Antivirus Scanning in Virtual Machine Clusters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus systems face inefficiencies in detecting malicious files due to high computational resource demands and workload, especially in distributed systems of virtual machines, leading to prolonged scanning times and resource exhaustion.
Innovation Solution
A method for detecting malicious files in a distributed system of virtual machines involves determining the characteristics and parameters of computing resources, using approximation functions to select the most effective virtual machine for scanning, optimizing resource usage, and prioritizing scans based on time and workload to ensure timely and efficient detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus scanning is performed on all files in a distributed system, then detection coverage is improved, but computing resource consumption increases substantially
Solution Approach 1:
The system segments the distributed file system into multiple virtual machine clusters, each responsible for scanning specific file portions. The patent divides the scanning task across multiple virtual machines (VMs) in the distributed system, where each VM scans a subset of files or file segments. This segmentation allows parallel processing while reducing the computational burden on individual nodes, thereby maintaining comprehensive detection coverage without overwhelming any single computing resource.
2Speed
If more computing resources are allocated to antivirus scanning, then scanning speed is improved, but system resource availability decreases
Solution Approach 1:
The system dynamically adjusts the allocation of computing resources to antivirus scanning based on real-time system conditions and workload characteristics. The patent implements dynamic resource allocation where the computing resources dedicated to scanning are adjusted adaptively according to the current state of the distributed system, ensuring optimal scanning speed while preserving sufficient resources for other system operations. This dynamic approach allows the system to respond to changing conditions without requiring static over-provisioning of resources.
3Measurement precision
If antivirus scanning is performed on large volumes of data, then detection accuracy is improved, but scanning time increases
Solution Approach 1:
The system performs preliminary actions to prepare and organize data before the actual antivirus scanning process. The patent implements pre-processing steps that sort, categorize, and prioritize files based on their risk characteristics, file types, and other relevant attributes. This preliminary organization enables the scanning system to process files in an optimized sequence, applying more rigorous analysis to high-risk files while using faster scanning methods for low-risk files, thereby maintaining high detection accuracy across large data volumes while reducing overall scanning time.
4Productivity
If distributed systems are used for antivirus scanning, then processing capacity is improved, but system complexity increases
Solution Approach 1:
The system implements universal, multi-functional virtual machine components that can perform multiple scanning operations and handle various file types through a unified architecture. The patent describes a standardized VM framework where each virtual machine is designed to be multi-functional, capable of executing different scanning algorithms, processing various file formats, and coordinating with other VMs through common protocols. This universality simplifies the distributed system architecture by reducing the need for specialized components for each scanning task, thereby increasing processing capacity while managing system complexity through standardization.
Data Source
AI summary
A method and system is provided for detecting malicious files in a distributed network having a plurality of virtual machines. An example method includes: determining and obtaining, by a virtual machine, at least one file for performing an antivirus scan; collecting data relating to characteristics of computing resources of each virtual machine and parameters relating to the antivirus scan; determining an approximation time function of the characteristics of the computing resources and an approximation function of the one or more parameters for determining an approximation time function of effectiveness of the antivirus scan; and beased at least on the approximation time function of effectiveness of the antivirus scan, selecting one virtual machine to perform the antivirus scan in order to determine whether the at least one file is malicious.