Antivirus File Access Method Selection via Attribute Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus systems face challenges in selecting the most appropriate file access method during analysis, leading to unnecessary blocking of user applications and potential malware infections, as synchronous access can suspend file access and asynchronous access may not detect infections effectively.
Innovation Solution
The system determines whether to use synchronous or asynchronous file access based on file attribute changes by comparing current and old attributes, allowing other programs to access files asynchronously if they are unmodified and blocking access synchronously if they are modified, thereby optimizing antivirus analysis efficiency and detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If synchronous file access is used during antivirus analysis, then malware detection reliability is improved, but user productivity deteriorates due to blocking of file access by other programs
Solution Approach 1:
The patent applies dynamics by making the file access method adaptable rather than fixed. The system dynamically switches between synchronous and asynchronous access modes based on real-time file modification status detection. When files are modified (potential malware infection), synchronous access is used to ensure detection reliability; when files are unmodified, asynchronous access is used to maintain user productivity. This dynamic adaptation resolves the contradiction between reliability and productivity.
2Productivity
If asynchronous file access is used during antivirus analysis, then user productivity is improved by allowing continued file access, but malware detection reliability deteriorates
Solution Approach 1:
The system dynamically adjusts the file access method based on detected file modification status. When a file is detected as modified (indicating potential malware infection), the system switches to synchronous access mode to ensure reliable malware detection. When files are unmodified, asynchronous access is maintained to preserve user productivity. This conditional dynamic switching resolves the reliability concern while maintaining productivity benefits.
3Reliability
If synchronous file access is used for all files, then malware detection effectiveness is improved, but system efficiency deteriorates due to unnecessary blocking of clean files
Solution Approach 1:
The patent applies local quality by treating different files differently based on their individual modification status. Instead of applying a uniform synchronous access method to all files, the system locally adapts the access method: synchronous access is applied only to modified files where malware detection is critical, while asynchronous access is applied to unmodified files where blocking would be unnecessary. This localized differentiation improves system efficiency while maintaining detection effectiveness for suspicious files.
4Productivity
If asynchronous file access is used for all files, then system efficiency is improved, but malware detection capability deteriorates
Solution Approach 1:
The system implements local quality by differentiating file access methods based on individual file characteristics (modification status). For unmodified files, asynchronous access maintains system efficiency. For modified files detected through attribute comparison, synchronous access is applied locally to ensure malware detection capability. This selective application resolves the contradiction between efficiency and detection capability.
Data Source
Figure 1A~1B
Figure 2
Figure 3
AI summary
Disclosed are systems, methods and computer program products for performing antivirus analysis of a file. Particularly, antivirus software detects an attempt to execute a file on a computer and collects information about current file attributes. The software retrieves information about old file attributes. The software then compares current file attributes with the old file attributes to determine whether the file has been modified. When the file is determined to be modified, the software synchronously accesses the file to perform antivirus analysis thereof. During the synchronous access of the file, one or more other programs are prohibited from accessing the analyzed file. When the file is determined to be unmodified, the software asynchronously accesses the file. During the asynchronous access of the file one or more of the other programs are allowed to access the analyzed file.