Distributed Anti-Virus Scanning Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed messaging systems, duplicate anti-virus scanning of messages occurs due to complex protection software configurations, leading to inefficiencies and the need for either complex state representations or repeated scanning across different servers.
Innovation Solution
Implementing a two-element scanning scheme with a minimum threshold and a single valued marker to determine if a message has been scanned, ensuring it is only scanned once across the system, regardless of disparate scanning tools and criteria.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a persistent secure marker is added to indicate a message has been scanned, then duplicate scanning is reduced, but the system assumes an absolute guarantee that may not hold when protection configurations differ across servers
Solution Approach 1:
The patent changes the marker from a simple binary state (scanned/not scanned) to a parameter-rich structure that includes configuration version identifiers, scanner identifiers, and scanning results. This allows the marker to encode sufficient information to determine whether re-scanning is necessary based on configuration differences, thus maintaining both efficiency and reliability.
Solution Approach 2:
The patent introduces an intermediary evaluation process that compares the current server's protection configuration against the configuration encoded in the marker. This intermediary step acts as a mediator between the marker system and the scanning decision, determining whether the marker is valid for the current context without requiring absolute guarantees.
2Measurement precision
If a complex representation of protection state is used to accurately reflect different configuration settings, then scanning accuracy is improved, but the marker complexity increases significantly
Solution Approach 1:
The patent segments the protection state representation into distinct, manageable components: configuration version identifiers, scanner identifiers, and scanning results. Each component serves a specific purpose and can be independently processed, making the overall system less complex than a monolithic complex state representation would require.
3Reliability
If duplicate scanning is performed across all servers to ensure different settings are applied, then security coverage is improved, but system efficiency deteriorates due to redundant scanning
Solution Approach 1:
The patent makes the scanning decision dynamic by evaluating the relationship between the current server's protection configuration and the configuration encoded in the marker. Instead of a static always-rescan or never-rescan approach, the system dynamically determines whether scanning is necessary based on configuration comparisons, optimizing both security coverage and efficiency.
Data Source
AI summary
Techniques for optimizing distributed anti-virus (AV) scanning are described. In one implementation, a message is received into a multi-node network that includes a plurality of distributed scanning tools. An acceptable scanning policy threshold is determined that is representative of a plurality of individual scanning policy configurations of the plurality of scanning tools. A determination is made whether the message has previously been scanned to the acceptable scanning policy threshold based on a single valued element. If the message has been previously scanned, the message is allowed to be communicated. Otherwise, the message is scanned at the acceptable scanning policy threshold. If the scanning is successful, then the message is marked as having been scanned, and is allowed to be communicated. If the scanning is unsuccessful, the message is prevented from being communicated.