419 to operate seamlessly in the background within a guest operating system without causing any discernible impact on the operation of storage system 133. This in effect offloads performance hits caused by traditional host-based malware detectors. As is well known, the execution of malware detectors on host devices reduces the performance of the host devices because they tend to have less robust processing capabilities than the storage processors in a storage system.

In another aspect, the embedded malware detector 419 is fortified against traditional attack vectors, which renders it resistant to common security threats. In some respects, a snapshot of a storage device that is scanned by malware detector 419 may be mounted in the guest OS 418 with read-only privileges, which prevents any malware that is present in the snapshot from being executed and/or disabling the malware detector 419.

In yet another aspect, malware detector 419 may be able to scan any identifiable volume filesystem, irrespective of the type of operating system that is used to implement guest OS 418. Being operating-system-agnostic allows detector 419 to operate efficiently across diverse environments, which in turn makes it a more economical solution for detecting malware compared to traditional methods. In yet another aspect, using malware detector 419 minimizes the need for extensive data traffic that would need to occur if a storage device 135 were to be scanned by malware detection software that is executed on a host device, such as any of the computing devices 130.

FIG. 5 is a flowchart of an example of a process 500, according to aspects of the disclosure. According to the example of FIG. 5, process 500 is executed by detector 419. However, the present disclosure is not limited to any specific entity or set of entities executing process 500.

At step 502, detector 419 requests list 139 from the management system 132. As noted above, list 139 may include identifiers of those ones of storage devices 135 that are desired to be scanned by detector 419.

At step 504, detector 419 receives the list 139 from the management system 132.

At step 506, detector 419 selects one of the storage devices 135 in the list 139, which has not been selected before during a previous iteration of steps 506-524.

At step 508, detector 419 requests a snapshot of the selected storage device 135. According to the present example, requesting the snapshot request may include generating a snapshot request that includes the identifier of the selected storage device and transmitting the snapshot request to management system 132. In another example, requesting the snapshot may include placing an API call for the creation of the snapshot which includes the identifier of the selected storage device 135 as one of its parameters. The API call may be executed by the management system 132 and/or one of the storage processors in storage system 133.

At step 509, detector 419 receives the snapshot. According to the present example, receiving the snapshot includes receiving a link to the snapshot. However, alternative implementations are possible in which the snapshot itself is received.

At step 510, detector 419 mounts the snapshot in the instance of the guest OS that is executing detector 419 (e.g., guest OS 418 that is shown in FIG. 4). In some implementations, mounting the snapshot may include discovering a filesystem of the snapshot (or the device 135 that is selected at step 506) and executing a mount command. After the snapshot is mounted, the snapshot appears as another volume that is available in the guest OS. Additionally or alternatively, in some implementations, upon discovering the file system, detector 419 may determine whether the file system is supported by guest OS 418. If the file system is supported, detector 419 may mount the snapshot in guest OS 418. Otherwise, if the file system is not supported, detector 419 may output an error after which process 500 may proceed to step 524. In some implementations, the file system of the snapshot (or the storage device 135 that is selected at step 506) may be determined by examining metadata associated with the snapshot or in any other suitable manner.

At step 512, detector 419 scans the mounted snapshot. In instances in which detector 419 includes the manager 441 and antivirus software 443, scanning the mounted snapshot may include: (i) providing, by manager 441, antivirus software 443 with an instruction to perform a scan of the snapshot, (ii) performing, by antivirus software 443, the scan in response to the instruction, and (iii) returning, by antivirus software 443 to manager 441, an indication of the outcome of the scan.

At step 514, detector 419 determines if any malware has been detected as a result of the scan. In instances in which detector 419 includes the manager 441 and antivirus software 443, manager 441 may process the indication of the outcome of the scan that is provided by antivirus software 443 to determine if antivirus software 443 has detected any malware on the mounted snapshot. If malware has been detected, process 500 proceeds to step 516. Otherwise, if no malware is detected, process 500 proceeds to step 520.

At step 516, detector 419 preserves the snapshot (received at step 509). In some implementations, “preserving the snapshot” may include leaving the snapshot as is, without deleting it. Additionally or alternatively, in some implementations, preserving the snapshot may include transmitting to management system 132 an instruction to keep the snapshot in storage indefinitely (or until further notice). In some respects, preserving the snapshot may include taking any action that would permit the snapshot to remain available for further analysis by security experts.

At step 518, detector 419 outputs for presentation to a user an indication that malware has been detected. Outputting the indication may include displaying the indication on a display device, transmitting the indication over a communications network to a remote device, or storing the indication in a database or another similar location. In some implementations, the indication that is output may include any information that is reported by the antivirus software 443, such as an identifier of the malware or identifiers of files that are infected. Additionally or alternatively, the indication may include or more of an identifier of the storage device 135 (selected at step 506), an identifier of the snapshot (received at step 509), and/or an indication of the storage location where the snapshot is stored. As used herein, the term “snapshot identifier” shall refer to any number, string, or alphanumerical string that identifies a snapshot of a storage device uniquely from other snapshots of the same storage device.

At step 520, detector 419 discards the snapshot (received at step 509). In some implementations, “discarding the snapshot” may include leaving the snapshot as is, thus allowing the snapshot to be deleted by default (by management system