Antivirus Signature Compression via Adaptive Algorithm Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing volume of virus and malware signatures in antivirus databases leads to significant storage space requirements, both in nonvolatile storage and volatile memory, causing resource constraints on computer systems.
Innovation Solution
A method for compressing arrays of strings, such as virus names, by selecting the most efficient compression method for each string based on the shortest compressed string length, using a combination of literal, drift, pointer, and extended pointer compression techniques, with dedicated ranges for each method to indicate the compression type and parameters.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the volume of virus and malware signatures is increased to improve detection coverage, then the detection capability is improved, but the storage space requirement increases
Solution Approach 1:
The patent applies parameter changes by transforming the storage representation of virus signatures from uncompressed string format to compressed format using multiple compression algorithms (literal, drift, pointer, extended pointer). This changes the physical parameters of data storage while maintaining the complete signature database, thereby reducing storage space requirements without sacrificing detection coverage or capability.
2Volume of stationary object
If the storage size of antivirus databases is reduced to minimize resource usage, then the storage efficiency is improved, but the decompression time increases
Solution Approach 1:
The patent implements dynamics by dynamically selecting the optimal compression algorithm for each virus signature based on its characteristics. The system evaluates whether a signature is better compressed using literal compression, drift compression, pointer compression, or extended pointer compression, and applies the most efficient method. This dynamic approach optimizes the balance between compression ratio and decompression speed for each individual signature.
Solution Approach 2:
The patent applies segmentation by dividing the virus signature database into individual signatures that can be independently compressed and decompressed. Each signature is processed separately with the appropriate compression algorithm, allowing for selective decompression based on needs. This segmentation enables efficient resource utilization and reduces overall decompression time compared to decompressing the entire database.
3Volume of stationary object
If multiple compression methods are used to optimize storage efficiency, then the storage compression ratio is improved, but the system complexity increases
Solution Approach 1:
The patent applies universality by implementing a multi-functional compression system that can handle multiple compression algorithms within a single framework. The system includes literal compression for exact matches, drift compression for minor variations, pointer compression for references to previous signatures, and extended pointer compression for longer references. All these methods are integrated into one unified approach, allowing the system to achieve high compression ratios while managing complexity through a structured, hierarchical design.
Data Source
AI summary
A method of compressing a string array comprising strings with similarity includes selecting a string compression method from among a plurality of available compression methods based on at least which of the available compression method yields the shortest compressed string. The string is then compressed using the selected string compression method. The array of strings to be compressed comprises text characters represented by a first range of values within a word, and compressed string comprises one or more words in a second range of values dedicated to compression and not overlapping with the first range of values. This process is repeated for additional strings in the string array, such that the compression method used for each of a plurality of strings is independently selected.