Client Device Signature Caching for Malware Detection Latency

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing malware detection methods, particularly in client devices, face challenges such as high processing resource consumption due to large signature databases and increased latency in remote anti-virus scanning, leading to slower scanning times and longer boot-up times.

Innovation Solution

A method that reduces signaling between client devices and servers by caching signature information for frequently requested objects, using both static and dynamic link provisioning to determine required information, allowing for quicker identification and handling of files without constant server requests.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a large signature database is maintained at the client device for malware detection, then detection accuracy is improved, but processing resource consumption increases and scanning time increases

Engineering Contradiction:
Improvemalware detection accuracyVSAvoidscanning speed
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The patent extracts the signature database from the client device and relocates it to a remote server. The client device maintains only a minimal local database for frequently accessed signatures, while the majority of signatures are stored remotely and accessed over the network. This extraction resolves the contradiction by removing the bulk of the database from the client, reducing local processing resource consumption and scanning time while maintaining detection accuracy through remote access to the comprehensive signature database.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces a remote server as an intermediary between the client device and the comprehensive signature database. The server acts as a mediator that stores the full signature database and provides selective access to the client device. This intermediary resolves the contradiction by enabling the client to access a large database remotely without maintaining it locally, thus reducing local processing requirements while preserving detection capabilities.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Device complexity

If remote anti-virus scanning is implemented to reduce local database storage, then device complexity is reduced, but communication latency increases scanning time

Engineering Contradiction:
Improvelocal database storage requirementsVSAvoidscanning time
Core Design Contradiction:
Device complexityVSLoss of time

Solution Approach 1:

The patent applies preliminary action by proactively caching frequently requested signature information at the client device before it is needed for scanning. The system predicts which signatures will be required and pre-loads them into the local cache, so when scanning occurs, the signatures are already available locally. This resolves the contradiction by eliminating communication latency for frequently accessed signatures while maintaining the benefits of remote database access for less frequent signatures.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent creates a copy of frequently accessed signature information at the client device through caching mechanisms. Instead of always accessing the remote server, the client maintains local copies of commonly needed signatures. This copying resolves the contradiction by providing immediate local access for frequent scanning needs while preserving the remote database as the source of truth for all signatures.

Inventive Principle:
Principle #26Copying

3Reliability

If frequent server requests are made for signature information, then detection accuracy is maintained, but processing resources and network bandwidth are consumed

Engineering Contradiction:
Improvedetection accuracyVSAvoidnetwork bandwidth consumption
Core Design Contradiction:
ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent performs preliminary action by pre-fetching and caching signature information that is likely to be needed for upcoming scanning operations. The system analyzes file metadata and scanning patterns to predict future signature requests and proactively loads those signatures into the local cache. This resolves the contradiction by reducing the frequency of network requests while maintaining detection accuracy through having signatures available locally when needed.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent implements self-service by enabling the client device to autonomously manage its own signature caching based on local scanning patterns and predictions. The system automatically determines which signatures to cache and when to refresh them without constant server intervention. This self-service approach resolves the contradiction by optimizing network bandwidth usage while maintaining detection accuracy through intelligent local signature management.

Inventive Principle:
Principle #25Self-service

Data Source

PatentUS9087194B2Providing information to a security application
Publication Date: 2015.07.21 RPX CORP
  • US9087194B2 patent drawing
  • US9087194B2 patent drawing
  • US9087194B2 patent drawing

AI summary

A method and apparatus for providing information to a security application at a client device. A server receives a request from the client device for information of an object at the client device. The request includes the signature information required by the server to identify the object. The server queries a database to determine the required information of the object and to determine information of at least one further object, and a response is sent to the client device. The response includes the information relating to the object, an identity of the at least one further object, and the information relating to the at least one further object.