Antivirus Client Module Filtering Susceptible Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing number of files on computer systems and the sophistication of viruses lead to longer scanning times for antivirus software, causing significant productivity loss during network-based virus outbreaks, as traditional scanning methods are inefficient and time-consuming.
Innovation Solution
An antivirus client module that identifies susceptible files using a virus definitions module and a filtering module with a file information cache, allowing only those files to be scanned, thereby reducing the time required for virus detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus software scans all files on the computer system, then comprehensive virus detection is achieved, but scanning time increases significantly
Solution Approach 1:
The patent segments the file scanning process by dividing all files into two categories: susceptible files (those that can be infected by the virus) and non-susceptible files. The virus definition includes file type information that enables this segmentation. Only susceptible files are scanned for the virus, while non-susceptible files are excluded from scanning. This segmentation maintains comprehensive detection for vulnerable files while eliminating unnecessary scanning of files that cannot be infected, thereby resolving the contradiction between thorough detection and scanning time.
2Measurement precision
If advanced virus detection technologies are used to detect sophisticated viruses, then detection accuracy improves, but scanning time increases
Solution Approach 1:
The patent extracts and utilizes file type information from virus definitions to identify and separate susceptible files from non-susceptible files before scanning begins. By taking out the file type characteristics and using them as a filtering criterion, the system extracts only the necessary subset of files that require advanced detection. This prevents the application of time-consuming advanced detection technologies to files that cannot be infected, while maintaining high detection accuracy for the relevant susceptible files.
3Quantity of substance
If the number of files on the computer system increases, then more files are available for processing, but the pool of potentially-infected files increases leading to longer scan times
Solution Approach 1:
The patent performs preliminary action by pre-identifying susceptible files using file type information from virus definitions before the actual virus scanning process begins. The system prepares a filtered list of only those files that can potentially be infected by the specific virus variant. This preliminary filtering action ensures that when scanning occurs, the system processes only the relevant subset of files, maintaining productivity even as the total number of files on the system increases.
Data Source
AI summary
An antivirus client module (114) includes a virus definitions module (312) holding information describing characteristics of files that can potentially be infected by viruses and information enabling a determination of whether a file is actually infected by a virus. The client module (114) also includes a filtering module (314) having a file information cache (410) describing characteristics of files. A file scanning module (316) can scan files to determine whether the files are infected by viruses. The antivirus client module (114) queries the file information cache (410) using the information describing characteristics of files to identify the set of files that are susceptible to a given virus. The file scanning module (316) scans the files in the set.