Collaborative Malware Scanning via Client-Server Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods are computationally intensive and resource-heavy, and content-based methods rely on large signature databases that require frequent updates, leading to performance issues and increased network traffic.
Innovation Solution
A collaborative malware detection system that performs a client-server scan, where the client conducts a preliminary scan and sends object data indicators to a server for further analysis, with the server performing server-side scans and sending results back to the client, minimizing resource usage and database updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavior-based scanning is performed on the client side, then malware detection capability is improved, but computational resource consumption increases
Solution Approach 1:
The malware scanning process is divided into two segments: a lightweight client-side component that performs initial scanning and a server-side component that performs computationally intensive behavior-based analysis. This segmentation allows the client to maintain detection capability while offloading heavy computational tasks to the server, thus resolving the contradiction between detection capability and resource consumption.
Solution Approach 2:
A server acts as an intermediary between the client and the malware analysis process. The client sends file hashes and basic information to the server, which then performs the heavy behavior-based scanning and returns results. This intermediary approach enables sophisticated malware detection without burdening the client's computational resources.
2Reliability
If large signature databases are maintained on the client side, then content-based malware detection is improved, but storage requirements and update complexity increase
Solution Approach 1:
The large signature database is extracted from the client side and relocated to the server side. The client maintains only a minimal local database for immediate protection, while the server hosts the comprehensive signature database and distributes updates centrally. This extraction resolves the contradiction by maintaining detection capability while dramatically reducing client storage requirements and simplifying update management.
Solution Approach 2:
The server is designed to serve multiple functions: it acts as a signature database repository, an update distribution center, and a behavior-based analysis engine. This multi-functional server approach allows the system to maintain robust content-based detection without requiring each client to store and manage large signature databases independently.
3Reliability
If frequent signature database updates are distributed to multiple clients, then malware detection accuracy is improved, but network traffic and update complexity increase
Solution Approach 1:
Multiple clients are merged into a single update recipient model where the server distributes signature updates to each client individually but centrally manages the update process. This consolidation of update distribution through a single server point reduces redundant network traffic compared to a decentralized update model, while still maintaining up-to-date detection accuracy across all clients.
4Reliability
If behavior-based scanning is performed locally, then real-time malware detection is improved, but system performance and user productivity decrease
Solution Approach 1:
The system performs preliminary lightweight scanning on the client side that can quickly identify obvious threats without heavy computational overhead. This preliminary action provides immediate protection while avoiding the performance degradation associated with full behavior-based analysis, thus maintaining both real-time detection and user productivity.
Solution Approach 2:
Instead of performing complete behavior-based analysis on every file, the system applies partial scanning actions only when necessary—when the lightweight client-side scan detects suspicious patterns or when the server requests further analysis. This selective approach maintains real-time detection capability while minimizing the impact on system performance and user productivity.
Data Source
AI summary
In some embodiments, a malware detecting system is configured to conduct an iterative, collaborative scan of a target object (computer file or process), comprising a server-side scan and a client-side scan, and to assess the malware status of the target object according to the results of the client-side and server-side scans. The client-side scan comprises computationally-intensive operations such as virtual-environment emulation, decryption and data compression methods, while the server-side scan comprises database-intensive operations such as hash lookups. The information exchanged between client and server systems may be limited to relatively-compact data, such as hashes, which may amount to a few bytes per target object. Exemplary methods and systems described herein allow storing malware signature databases on the server side, thus reducing the burden of frequently delivering data-heavy signature updates to large numbers of customers, without requiring the server side to perform computationally-intensive scanning tasks for large numbers of customers.