Cached File Reputation System for Secure Installation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware systems face challenges in ensuring the security of modern computing environments, where downloaded files often install numerous components, making it difficult to verify the trustworthiness of each file in a timely and efficient manner, leading to potential malicious installations and user frustration.
Innovation Solution
A security agent that predicts likely downloads based on user behavior and contextual information, allowing for pre-installation caching of file reputations from a global threat database, enabling on-demand access to verify the safety of files during installation without synchronous cloud queries, thus enhancing security and user experience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If synchronous cloud queries are performed for each file during installation, then security verification is thorough, but installation speed decreases and user experience deteriorates
Solution Approach 1:
The system performs preliminary action by predicting likely downloads based on user behavior patterns and contextual information before the actual installation occurs. File reputations are cached in advance from the global threat database, so when installation happens, the security verification can be performed locally without synchronous cloud queries, thus maintaining both thorough security verification and fast installation speed
Solution Approach 2:
The patent introduces a local cache as an intermediary between the cloud threat database and the installation process. This intermediary stores pre-fetched file reputation data, allowing the system to perform security verification locally using cached data rather than directly querying the cloud for each file during installation, thereby resolving the contradiction between security thoroughness and installation speed
2Measurement precision
If individual file reputations are queried from cloud service, then security analysis accuracy is high, but network overhead increases and response time increases
Solution Approach 1:
The system performs preliminary action by predicting likely downloads based on user behavior patterns and contextual information before the actual installation occurs. File reputations are cached in advance from the global threat database, so when installation happens, the security verification can be performed locally without synchronous cloud queries, thus maintaining both thorough security verification and fast installation speed
Solution Approach 2:
The patent applies copying by creating a local copy of the global threat database's reputation information in a local cache. Instead of querying the cloud for each file during installation, the system uses copies of reputation data that are already stored locally, dramatically reducing network overhead and response time while maintaining the same security analysis accuracy
3Reliability
If all downloaded files are scanned for malware, then security coverage is comprehensive, but processing complexity increases
Solution Approach 1:
The system segments the security verification process into two parts: (1) prediction of likely downloads based on user behavior and contextual information, and (2) verification of only those predicted files using cached reputations. This segmentation reduces processing complexity by focusing resources on the most likely candidates rather than scanning all downloaded files, while maintaining comprehensive security coverage through predictive accuracy
Solution Approach 2:
The patent applies local quality by making different parts of the security system have different functions: the prediction module uses local user behavior data and contextual information to identify likely downloads, while the verification module uses locally cached reputation data for fast verification. This local quality approach reduces processing complexity by avoiding uniform treatment of all files and instead applies targeted verification based on predicted likelihood
Data Source
AI summary
There is disclosed in one example a computing apparatus, including: a network interface; a hardware platform, including at least a processor and a memory; and instructions encoded in the memory to instruct the processor to: identify an executable object to be run on the apparatus, the executable object to provision a plurality of local files or objects with unknown local reputations; query via the network interface a remote service with an identification of the executable object; responsive to the query, receive from the remote service a reputation batch for the local files or object; and selectively permit installation of the executable object and/or the plurality of local files or objects based at least in part on individual reputations within the reputation batch.