Cloud Shared White List for Malware Scanning Performance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware scanning technologies, particularly in Mac OS X, face performance issues due to the large number of files that need to be scanned, leading to time-consuming scans that are not acceptable for many users, and existing white list maintenance is tedious and prone to errors.
Innovation Solution
An improved scanning technique that automatically generates and shares a white list in the cloud, reducing duplicate scans and resource usage, and uses a full-disk cache with a single bit to represent file presence in the white list, allowing for quicker and more accurate malware scanning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual scanning is performed on all files, then scanning thoroughness is improved, but scanning time increases significantly
Solution Approach 1:
The system performs preliminary actions by pre-scanning files and adding them to a white list before they are needed. Files are scanned in advance and stored in a database, so when a user needs to access a file, it is already marked as safe and can be opened immediately without re-scanning. This preliminary action eliminates the need for repeated manual scanning while maintaining thoroughness.
Solution Approach 2:
The system creates a virtual copy of the scanning process by storing scan results in a database. Instead of physically scanning every file again, the system queries the database for existing scan results. This copying of scan information allows the system to maintain scanning thoroughness while dramatically reducing the time required, as it retrieves pre-computed scan results rather than performing new scans.
2Reliability
If a white list is maintained manually, then white list accuracy is improved, but maintenance complexity increases
Solution Approach 1:
The system performs self-service by automatically maintaining the white list through a database that tracks scan results. The database automatically records which files have been scanned and their status, eliminating the need for manual maintenance. The system monitors itself and updates the white list automatically based on new scan results, reducing maintenance complexity while preserving accuracy.
Solution Approach 2:
The system implements feedback mechanisms where scan results automatically feed back into the white list database. When a file is scanned, the result is recorded and immediately updates the white list status. This feedback loop ensures the white list remains accurate without manual intervention, as the system continuously updates itself based on new scan information.
3Reliability
If all files are scanned repeatedly, then malware detection reliability is improved, but resource consumption increases
Solution Approach 1:
The system uses copying by storing scan results in a database that can be queried multiple times without performing additional scans. Instead of repeatedly scanning the same files, the system copies the scan information from the database, which maintains malware detection reliability while significantly reducing resource consumption. The database serves as a reusable repository of scan results that can be accessed indefinitely.
Solution Approach 2:
The system performs preliminary scanning actions and stores the results for future reference. By completing the scanning action in advance and preserving the results, the system avoids the need for repeated resource-intensive scans. This preliminary action with result preservation maintains detection reliability while reducing ongoing resource consumption.
Data Source
AI summary
Each time a version of a virus pattern is downloaded to a local computer a scanned file cache is generated including all files scanned by that version. A modified file cache is also generated including all files modified while that version is present. After a minimum time interval or after a minimum number of virus pattern versions, a white list is generated by combining the existing white list, versions of the scanned file cache and the modified file cache. The white list (and the other caches) is represented by a single binary digit per file that is indexed by the i-node number of the file's i-node. A bundle of files (or their unique identifiers) on the white list is created and uploaded to a cloud storage service. A local computer sends a request to the storage service for the white list for a particular bundle which is then downloaded to the local computer.