Centralized File Rule Evaluation for Malware Detection Coverage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file security systems for organizations that accept file uploads are prone to localized scanning issues, which can lead to incomplete detection of malicious and suspicious files, computational inefficiencies, and the spread of malware across networks, as well as the potential for localized scans to be fooled by viruses that delete themselves.
Innovation Solution
A centralized, rule- or feature-based system, such as YARA, is used to scan files from multiple sources in a secure repository, allowing for global assessment of scanning rules and identifying the origin of suspicious files, while also evaluating the efficacy of rules based on the number of matches, thereby optimizing the detection process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a centralized system is used to scan files from multiple sources, then detection accuracy and rule evaluation capability are improved, but system complexity and infrastructure requirements increase
Solution Approach 1:
The patent introduces a centralized repository system that acts as an intermediary between multiple file sources and the scanning engine. This intermediary collects files from various sources, stores them centrally, and enables comprehensive rule evaluation that would be impossible in distributed localized systems. The repository mediates between the complexity of multiple sources and the simplicity of a unified scanning approach.
2Device complexity
If files are scanned locally at each source, then system infrastructure is simplified, but detection completeness decreases and malware can spread across networks
Solution Approach 1:
The patent merges multiple distributed file sources into a single centralized repository for unified scanning. Instead of each source scanning independently with limited capability, all files are consolidated and scanned by a comprehensive rule set, ensuring complete detection while preventing malware propagation across the network.
3Reliability
If comprehensive rule sets are applied to all files, then detection coverage is improved, but computational overhead and processing time increase
Solution Approach 1:
The patent performs preliminary actions by collecting and organizing all files in a centralized repository before scanning begins. This preliminary organization enables efficient rule evaluation and allows the system to process files systematically, reducing overall computational overhead compared to ad-hoc scanning approaches.
4Productivity
If localized scanning is used, then processing speed for individual files is maintained, but the ability to evaluate rule efficacy across multiple sources is lost
Solution Approach 1:
The centralized repository system implements feedback mechanisms that collect scanning results from all files across multiple sources. This feedback enables the evaluation of rule efficacy by analyzing match patterns across the entire corpus, allowing continuous optimization of detection rules based on comprehensive data rather than isolated local results.
Data Source
AI summary
A method for evaluating rules for detecting malicious files in a network repository is provided. The method includes receiving, in the network repository, files from file sources to create a corpus of files, wherein the network repository is separated by a firewall from the file sources, scanning each file against a character string of a first rule in the rule list for detecting a malicious pattern to determine if one or more files satisfy the first rule. Based on the scanning, the method includes counting a number of files that satisfy the first rule, determining a score for the first rule based on the number of files that satisfy the first rule, and ranking the first rule in the rule list based on the score. A system including a processor and a memory storing instructions to cause the system to perform the above method is also provided.