Antivirus File Handling via Hash-Based Malware Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional antivirus mechanisms that rely on hash values to detect and prevent malware often result in partial disinfection of files, leading to security issues and session disruptions, especially when handling electronic mail protocols like POP3, where incomplete file transmission causes repeated session resets and inability to process subsequent emails.
Innovation Solution
A system that calculates hash values for files and, upon detection of malware, stores metadata associated with the infected file, allowing for the generation and transmission of disinfected packets in subsequent sessions, ensuring complete disinfection and preventing malicious code execution, while maintaining communication session integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional antivirus mechanisms overwrite a part of the file based on hash value, then the file is partially disinfected, but the file still includes malicious code that can be executable and cause security issues
Solution Approach 1:
The patent extracts and removes the malicious portion of the file by calculating the hash value of the infected file, identifying the malicious segment, and creating a disinfected version by excluding only the malicious part while preserving the legitimate content. This extraction approach ensures complete disinfection without affecting the useful portions of the file.
Solution Approach 2:
The system performs preliminary actions by calculating the hash value of the downloaded file before execution, comparing it against known malware hash values in advance, and preparing the disinfected version proactively. This preliminary detection and preparation prevents malicious code execution before it can harm the system.
2Reliability
If conventional antivirus mechanisms drop the last packet to prevent malware execution, then no malware can be executed, but the client device cannot process subsequent emails and repeated session resets occur
Solution Approach 1:
Instead of dropping packets, the system extracts and removes only the malicious portion of the file by calculating hash values and identifying the infected segments. This allows the rest of the email data to be processed normally, maintaining productivity while preventing malware execution.
Solution Approach 2:
The system creates a copy of the downloaded file, calculates its hash value, compares it against known malware hashes, and generates a disinfected copy by removing only the malicious portions. This copying approach allows the original email processing to continue uninterrupted while providing a safe version for execution.
3Measurement precision
If hash-based antivirus systems are used to detect malware, then known malware can be identified, but incomplete file transmission causes repeated session resets and inability to process subsequent emails
Solution Approach 1:
The system performs preliminary hash value calculation and malware detection before the file transmission is complete. By comparing the calculated hash against known malware hashes in advance, the system can identify infected files and generate disinfected versions proactively, preventing repeated session resets and enabling continuous email processing.
Data Source
AI summary
An example method for a device to handle a file in an antivirus action has been disclosed. The method includes in response to receiving a signal indicative of having detected malware associated with the file, resetting a first session with a first client device and storing metadata associated with the file in a cache. The method further includes after having received the signal and in response to receiving a second request for the file from the first client device to establish a second session, retrieving the metadata from the cache, maintaining the second session, identifying a first part of the file based on the retrieved metadata during the second session, and performing the antivirus action to the identified first part of the file during the second session.