Archive Scanning via Metadata and Hash Extraction

Solution Overview

Problem

Traditional malware detection methods require extracting and scanning compressed archives, which is time-consuming and inefficient.

Innovation Solution

A system and method for anti-malware scanning that selects an archive, extracts metadata, reads hash strings, and compares them with a database of known malware without fully extracting the archive, determining security threats based on metadata and hash strings.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional malware detection extracts and scans compressed archives, then detection accuracy is improved, but processing time increases significantly

Engineering Contradiction:

Improvemalware detection accuracyVSAvoidprocessing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent extracts only the essential metadata and hash strings from archived files without fully decompressing the archive. This selective extraction of critical information (file names, hashes, metadata) allows malware detection to proceed on representative data while avoiding the time-consuming process of extracting entire archive contents, thus resolving the contradiction between detection accuracy and processing time

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system performs preliminary extraction of metadata and hash strings from archives before the actual malware scanning process. By preparing this essential information in advance, the system enables rapid comparison with malware databases without needing to fully extract and process the entire archive, thereby reducing processing time while maintaining detection reliability

Inventive Principle:

Principle #10Preliminary action

2Reliability

If compressed archives are extracted before scanning, then malware detection capability is improved, but system efficiency deteriorates

Engineering Contradiction:

Improvemalware detection capabilityVSAvoidsystem efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent extracts only the essential metadata and hash strings from archived files without fully decompressing the archive. This selective extraction of critical information (file names, hashes, metadata) allows malware detection to proceed on representative data while avoiding the time-consuming process of extracting entire archive contents, thus resolving the contradiction between detection accuracy and processing time

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system performs partial extraction of only the necessary metadata and hash strings from archives rather than complete extraction of all files. This partial action provides sufficient information for effective malware detection while significantly reducing the processing overhead, thereby improving system efficiency without sacrificing detection capability

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS20240037232A1System and Method for Archive AM Scanning

Publication Date: 2024.02.01 UAB 360 IT

AI summary

Systems and methods for archive scanning are provided herein. In some embodiments, a method includes: selecting an archive; reading a metadata representing a plurality of files within the archive; reading a plurality of hash strings from the archive; comparing the plurality of hash strings with a database of hash strings; and determining, based on the comparing, if the plurality of files within the archive represent a security threat based on the plurality of hash strings.