Antivirus Cache Acceleration via Memory Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus database update methods consume significant system resources and slow down system boot times due to frequent loading of large databases into RAM and inefficient memory usage, especially when multiple malware scanning processes are involved.
Innovation Solution
An antivirus cache is maintained in non-volatile memory, where updates are stored in a dynamic library format, allowing memory-mapped data files and libraries to be accessed directly without conversion, reducing the need for repeated format conversions and memory duplication during malware scans.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the antivirus database is loaded into RAM and converted to internal format during each antivirus engine startup, then the antivirus application can operate with the database, but system resources are significantly consumed and boot time is slowed down
Solution Approach 1:
The patent pre-converts the antivirus database to internal format and stores it in a cache file on disk before the antivirus engine needs to run. This preliminary conversion eliminates the need to perform time-consuming format conversion during each startup, thus reducing boot time while ensuring the database is ready for immediate use when needed.
Solution Approach 2:
The patent creates a cached copy of the antivirus database in a specialized format on disk. This cached copy can be quickly loaded and mapped into memory without requiring full format conversion, allowing the system to use a lightweight copy for operations while the original database remains in its source format.
2Ease of operation
If the antivirus database is loaded into RAM for each malware scanning process, then the process can access the database independently, but system memory usage increases significantly with multiple processes
Solution Approach 1:
The patent merges the database storage functionality by implementing a shared cache mechanism where multiple antivirus processes access the same cached database copy in memory. This eliminates the need for each process to load its own separate copy of the database, significantly reducing total memory consumption while maintaining independent access capabilities through shared memory mapping.
Solution Approach 2:
The cached database in memory serves as a universal resource that can be simultaneously accessed by multiple different antivirus scanning processes. This single shared cache instance provides database access functionality for all processes, replacing the need for multiple separate database instances and reducing overall memory requirements.
3Ease of manufacture
If the antivirus database is updated by downloading incremental update files and converting them during execution, then the database can be modified independently, but the conversion process slows down system operation
Solution Approach 1:
The patent performs the database conversion to internal format as a preliminary action during the update process itself, before the updated database needs to be used. By converting update files to the cache format during the update operation rather than during subsequent scanning operations, the system prepares the data in advance, ensuring fast access during actual antivirus operations without impacting productivity.
Data Source
AI summary
Disclosed are systems, methods and computer program products for acceleration of computer malware detection system using antivirus cache. The system provides an antivirus cache in a non-volatile system memory that may be updated with information from an antivirus database. Each update contains different types of data and executable code associated with different types of known malware. During update, the same types of data for each type of malware is collected and stored as data files in corresponding sections of the antivirus cache and executable code sections are converted into platform-specific dynamic libraries and also stored in the antivirus cache. During execution of the antivirus application, the system maps one or more data files of the antivirus cache into the memory without any further conversion, thereby accelerating launch of the antivirus application.