Distributed Malware Detection via Client-Server Heuristic Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods fail to provide complete protection as standalone tools, as malicious software evolves and uses new methods to penetrate computer systems, concealing activities and bypassing detection.
Innovation Solution
A distributed client-server system that receives client heuristics information, identifies suspicious files, collects threat-identification information, and transmits it to a server system for further analysis using more computationally intensive heuristic information, determining a security status and applying security tools to block or remove potentially malicious files based on confidentiality levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional malware detection methods are used as standalone tools, then device complexity is reduced, but detection reliability deteriorates because malicious software evolves and bypasses detection
Solution Approach 1:
The malware detection system is segmented into two distinct parts: a client system that performs initial detection using lightweight heuristics, and a server system that performs advanced analysis using computationally intensive heuristics. This segmentation allows the system to maintain high reliability through multiple detection layers while managing complexity by distributing computational loads appropriately across client and server infrastructure.
2Productivity
If client heuristics information is used for detection, then productivity is improved through faster local analysis, but measurement precision deteriorates compared to server-side analysis
Solution Approach 1:
The client system performs preliminary detection actions using lightweight heuristics to quickly identify potentially malicious files. This preliminary action filters out obvious threats locally, providing fast initial responses. Files that pass through or fail this preliminary check are then subjected to more precise server-side analysis, ensuring both speed and accuracy are achieved at different stages of the detection process.
3Measurement precision
If computationally intensive heuristic information is maintained at the server, then detection precision is improved, but use of energy increases due to server processing requirements
Solution Approach 1:
The system applies partial action by using lightweight heuristics at the client for initial filtering, and only applying the full computationally intensive heuristic analysis at the server for files that require deeper inspection. This partial application of intensive processing reduces overall energy consumption while maintaining detection precision for files that truly need advanced analysis.
Data Source
AI summary
Disclosed are systems, methods and computer program products for determining a security status of at least one potentially malicious file in a customer network. An example method comprising receiving, by a client computer system, client heuristics information from a server system for determining a security status of client data generated by at least one client application; monitoring and identifying at least one suspicious file of the client data as a potentially malicious file by analyzing metadata associated with the at least one suspicious file using the client heuristics information; collecting threat-identification information of the potentially malicious file to exclude confidential information associated with a content of the potentially malicious file; transmitting the threat-identification information to the server system for determining a security status of the potentially malicious file; and receiving security tools from the server system to block or remove the potentially malicious file.