Antivirus Intelligent Flow Framework for Network Congestion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network devices face challenges in efficiently managing antivirus scanning processes, as existing methods like store-and-forward and simple inline methods either cause congestion or are ineffective in preventing virus transmission, leading to increased risk and data rendering issues.
Innovation Solution
Implementing an antivirus intelligent flow framework that classifies data transactions based on risk levels, opting for either a slow path or fast path virus scanning process, which involves storing and scanning all data or sending partial data with remaining portions buffered for scanning, respectively, to effectively block viruses and reduce buffering demands.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If store-and-forward method is used for virus scanning, then virus blocking reliability is improved, but network device buffer capacity is exceeded causing congestion
Solution Approach 1:
The patent segments the data transaction into multiple portions and processes them differently. The header portion is buffered and scanned, while the body portion is forwarded without buffering. This segmentation allows the system to maintain reliable virus scanning for critical header information while avoiding the buffer capacity issues of storing entire data transactions.
Solution Approach 2:
The patent applies partial action by performing virus scanning only on the header portion of data transactions rather than the complete data. This partial scanning approach provides sufficient virus blocking capability for identifying malicious traffic patterns while significantly reducing the buffering requirements compared to complete data scanning.
2Quantity of substance
If simple inline method is used for virus scanning, then buffer usage is reduced, but virus blocking effectiveness deteriorates
Solution Approach 1:
The patent applies local quality by treating the header and body portions of data transactions differently. The header portion receives full buffering and scanning treatment to ensure reliable virus detection, while the body portion is forwarded with minimal buffering. This localized quality differentiation maintains virus blocking effectiveness for critical information while reducing overall buffer usage.
3Measurement precision
If complete data buffering is performed for scanning, then scanning accuracy is improved, but network latency increases
Solution Approach 1:
The patent performs preliminary action by buffering and scanning only the header portion of data transactions before forwarding the complete data. This preliminary scanning of the header provides sufficient accuracy for identifying virus patterns while avoiding the time delay associated with buffering and scanning the entire data transaction.
Data Source
AI summary
A device receives a data transaction associated with packet, determines a risk level associated with the data transaction, and performs a content type check for the data transaction. The device also performs an infected content check for the data transaction, and classifies, based on the determined risk and the performed checks, the data transaction for one of a slow path virus scanning process or a fast path virus scanning process. The device further performs, based on the classification, one of the slow path virus scanning process or the fast path virus scanning process on the data transaction.