Automated Whitelist Generation for Anti-Malware Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-malware scanning methods are resource-intensive and generate high false positives due to the large volume of data that needs to be scanned, causing computational slowdowns and requiring labor-intensive whitelist creation.
Innovation Solution
An automated method for creating an optimal whitelist by scanning objects in backup archives, generating metadata, and using hash values to identify trusted objects, thereby reducing the need for IT administrators and minimizing false positives during scans.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-malware scanning is performed on all files and data in backup archives, then data security is improved, but computational resources are overwhelmed and processing speed decreases
Solution Approach 1:
The system performs preliminary scanning of backup archives to identify and whitelist safe objects before the main malware scanning operation. This preliminary action creates a whitelist that prevents false positives and reduces the computational load during subsequent scanning operations, thereby maintaining both security and processing speed
Solution Approach 2:
The scanning process is divided into two segments: (1) preliminary scanning to build the whitelist, and (2) main scanning using the whitelist to exclude known safe objects. This segmentation allows the system to handle large volumes of data efficiently by separating the identification of safe objects from the detection of malicious objects
2Measurement precision
If comprehensive malware scanning is performed on all objects, then detection accuracy is improved, but the number of false positives increases
Solution Approach 1:
The whitelist acts as an intermediary between the malware scanner and the objects being scanned. It provides a reference list of known safe objects that the scanner can check against before performing detailed analysis, thereby reducing false positives while maintaining detection accuracy for truly malicious objects
Solution Approach 2:
The system performs preliminary scanning to identify safe objects and create the whitelist before the main detection phase. This preliminary identification of benign objects prevents them from being incorrectly flagged as malware during comprehensive scanning, thereby reducing false positives
3Reliability
If manual whitelist creation is performed by IT administrators, then whitelist accuracy is improved, but labor time and operational complexity increase
Solution Approach 1:
The system performs self-service by automatically scanning backup archives and generating the whitelist without requiring manual intervention from IT administrators. The automated process identifies safe objects based on scanning results and populates the whitelist, thereby maintaining accuracy while eliminating manual labor and operational complexity
Data Source
AI summary
Disclosed herein are systems and method for anti-malware scanning, including identifying a plurality of objects in a backup archive that is connected to a first network comprising a plurality of computing devices; scanning the plurality of objects in the backup archive to generate a whitelist indicating a subset of the plurality of objects that do not need to be scanned at a subsequent time; performing, using the whitelist, a first malware scan in a computing device of the plurality of computing devices; detecting that the computing device has left the first network to join a second network; and performing a second malware scan on the computing device, wherein the second malware scan uses a different whitelist of the second network, and wherein the second malware scan comprises scanning a first object that is not in the different whitelist and was not scanned in the first malware scan.