|
13th USENIX Security Symposium — Abstract
Pp. 73–88 of the Proceedings
Avfs: An On-Access Anti-Virus File System
Yevgeniy Miretskiy, Abhijith Das, Charles P. Wright, and Erez Zadok, Stony Brook University
Abstract
Viruses and other malicious programs are an ever-increasing threat to
current computer systems. They can cause serious damage and consume
countless hours of system administrators' time to combat.
Most current virus scanners perform scanning only when a file is
opened, closed, or executed. Such scanners are inefficient because
they scan more data than is needed.
Worse, scanning on close may detect a virus after it had already been
written to stable storage, opening a window for the virus to spread
before detection.
We developed Avfs, a true on-access anti-virus file system
that incrementally scans files and prevents infected data from being
committed to disk.
Avfs is a stackable file system and therefore can add virus detection
to any other file system: Ext3, NFS, etc.
Avfs supports forensic modes that can prevent a virus from reaching
the disk or automatically create versions of potentially infected files to
allow safe recovery. Avfs can also quarantine infected files on disk and isolate
them from user processes.
Avfs is based on the open-source ClamAV scan engine, which we
significantly enhanced for efficiency and scalability.
Whereas ClamAV's performance degrades linearly with the number of
signatures, our modified ClamAV scales logarithmically.
Our Linux prototype demonstrates an overhead of less than 15% for
normal user-like workloads.
- View the full text of this paper in HTML and PDF.
Until August 2005, you will need your USENIX membership identification in order to access the full papers. The Proceedings are published as a collective work, © 2004 by the USENIX Association. All Rights Reserved. Rights to individual papers remain with the author or the author's employer. Permission is granted for the noncommercial reproduction of the complete work for educational or research purposes. USENIX acknowledges all trademarks within this paper.
- If you need the latest Adobe Acrobat Reader, you can download it from Adobe's site.
|
Need help? Use our Contacts page.
