Anti-Virus Driver File Modification Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-virus scanning methods are inefficient due to the need to scan hundreds of thousands of files, causing significant computational overhead and unnecessary checks, as they rely on large databases and lack effective methods to identify modified files since the last scan.
Innovation Solution
A system and method that utilizes an AV driver to maintain a log of modified files and a circular cache, where the AV driver monitors file modifications, records information, and periodically transfers records from the cache to a log file, which is then updated in the database, optimizing the scanning process by reducing unnecessary checks and computational load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If the AV application queries the database to check which files have already been scanned, then the scanning process can avoid redundant checks, but the database synchronization causes significant computational overhead and slows down the system
Solution Approach 1:
The system pre-records file modification information in a log file before the scanning process begins. The AV driver monitors file system changes continuously and maintains a log of modified files, so when scanning is needed, the system only needs to check the log file rather than querying the entire database. This preliminary action eliminates the need for expensive database queries during the scanning process.
Solution Approach 2:
The invention extracts the file modification tracking function from the main database system and implements it as a separate log file maintained by the AV driver. This separation allows the scanning process to use the lightweight log file for determining which files need scanning, rather than querying the heavy database, thus reducing computational overhead while maintaining accuracy.
2Reliability
If the AV scans hundreds of thousands of files to ensure complete coverage, then the file system security is maintained, but the scanning process becomes lengthy and costly
Solution Approach 1:
The invention extracts only the necessary information (modified files) from the full file system and stores it in a separate log file. This allows the scanning process to focus only on files that have changed since the last scan, maintaining security coverage while dramatically reducing the number of files that need to be checked.
Solution Approach 2:
The system performs preliminary tracking of file modifications through the AV driver, which monitors and records changes as they occur. This preliminary action ensures that when a scan is initiated, the system already has an accurate list of files that need to be checked, eliminating the need for exhaustive scanning while maintaining complete security coverage.
3Loss of information
If the AV maintains a comprehensive database of all checked files, then the system can track file status accurately, but the database size becomes very large and querying it takes a long time
Solution Approach 1:
The invention extracts the essential tracking information (which files have been modified) from the comprehensive database and stores it in a separate, lightweight log file. The AV driver maintains this log by monitoring file system changes, allowing the system to track file status accurately without needing to query a large database.
Solution Approach 2:
Instead of querying the main database for file status information, the system uses a copied and simplified representation of the necessary data stored in the log file. This copy contains only the modification status of files, which is all that is needed for scanning decisions, thus providing accurate tracking with minimal query time.
4Reliability
If the AV checks extra files beyond what is strictly necessary, then the system ensures no infected files are missed, but additional load is placed on the file system and system performance slows down
Solution Approach 1:
The AV driver performs preliminary monitoring of file system changes and maintains an accurate log of modified files before scanning begins. This preliminary action ensures that the scanning process only needs to check files that have actually changed, eliminating unnecessary scans of unchanged files while maintaining complete virus detection capability.
Solution Approach 2:
The system changes the parameter used for scanning decisions from a comprehensive database query to a simple log file check. This parameter change allows the system to maintain reliable virus detection by focusing on modified files while dramatically improving system performance by avoiding unnecessary scans of files that haven't changed.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for optimizing a process of synchronization of a database of files checked by an anti-virus (AV) application implemented as a special AV driver. The database is updated by a special interface application using a log file and the AV driver cache. The AV driver monitors modifications of the files and records modification-related information in the context of the modified files. The AV driver creates and maintains a log of modified files. The AV driver supports a circular cache containing minimal required information about the modified files. This information is used for identification of the modified files by an application providing an interface between the AV driver and the database of checked files.