Antivirus Check Optimization via Executable File Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional antivirus checks for executable files are resource-intensive and time-consuming, especially for new files that have not been pre-checked, as they require deep analysis using various technologies, which is not efficient for fast and lightweight scanning on computing systems.
Innovation Solution
A system and method that strategically exclude executable files without executable code from antivirus checks by analyzing their structure and format, using a check tool, breakdown tool, and analysis tool to determine if all conditions for safety are met, thereby excluding safe files from further antivirus checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If deep antivirus analysis is performed on all executable files, then security reliability is improved, but system resources and time are excessively consumed
Solution Approach 1:
The antivirus check process is divided into two segments: a first check using file format identification to quickly determine if a file is executable, and a second deep analysis only for files that pass the first check. This segmentation allows the system to maintain high security reliability while significantly reducing resource consumption for non-executable files.
Solution Approach 2:
The patent applies preliminary action by performing file format identification and executable code detection before conducting the full antivirus analysis. This preliminary check filters out non-executable files early in the process, preventing unnecessary consumption of system resources on files that cannot possibly contain malicious executable code.
2Reliability
If deep antivirus analysis is performed on all executable files, then security reliability is improved, but check time is excessively increased
Solution Approach 1:
The check process is segmented into a rapid first check using format identifiers and a comprehensive second check only for files that fail the first check. This reduces overall check time dramatically while maintaining reliability through the two-stage approach.
Solution Approach 2:
The patent implements skipping by allowing files that pass the first format-based check to be rapidly processed or excluded from the slower, more time-consuming second analysis stage. This rushing through of obviously safe files significantly reduces total check time while maintaining security through the initial filtering stage.
3Reliability
If all executable files are subjected to antivirus checks, then security coverage is improved, but system productivity is reduced
Solution Approach 1:
By segmenting the antivirus check into two stages with the first stage quickly identifying executable files through format analysis, the system maintains comprehensive security coverage while minimizing the impact on productivity. Only files requiring full analysis consume significant processing time.
Solution Approach 2:
The patent extracts and handles executable file identification as a separate, efficient preprocessing step before the main antivirus analysis. This extraction of the file type determination function allows the bulk of non-executable files to be processed or excluded rapidly, preserving system productivity while maintaining security coverage.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods for optimizing an antivirus determination for executable files. Optimization by excluding from an antivirus check executable files such as dynamic libraries and/or resource files that do not contain executable code speeds up the overall antivirus determination. An optimization system generally includes an antivirus system. The antivirus system generally includes a check tool and an executable file detection system. The executable file detection system generally includes a breakdown tool, an analysis tool, and a database. The antivirus system can be operably coupled to an antivirus server via the Internet.