Cloud Storage Malware Detection via File Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods in cloud storage face challenges in balancing accuracy and resource efficiency, as simple techniques are inaccurate while advanced methods are costly and resource-intensive, and existing methods fail to effectively target deep scans on the most relevant files.
Innovation Solution
A novel malware detection mechanism that clusters files based on features and assigns threat tags, using a combination of hash-based matching, static analysis, and dynamic analysis to selectively perform deep scans on files that are most likely to be malicious, thereby optimizing resource usage and improving detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If simple malware detection techniques are used, then resource consumption is low, but detection accuracy is poor
Solution Approach 1:
The detection system segments files into clusters based on feature similarity, then applies different detection strategies to different clusters. High-risk clusters undergo deep scanning while low-risk clusters use lighter detection methods, resolving the contradiction between resource consumption and detection accuracy.
Solution Approach 2:
The system applies different quality levels of detection to different files based on their cluster assignment. Files in clusters with known malicious patterns receive thorough deep scanning, while files in benign clusters receive minimal inspection, optimizing resource allocation according to local risk characteristics.
2Measurement precision
If advanced deep scan methods are applied to all files, then detection accuracy improves, but resource consumption increases significantly
Solution Approach 1:
The system divides the file population into distinct clusters based on feature similarity, then selectively applies deep scanning only to specific clusters identified as high-risk. This segmentation allows maintaining high detection accuracy for malicious files while avoiding unnecessary deep scans on benign files, thus controlling resource consumption.
Solution Approach 2:
Instead of applying deep scanning to all files (excessive action), the system applies deep scanning only to files in high-risk clusters (partial action). This partial application of the detection resource achieves sufficient security coverage while dramatically reducing overall computational resource consumption.
3Reliability
If deep scans are performed on all uploaded files, then malware detection coverage is comprehensive, but processing time increases
Solution Approach 1:
The system segments files into clusters and processes them differently based on cluster risk profiles. Files in low-risk clusters are processed quickly with minimal scanning, while only files in high-risk clusters undergo time-consuming deep scans. This maintains comprehensive detection coverage for malicious files while significantly reducing average processing time.
Solution Approach 2:
The system applies different processing qualities to different files based on their local characteristics and cluster assignment. High-priority deep scanning is applied locally to suspicious files, while benign files receive expedited processing, optimizing the balance between detection coverage and processing speed.
Data Source
AI summary
Files uploaded to a cloud storage medium are considered. The files may include a mixture of files known to be malicious and known to be benign. The files are clustered using similarity of file features, e.g., based on distance in a feature space. File clusters may then be used to determine a threat status of an unknown file (a file whose threat status is unknown initially). A feature of the unknown file in the feature space is determined, and a distance in the feature space between the file and a file cluster is calculated. The distance between the unknown file and the file cluster is used to determine whether or not to perform a deep scan on the unknown file. If such a need is identified, and the deep scan indicates the unknown file is malicious, a cybersecurity action is triggered.