Anti-Malware Filter Driver I/O Priority Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-malware scanners significantly slow down file access and writing processes by scanning files sequentially, causing inconvenience and inefficiency, as they block other processes until a file is scanned, leading to substantial delays in copying and saving files.
Innovation Solution
A method and system that prioritize I/O operations by assigning a low priority to file scanning requests, delaying access to files until higher-priority operations are completed, and using an anti-malware filter driver to prevent access to unscanned files, allowing parallel processing and scanning of files in cache memory without interfering with other applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If files are scanned sequentially for malware, then malware detection is performed, but file access speed and system productivity are significantly reduced
Solution Approach 1:
The patent segments the file scanning process into two distinct paths: a fast path for files marked as clean or exempt from scanning, and a slow path for files requiring full malware analysis. This segmentation allows the system to maintain high file access speeds for the majority of files while still performing thorough scanning when necessary, thereby resolving the contradiction between malware detection reliability and file access productivity.
Solution Approach 2:
The patent implements preliminary actions by marking files as clean before they are actually scanned, and by pre-configuring the scanning system to automatically skip already-scanned or known-safe files. This preliminary classification allows files to be accessed immediately without blocking, while the scanning infrastructure remains in place to perform thorough analysis when needed, thus maintaining both speed and security.
2Reliability
If the scanner blocks the writing thread until scanning is complete, then malware is detected, but time to save files is substantially increased
Solution Approach 1:
The patent applies preliminary action by marking files as clean before scanning occurs and by allowing the writing thread to complete without blocking. The system pre-configures the scanning mechanism to operate independently, so that files are not blocked during scanning. This enables the writing thread to finish quickly while the scanning thread performs malware detection in parallel, significantly reducing the time loss while maintaining detection reliability.
Solution Approach 2:
The patent introduces dynamic control over the scanning process, allowing it to adapt its behavior based on file status and system conditions. The scanner can dynamically switch between blocking and non-blocking modes, and can dynamically adjust scanning depth based on file markings. This dynamic approach enables the system to maintain fast file saving times while still performing thorough malware detection when necessary.
3Reliability
If scanning is performed on every file, then malware detection coverage is maximized, but processing overhead and system resource consumption increase
Solution Approach 1:
The patent applies local quality by treating different files differently based on their specific characteristics and scanning history. Files marked as clean or known to be safe are processed with minimal or no scanning overhead, while files that are new, modified, or unmarked undergo full scanning. This localized differentiation maintains comprehensive malware detection coverage for suspicious files while significantly reducing processing overhead for benign files.
Solution Approach 2:
The patent implements preliminary action by pre-marking files as clean before scanning occurs and by maintaining a database of previously scanned and verified files. This preliminary classification allows the system to maximize malware detection coverage for files that need scanning while avoiding redundant scanning of safe files, thereby reducing overall processing overhead and system resource consumption.
4Reliability
If the scanner processes files one at a time, then scanning accuracy is maintained, but user convenience and system responsiveness are reduced
Solution Approach 1:
The patent introduces dynamic control over the scanning process, allowing it to adapt its behavior based on file status and system conditions. The scanner can dynamically switch between sequential and parallel processing modes, and can dynamically adjust scanning depth based on file markings. This dynamic approach maintains scanning accuracy for critical files while enabling parallel processing for less critical files, thereby improving user convenience and system responsiveness without sacrificing security.
Solution Approach 2:
The patent segments the file processing workload into distinct categories: files requiring full sequential scanning for accuracy, and files that can be processed in parallel or skipped based on markings. This segmentation allows the system to maintain scanning accuracy for files that need it most while processing other files concurrently, thereby improving user convenience and system responsiveness without compromising security.
Data Source
AI summary
Systems, methods and non-transitory, tangible computer readable storage mediums encoded with processor readable instructions to scan files for malware are disclosed. An exemplary method includes writing, via a communication pathway, a first file to a storage medium that is utilized by the computer, requesting access to the first file so as to enable the first file to be scanned for malware, and delaying, when the first file resides on the storage medium, access to the first file while there is at least one I/O operation relative to the storage medium that has a higher priority level than a priority level of the request to access the first file. In addition, except to enable the first file to be scanned for malware, access to the first file is prevented until the first file has been scanned for malware.