Avfs: An On-Access Anti-Virus File System

Viruses and other malicious programs are an everincreasing threat to current computer systems. They can cause serious damage and consume countless hours of system administrators' time to combat. Most current virus scanners perform scanning only when a file is opened, closed, or executed. Such scanners are inefficient because they scan more data than is needed. Worse, scanning on close may detect a virus after it had already been written to stable storage, opening a window for the virus to spread before detection. We developed Avfs, a true on-access anti-virus file system that incrementally scans files and prevents infected data from being committed to disk. Avfs is a stackable file system and therefore can add virus detection to any other file system: Ext3, NFS, etc. Avfs supports forensic modes that can prevent a virus from reaching the disk or automatically create versions of potentially infected files to allow safe recovery. Avfs can also quarantine infected files on disk and ...

• Type: Conference
• Year: 2004
• Where: USS
• Authors: Yevgeniy Miretskiy, Abhijith Das, Charles P. Wright, Erez Zadok
• Keywords: Current Virus Scanners, File System, Operating System, USS 2004, Virus