Antivirus Operational Status Detection via Dynamic Test Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing EICAR file-based method for checking antivirus functionality is vulnerable to circumvention by attackers due to its well-known test string, which can be exploited to compromise the operational status of antivirus software.
Innovation Solution
A system is implemented where unique test data is provided to endpoint systems, and the antivirus software reports detection to a backend system, with a challenge procedure involving a threshold response to determine operational status, incorporating forward secrecy and multi-key encryption for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the EICAR file with a well-known test string is used to check antivirus functionality, then the antivirus operational status can be verified, but attackers can circumvent the test by exploiting the known test string
Solution Approach 1:
The test string is dynamically generated and changed periodically rather than using a static well-known string. The backend system generates unique test strings that are distributed to endpoint systems, ensuring that the test data changes over time and cannot be easily exploited by attackers
Solution Approach 2:
The backend system pre-generates and distributes test strings to endpoint systems before the actual antivirus test is performed. This preliminary distribution ensures that the test string is available at the endpoint while maintaining security through controlled dissemination
Solution Approach 3:
A backend system acts as an intermediary between the test string generation and distribution. The backend system manages the creation, distribution, and verification of test strings, isolating the endpoint systems from direct exposure to test string generation logic and enhancing overall security
2Object-affected harmful factors
If a unique test data approach is implemented with backend system coordination, then attacker circumvention is prevented, but system complexity increases due to multiple components and communication protocols
Solution Approach 1:
The backend system performs multiple functions including test string generation, distribution to endpoint systems, and verification of test results. This multi-functionality reduces the need for separate dedicated components for each task, thereby managing complexity while maintaining security
Solution Approach 2:
The system implements a feedback mechanism where endpoint systems report test results back to the backend system. This automated feedback loop enables verification of antivirus operational status without requiring manual intervention, managing complexity through automation
Data Source
AI summary
Proper functioning of an antivirus software running on an endpoint system is detected using a test data that is provided to the endpoint system. The test data is also provided to a backend system, which provides the endpoint system with an antivirus definition that includes information for detecting the test data. The antivirus software running on the endpoint system scans for the test data and reports detection of the test data to the backend system. The antivirus software is deemed to have failed the proper functioning test when the antivirus software fails to report detection of the test data. Proper functioning of the antivirus software is also detected by performing a challenge procedure, which involves sending a challenge message to the endpoint system. The endpoint system is expected to respond to the challenge message with a response that includes expected information.