessed portions of files as I/O hints to optimize subsequent scans of the files for malicious code. In one embodiment of the present invention, the scanning optimization manager uses I/O hints to read only relevant portions of previously scanned files into dynamic memory from media prior subsequent scans of those files. In such an embodiment, the scanning optimization manager only scans the relevant portions of these files in dynamic memory. 
     The features and advantages described in this disclosure and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram illustrating a high level overview of a system for practicing some embodiments of the present invention. 
         FIG. 2  is a flowchart, illustrating steps for optimizing file scanning, according to some embodiments of the present invention. 
         FIG. 3  is a block diagram, illustrating using input-output hints to optimize the use of multithreading during file scanning, according to some embodiments of the present invention. 
         FIG. 4  is a block diagram, illustrating using input-output hints to optimize the storage of files, according to some embodiments of the present invention. 
     
    
    
     The Figures depict embodiments of the present invention for purposes of illustration only. One skilled in the art will readily recognize from the following discussion that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles of the invention described herein. 
     DETAILED DESCRIPTION 
       FIG. 1  illustrates a high level overview of a system  100  for practicing some embodiments of the present invention. A scanning optimization manager  101  optimizes the scanning of files  103  for malicious code by using previously compiled input-output hints  105 . It is to be understood that although the scanning optimization manager  101  is illustrated as a single entity, as the term is used herein a scanning optimization manager  101  refers to a collection of functionalities which can be implemented as software, hardware, firmware or any combination of these. Where a scanning optimization manager  101  is implemented as software, it can be implemented as a standalone program, but can also be implemented in other ways, for example as part of a larger program, as a plurality of separate programs, as one or more device drivers or as one or more statically or dynamically linked libraries. 
     As illustrated in  FIG. 1 , the scanning optimization manager  101  scans files  103  for malicious code. Typically, this involves looking for a signature that identifies a specific piece of malicious code (e.g., a known virus or worm). As explained above, this generally requires only examining a small percentage of the file  103 , but which portions need to be examined are difficult to predict ahead of time. Therefore, the first time that a scanning optimization manager  101  scans a specific file  103  looking for a malicious code signature, the scanning optimization manager  101  creates a listing  105  of the portions of the file  103  accessed during the scanning. This listing  105  can then be used by the scanning optimization manager  101  as a set of input-output hints  105  to optimize subsequent scans of that file  103  for malicious code. Knowing in advance which portions of a file  103  need to be examined allows the scanning optimization manager  101  to optimize the scan of the file  103  in various ways, as explained in detail below. 
     The specific format of the input-output hints  105  is a variable design parameter. For example, file system specific or generalized data indicating which portions of each file  103  were examined can be stored in a single file, individual entries for each scanned file  103  can be stored in a database or table, etc. Various options will be readily apparent to those of ordinary skill in the relevant art in light of this specification. 
     Once input-output hints  105  for a file  103  have been created, the scanning optimization manager  101  can use the hints  105  to optimize subsequent scans of that file  103 . In some embodiments, the scanning optimization manager  101  reads the relevant portions of the file  103  into dynamic memory from media prior to each subsequent scan of that file  103 . The scanning optimization manager  101  is thus able to scan only the relevant portions of the file  103  in dynamic memory, thereby eliminating the lengthy time overhead required to read the file portions to be examined from disk during a scan. 
     As illustrated in  FIG. 2 , knowing in advance which portions of a file  103  need to be examined during a scan enables various additional scanning optimizations. For example, in some embodiments of the present invention, the scanning optimization manager  101  utilizes the input-output hints  105  to perform some or all of the following scanning optimizations as desired. 
     The scanning optimization manager  101  can disable  201  operating system read-ahead during the subsequent scan of the file  103 . Because the scanning optimization manager  101  knows in advance which portions of the file  103  it will be reading, operating system read-ahead will not provide any benefit. Thus, the time and operating system resources required by read-ahead can be saved by disabling  201  this feature. 
     Additionally, the scanning optimization manager  101  can disable  203  input-output caching during subsequent scans of a file  103  for which input-output hints  105  are available. Because of the existence of the input-output hints  105 , the scanning optimization manager  101  will not benefit from a cached copy of the file  103 , and thus the overhead associated with caching can be saved as well. 
     Although scanning can be optimized by disabling  203  input-output caching during scanning generally, in some embodiments of the present invention, the scanning optimization manager  101  caches  205  only the accessed portions of a file  103  during an initial scan. Then, the scanning optimization manager  101  accesses  207  the cached portions of that file  103  during subsequent scans. This further optimizes the subsequent scans. 
     Furthermore, the scanning optimization manager  101  can use the input-output hints  105  to better sort  209  the relevant portions of the file  103  into disk order. More robustly sorting  209  the relevant portions of the file  103  into disk order further improves scanning efficiency. 
     Typically, the portions of a file  103  that need to be accessed when scanning for malicious code signatures do not change, even when the target signature changes. However, when the portions of a file  103  which are accessed during anti-malicious code scanning do change, the scanning optimization manager  101  updates  211  the associated input-output hints  105  responsive to the change. 
     As illustrated in  FIG. 3 , the input-output hints  105  also enable the scanning optimization manager  101  to execute efficient multi-threaded anti-malicious code scanning. In some embodiments of the present invention, the main thread  301  of the scanning optimization manager  101  launches a separate thread  303  (e.g., a child thread) to perform an optimized scan of a file  103  utilizing associated input-output hints  105 , as described above. While the separate thread  303  performs the compute-bound scan, the main thread  301  continues to process additional files  103  for malicious code scanning, for example by performing the input-output processing for the next file  103  to be scanned. Additional separate threads  303  can be launched to scan additional files  103  as desired. 
     Turning to  FIG. 4 , in some embodiments of the present invention the scanning optimization manager  101  also utilizes a listing  105  of accessed portions  401  of a file  103  to optimize the storing of that file  103  on a medium  403  (e.g., a disk). More specifically, the scanning optimization manager  101  can use the input-output hints  105  to fragment the file so as to store the accessed portions  401  of the file  103  contiguously on the disk  403 , and next to the portions of other files to be scanned. The portions of the files that are not accessed during scanning are stored elsewhere on the disk. This makes future access of these portions  401  faster. 
     As will be understood by those familiar with the art, the invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Likewise, the particular naming and division of the modules, managers, functions, layers, features, attributes, methodologies and other aspects are not mandatory or significant, and the mechanisms that implement the invention or its features may have different names, divisions and/or formats. Furthermore, as will be apparent to one of ordinary skill in the relevant art, the modules, managers, functions, layers, features, attributes, methodologies and other aspects of the invention can be implemented as software, hardware, firmware or any combination of the three. Of course, wherever a component of the present invention is implemented as software, the component can be implemented as a script, as a standalone program, as part of a larger program, as a plurality of separate scripts and/or programs, as a statically or dynamically linked library, as a kernel loadable module, as a device driver, and/or in every and any other way known now or in the future to those of skill in the art of computer programming. Additionally, the present invention is in no way limited to implementation in any specific programming language, or for any specific operating system or environment. Accordingly, the disclosure of the present invention is intended to be illustrative, but not limiting, of the scope of the invention, which is set forth in the following claims.