Malicious data scan service

Abstract

A communication network may scan data to identify and prevent the spread of malicious data, such as viruses, worms, trojans, malware, and the like, transmitted through the communication network. As scanning content for malicious data within an application program or an application node hosted on the communication network may limit the performance of the application program, a server in a load balanced datacenter environment may host a malicious data scan as a service. Accordingly, the malicious data scan service may scale effectively to accommodate an increasing number of application nodes in the network, and by retrieving updated definitions of malicious data at suitable times, the server may identify malicious data with increasing reliability.

What is claimed is: 
     
         1 . A distributed computing system, comprising:
 one or more memory structures storing instructions; and   one or more processors, that when executing the instructions,   implement a cloud platform comprising or in communication with one or more security servers, wherein the cloud platform is configured to;
 receive an upload of content from a client computing device to the cloud platform; 
 set a table field controlling availability of the content to a first state that prevents distribution of the content to a plurality of additional client computing devices remote from the cloud platform; 
 transmit a request to a load balancer to cause one or more security servers of a plurality of security servers to analyze the content to identify malicious data in the content, wherein the load balancer directs the request to a respective security server of the plurality of security servers based on one or more load balancing criteria; 
 receive a result of analyzing the content from the respective security server; and 
 in response to the result, updating the table field to a second state that makes available the content to the plurality of additional client computing devices remote from the cloud platform. 
   
     
     
         2 . The distributed computing system of  claim 1 , wherein the cloud platform comprises an application server configured to communicate with the one or more security servers. 
     
     
         3 . The distributed computing system of  claim 1 , wherein the one or more load balancing criteria comprises a count of additional client computing devices in use. 
     
     
         4 . The distributed computing system of  claim 3 , wherein the load balance is configured to direct the content to a recently activated security server of the one or more security servers based at least in part on the count. 
     
     
         5 . The distributed computing system of  claim 1 , wherein the first state comprises a pending state where the content is unavailable until the content is analyzed. 
     
     
         6 . The distributed computing system of  claim 1 , wherein the cloud platform is configured to transmit a message concerning the result of analyzing the content to the additional client computing devices. 
     
     
         7 . The distributed computing system of  claim 6 , wherein the cloud platform is configured to transmit the message in real-time to the additional client computing devices. 
     
     
         8 . The distributed computing system of  claim 1 , wherein the table field comprises a scan history, wherein the scan history comprises a set of entries indicating statuses of attachments uploaded to the cloud platform. 
     
     
         9 . The distributed computing system of  claim 8 , wherein the scan history is stored in a database separate from a database used to store the table field. 
     
     
         10 . A method to prevent intrusion from malicious data attached to a digital file, comprising:
 receiving, from a remote client computing device, a request to upload the digital file to a cloud platform;   determining availability of a service configured to detect the presence of malicious data in the digital file;   in response to determining that the service is available;   setting a table field controlling availability of the digital file to a first state that prohibits distribution of the digital file to additional client computing devices through the cloud platform; and   transmitting an additional request to a load balancer, wherein the load balancer directs the additional request to a security server based on one or more load balancing criteria, wherein the additional request comprises instructions configured to cause the respective security server to run the service on the digital file; and   receiving, at the cloud platform, a response from the security server, wherein the response is at least partially based on a result of running the service, wherein receiving the response causes the cloud platform to update the table field to a second state that specifies availability of the digital file to the additional remote client computing devices.   
     
     
         11 . The method of  claim 10 , wherein directing the additional request to the security server comprises bringing the security server online based at least in part on the one or more load balancing criteria. 
     
     
         12 . The method of  claim 10 , wherein the one or more load balancing criteria comprises a count of pieces of content being scanned. 
     
     
         13 . The method of  claim 10 , wherein the one or more load balancing criteria comprises a count of additional client computing devices in use. 
     
     
         14 . The method of  claim 10 , wherein, in response to the request, the cloud platform is configured to perform a check determining the availability of the digital file. 
     
     
         15 . The method of  claim 10 , wherein the cloud platform is configured to perform a quarantine on the digital file based at least in part on the response indicating that the digital file comprises a security vulnerability. 
     
     
         16 . Tangible, non-transitory, and computer-readable medium having instructions stored thereon, wherein the instructions, when executed by one or more processors, are configured to cause the one or more processors to:
 receive an upload of content from a client computing device to a cloud platform implemented using the one or more processors;   set a table field to a pending state to control availability of the content to prevent distribution of the content to a plurality of additional client computing devices communicatively coupled to the cloud platform;   transmit a request to a load balancer, wherein the request is to have the content analyzed by one or more security servers of a plurality of security servers to identify malicious content, and the load balancer is configured to transmit the request to the one or more security servers of the plurality of security servers based on one or more load balancing criteria;   receive a response from the one or more security servers; and   based on the response, update the table field to an available state that makes the content available to the plurality of additional client computing devices via the cloud platform.   
     
     
         17 . The tangible, non-transitory, and computer-readable medium of  claim 16 , wherein the instructions are configured to cause the one or more processors to implement an application server to implement an application node and to transmit the request to the load balancer. 
     
     
         18 . The tangible, non-transitory, and computer-readable medium of  claim 16 , wherein the one or more load balancing criteria comprises a count of application nodes in use in the cloud platform. 
     
     
         19 . The tangible, non-transitory, and computer-readable medium of  claim 16 , wherein the one or more load balancing criteria comprises a count of the additional client computing devices in use that are communicatively coupled to the cloud platform. 
     
     
         20 . The tangible, non-transitory, and computer-readable medium of  claim 16 , wherein the request comprises a check to determine the availability of the one or more security servers.