Bloom Filter Malware Signature Deployment for Bandwidth Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current host-based security systems require significant bandwidth for transmitting and processing malware signatures, which is costly and resource-intensive, especially in constrained environments where bandwidth, computational power, and memory are limited, making them vulnerable to adversaries.
Innovation Solution
A malware detection architecture that compactly combines malware signatures into a Bloom filter with a fixed false positive rate, allowing hosts to scan files and data using the filter, with positive alerts sent to a central location for further instruction, utilizing pre-image resistant hash functions to maintain security and reduce resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional host-based security systems distribute complete DAT files to every node, then malware detection capability is maintained, but bandwidth consumption and computational overhead increase significantly
Solution Approach 1:
The patent extracts only the essential signature information from complete DAT files and stores it in a centralized signature repository. Instead of distributing entire 80MB DAT files to every node, the system extracts and distributes only the necessary signature data, reducing bandwidth consumption while maintaining detection capability.
Solution Approach 2:
The patent segments the signature distribution process into modular components: a centralized signature repository, incremental update mechanisms, and on-demand signature retrieval. This segmentation allows nodes to receive only the specific signature updates they need rather than complete signature sets, significantly reducing bandwidth usage.
2Reliability
If complete signature sets are distributed to all nodes, then comprehensive malware detection is achieved, but memory and processing resources at each node are overwhelmed
Solution Approach 1:
The patent merges the signature storage and management functions into a centralized signature repository rather than duplicating complete signature sets at each node. This consolidation reduces memory requirements at individual nodes while maintaining comprehensive detection capability through centralized access to all signatures.
Solution Approach 2:
The patent introduces a signature repository server as an intermediary between the central management system and endpoint nodes. This intermediary handles signature storage, retrieval, and distribution, reducing the processing burden on individual nodes while enabling comprehensive malware detection through centralized signature management.
3Reliability
If daily DAT file updates are transmitted to every node, then up-to-date threat protection is maintained, but network bandwidth and update transmission time are excessively consumed
Solution Approach 1:
The patent implements periodic incremental updates instead of daily complete DAT file distributions. The signature repository is updated periodically with only the changes since the last update, allowing nodes to receive brief incremental updates rather than complete 80MB files daily, significantly reducing update transmission time while maintaining up-to-date protection.
4Ease of operation
If signature information is transmitted in plain text, then ease of processing is improved, but security and confidentiality of signature data are compromised
Solution Approach 1:
The patent changes the parameter of signature data representation by encoding signatures in a compact binary format rather than plain text. This encoding maintains processing efficiency while significantly reducing data size and enhancing security through obfuscation, preventing adversaries from easily analyzing or evading detection by examining transmitted signature data.
Data Source
AI summary
A malware detection system comprising a signature generator for combining malware signatures into a malware signature filter with a fixed false positive rate; a central location configured to send the malware signature filter to each of a plurality of hosts that are configured to scan files on the host system using the malware signature filter; each host configured such that if the scan indicates a positive result, the file is quarantined and the host sends identification back to central location if a false positive result is obtained for additional instruction. A method for malware detection operative to combine malware signatures into a filter with fixed false positive rate; comprising sending a malware signature filter to hosts for scanning of files on the host system and incoming data; if the malware signature filter returns a positive alert, identification is sent back to a central location.