Antimalware Scan Block Selection Algorithm
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional antimalware systems require full file scans to detect malware signatures, consuming significant CPU and I/O resources and being inefficient for fast detection, especially with increasing malware variants.
Innovation Solution
A method that performs partial matching of continuous byte sequences (blocks) of an unknown file against known malware files using a block selection algorithm, minimizing false positives and optimizing resource usage through a two-stage scan process, potentially aided by AI algorithms like neural networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full file scan is performed to detect malware signatures, then detection accuracy is improved, but scan speed and resource efficiency deteriorate
Solution Approach 1:
The patent divides the file into discrete blocks of data and selects specific blocks for comparison against malware signatures. Instead of scanning the entire file sequentially, the system segments the file content and strategically samples portions that are most likely to contain malware indicators, thereby reducing scan time while maintaining detection effectiveness.
Solution Approach 2:
The patent applies partial action by performing only the necessary portion of the scan. Rather than reading and analyzing every byte of the file, the system reads and compares only selected blocks that are sufficient to make a detection decision. This partial scanning approach reduces resource consumption and increases scan speed while still achieving reliable malware detection.
2Reliability
If full file scan is performed to ensure complete signature matching, then detection reliability is improved, but CPU and I/O resource consumption increase
Solution Approach 1:
The patent extracts only the necessary portions of the file for analysis. By identifying and extracting specific blocks that are most indicative of malware presence, the system avoids the unnecessary processing of entire file contents. This extraction approach reduces both CPU processing requirements and I/O operations while maintaining the reliability of detection through targeted sampling of critical file regions.
3Ease of manufacture
If block selection algorithm uses pre-defined criteria, then implementation simplicity is improved, but detection precision for new malware variants deteriorates
Solution Approach 1:
The patent implements a dynamic block selection mechanism that can adapt to different file types and malware variants. The system uses heuristics and machine learning models to dynamically determine which blocks to scan based on file characteristics, allowing the implementation to maintain simplicity through automated decision-making while achieving high detection precision by adapting to new malware techniques without requiring manual reconfiguration.
Data Source
AI summary
A system for detection of files not matching a known malware file in a computing environment that includes a processor coupled to a memory storing instructions to permit the processor to function as an analyzer. The analyzer is configured to receive, as input, an unknown file and the known malware file, compare the unknown file to the known malware file by comparing N (where N is greater of equal to 1) blocks B1, . . . , BN of lengths L1, . . . , LN located at offsets O1, . . . , ON such that the number of blocks, lengths and offsets are calculated according to pre-defined algorithm, and output a value indicating that the unknown file is different from the known malware file if exists at least one j that a Bj block of the unknown file is different from a Bj block of the known malware file.