Anti-malware Metadata Lookup Prioritization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional antivirus and antispyware solutions face challenges with large anti-malware signature databases, which increase disk footprint and delay application access due to server-side lookups, necessitating improved systems and methods for prioritizing anti-malware metadata lookups.
Innovation Solution
The system predicts when anti-malware metadata is needed and prioritizes its lookup by identifying executable objects likely to be executed, assessing their imminence, and retrieving anti-malware metadata in advance to minimize latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-malware signature databases are stored locally on client devices, then scan accuracy and threat detection capability are improved, but disk footprint increases
Solution Approach 1:
The patent extracts the anti-malware signature database from local client storage and relocates it to remote server storage. The system maintains full threat detection capability by performing server-side lookups, while client devices only store minimal local cache data, thereby resolving the contradiction between comprehensive threat detection and limited local storage requirements
Solution Approach 2:
The patent introduces a server-side lookup mechanism as an intermediary between the client device and the anti-malware signature database. This intermediary enables comprehensive threat detection by providing on-demand access to complete signature databases, while eliminating the need for clients to maintain large local copies of the database
2Weight of moving object
If server-side lookups are used to reduce local storage requirements, then disk footprint is reduced, but application access time increases due to lookup delays
Solution Approach 1:
The patent applies preliminary action by performing server-side anti-malware lookups in advance, before the user actually launches the application. The system proactively checks executable files against the signature database and caches the results locally, so that when the user launches the application, the security check has already been completed or is readily available, thereby eliminating perceived delays
Solution Approach 2:
The patent implements dynamic prioritization where the system continuously monitors and adjusts the priority of different executable files based on their likelihood of being launched. Frequently executed files are scanned and cached first, while less common files are checked on-demand, creating a dynamic adaptation that optimizes both storage usage and access speed
3Reliability
If all executable files are scanned before execution, then security reliability is improved, but system performance and user experience deteriorate due to latency
Solution Approach 1:
The patent applies local quality by differentiating the security scanning approach based on individual file characteristics and usage patterns. Instead of uniformly scanning all files, the system applies intensive scanning only to high-priority frequently executed files, while using lighter-weight on-demand scanning for less common files, thereby optimizing both security coverage and system performance
Solution Approach 2:
The patent implements partial action by performing security scanning selectively rather than comprehensively on all files. The system prioritizes scanning of frequently executed files and caches their security status, while deferring or skipping scanning of less common files until actually needed, thereby achieving adequate security protection with reduced performance impact
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer-implemented method for looking up anti-malware metadata may include identifying a plurality of executable objects to be scanned for malware before execution. The computer-implemented method may also include, for each executable object within the plurality of executable objects, assessing an imminence of execution of the executable object. The computer-implemented method may further include prioritizing, based on the assessments, a retrieval order for anti-malware metadata corresponding to the plurality of executable objects. The computer-implemented method may additionally include retrieving anti-malware metadata corresponding to an executable object within the plurality of executable objects based on the retrieval order. Various other methods, systems, and computer-readable media are also disclosed.