Cloud Security File Processing via Signature Feedback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud security technologies are ineffective in timely detection and removal of malicious programs due to their reliance on local feature libraries and engines, which can be evaded by malicious software, leading to delayed updates and widespread infection before detection.
Innovation Solution
A cloud security-based file processing method that generates a unique signature identifier for unknown program files, sends it to a server for query, and receives feedback for real-time processing, including detection and potential killing of malicious files based on server-provided instructions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cloud security technology uses local feature libraries and engines for virus detection, then the system can operate with existing security databases, but the detection speed is slow and malicious programs can evade detection by updating their codes before security software is updated
Solution Approach 1:
The patent applies preliminary action by pre-calculating and storing hash values of computable fields for known malicious programs in the cloud database before actual detection occurs. When a file needs detection, the system immediately compares its hash against the pre-prepared database, eliminating the need for time-consuming analysis during detection. This resolves the contradiction by preparing detection data in advance, achieving both high reliability and fast detection speed.
Solution Approach 2:
The patent extracts only the essential computable field from program files for hashing and comparison, separating this critical detection element from the entire file. By extracting and storing only the hash of the computable field in the cloud database, the system achieves rapid comparison without dealing with complete file analysis, thus improving detection speed while maintaining accuracy.
2Reliability
If security software is updated regularly to detect new malicious programs, then detection accuracy improves, but the update process takes time during which malicious programs can spread widely
Solution Approach 1:
The patent introduces a cloud-based intermediary database that stores pre-calculated hash values of malicious program computable fields. Instead of requiring direct updates to local security software, the cloud server acts as an intermediary that maintains the latest threat intelligence and provides instant verification capability to clients. This resolves the contradiction by decoupling detection accuracy from local update cycles, enabling rapid response to new threats through cloud-mediated verification.
Solution Approach 2:
The system implements feedback by continuously comparing file hashes against the cloud database and providing immediate detection results. The cloud server receives detection requests, compares against the latest threat data, and returns results in real-time, creating a closed-loop feedback system that maintains high detection accuracy without requiring time-consuming local updates.
3Reliability
If the local engine scans and sends features of unknown program files to the cloud security server for analysis, then detection accuracy can be maintained, but the process is time-consuming and allows malicious programs to spread before detection
Solution Approach 1:
The patent extracts only the essential computable field from program files for hashing and comparison, separating this critical detection element from the entire file. By extracting and storing only the hash of the computable field in the cloud database, the system achieves rapid comparison without dealing with complete file analysis, thus improving detection speed while maintaining accuracy.
Solution Approach 2:
The patent uses copying by creating hash copies of the computable fields instead of storing or transmitting entire program files. The cloud database stores hash copies of malicious program signatures, and detection is performed by comparing hash copies rather than analyzing complete files. This dramatically reduces processing time while maintaining detection accuracy through efficient hash-based matching.
Data Source
AI summary
The invention discloses a cloud security-based file processing method and apparatus. The method comprises: generating a signature identifier uniquely corresponding to an unknown program file downloaded locally according to signature related information of the unknown program file; sending a query request to a server end to query whether the unknown program file is a malicious program or not, wherein the query request carries the signature identifier of the unknown program file and a part or all of the file features of the unknown program file; and receiving a feedback message from the server end, and performing subsequent process on the unknown program file according to the feedback message, wherein the server end generates the feedback message according to the signature identifier and the file features. The invention solves the problem of breaking through the cloud killing by utilizing a Trojan in the prior art and at the same time can also reduce the time from discovering a malicious program to killing the malicious program, thereby accelerating the speed of fighting against a new malicious program, reducing the information storage amount of the server as well and in turn guaranteeing the security of a client program.