Access-Frequency Adaptive Scanning for Resource-Efficient Tamper Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional software tampering detection methods face challenges in reducing the possibility of executing illicitly tampered files while minimizing resource usage, with cyclic, random, and on-access scan methods either being inefficient or resource-intensive.
Innovation Solution
A tampering detection device that calculates the number of scanning times for each monitoring target file based on access frequency to determine an optimal scan pattern, reducing the likelihood of executing illicitly tampered files while conserving resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If cyclic scan method is used, then resource usage is reduced, but the time taken to scan all files becomes long, increasing the possibility of executing illicitly tampered files
Solution Approach 1:
The patent applies dynamics by making the scan pattern adaptive rather than static. The scan pattern is dynamically adjusted based on file access frequencies, allowing the system to prioritize scanning of frequently accessed files while reducing the scan frequency of less critical files. This dynamic adaptation resolves the contradiction by optimizing the balance between resource usage and scan coverage time.
Solution Approach 2:
The patent changes the parameter of scan frequency from a uniform fixed value to a variable value based on file access characteristics. By calculating access frequencies and assigning different scan intervals to different files, the system achieves both resource efficiency and timely detection of tampered files, resolving the time-resource tradeoff.
2Reliability
If random scan method is used, then file selection is unpredictable, but it may take an enormous amount of time to scan the same file again
Solution Approach 1:
The patent implements feedback by continuously monitoring file access frequencies and using this information to adjust the scan pattern. This feedback mechanism ensures that frequently accessed files (which are more likely to be tampered with) are scanned more often, while maintaining reasonable scan intervals for all files, thus resolving the contradiction between reliable coverage and excessive rescan time.
Solution Approach 2:
The patent performs preliminary analysis of file access patterns before determining the scan schedule. By pre-calculating access frequencies and establishing an optimized scan pattern in advance, the system avoids the inefficiency of random scanning while ensuring comprehensive coverage, thereby reducing the time to rescan files without compromising reliability.
3Reliability
If on-access scan method is used, then the possibility of executing illicitly tampered files is almost completely eliminated, but monitoring and file access hooking consume considerable memory and CPU resources
Solution Approach 1:
The patent applies partial action by implementing selective monitoring rather than comprehensive on-access scanning. Instead of monitoring every file access event, the system monitors only those files that have been identified as having high access frequencies or high risk profiles. This partial monitoring approach maintains high detection reliability while significantly reducing the complexity and resource consumption associated with full on-access scanning.
Data Source
AI summary
A tampering detection device includes tampering detection circuitry configured to acquire an access frequency of a monitoring target file, calculate a number of times of scanning in a scan pattern for each monitoring target file on a basis of the access frequency acquired, and determine the scan pattern on a basis of the number of times of scanning calculated.