Antivirus Scan Mode Selection Using Short Hash Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus scan technologies face challenges in reducing scan time and optimizing between synchronous and asynchronous scanning modes, leading to potential delays and errors such as false positives and negatives.
Innovation Solution
A method that intercepts files during launch, calculates a short hash synchronously, and determines the scan mode based on the hash's presence in a verdict cache, switching to asynchronous mode if the file is deemed safe, allowing for efficient and secure scanning by selecting the optimal scan type.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a complete antivirus scan is performed upon attempted access to a file, then the security detection capability is improved, but the file access time is significantly delayed
Solution Approach 1:
The antivirus scan is divided into two stages: a preliminary quick scan using a short hash of the file, and a complete scan using the full hash. The short hash provides initial security checking while the full hash provides comprehensive verification only when needed, thus segmenting the scan process to reduce overall access time while maintaining detection capability.
Solution Approach 2:
The system performs preliminary actions by calculating a short hash and conducting a preliminary search in the verdict cache before the user attempts to access the file. This preliminary scan quickly identifies obviously malicious files, allowing most files to be accessed without waiting for the complete scan, thus reducing file access time while maintaining security.
2Reliability
If synchronous file scanning is used, then malicious code execution is prevented, but file access is blocked causing delays
Solution Approach 1:
The system dynamically adjusts the scanning mode based on the results of the preliminary short hash search. If the short hash matches an entry in the verdict cache, synchronous scanning is performed to prevent malicious code execution. If no match is found, asynchronous scanning is used to allow file access to proceed smoothly without blocking. This dynamic adaptation resolves the contradiction between security prevention and access smoothness.
3Measurement precision
If the full hash is calculated for every file, then accurate virus detection is achieved, but the processing time increases significantly
Solution Approach 1:
The hash calculation is segmented into two parts: a short hash that is calculated quickly for all files as a preliminary check, and a full hash that is calculated only when the short hash indicates potential malicious content. This segmentation reduces processing time for the majority of files while maintaining accurate virus detection capability when needed.
Solution Approach 2:
Instead of performing the complete action (calculating full hash for every file), the system performs a partial action (calculating short hash) for all files, and only performs the complete action (calculating full hash) when necessary. This partial action approach significantly reduces processing time while maintaining detection accuracy for malicious files.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are systems and methods for generating a request for information on a file to perform an antivirus scan. In one example, an exemplary method comprises, intercepting the file, synchronously calculating a first hash of a portion of the file, searching in a verdict cache, when the hash is found, determining whether the hash belongs to a list of malicious files, when it belongs to the list of malicious files, synchronously calculating a second hash, searching for the second hash in the verdict cache, and pronouncing a final decision as to harmfulness of the file, when the first hash does not belong to the list of malicious files, granting access to the file, asynchronously generating a request for information about the file, calculating a second hash, searching for the information in a verdict cache, and pronouncing a decision as to harmfulness of the file.