Distributed Malware Detection via Peer-to-Peer Node Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Centralized mechanisms for distributing malware information are inadequate in keeping pace with the rapid emergence and spread of new malware types, leading to increased infections as antivirus software often fails to detect new threats in a timely manner.
Innovation Solution
A distributed malware detection system where security clients on multiple computer nodes within local or remote networks communicate directly to share information about new malware, with nodes selecting the most suitable source based on geographic proximity or other criteria to facilitate rapid identification and remediation of unknown files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If centralized mechanisms are used for distributing malware information, then system structure is simple and easy to manage, but detection speed and responsiveness to new malware are insufficient
Solution Approach 1:
The patent segments the centralized antivirus system into multiple distributed security clients deployed on different computer nodes. Each client independently performs malware analysis and shares results with others, eliminating the single-point bottleneck of centralized systems and enabling parallel processing of malware detection tasks across the network.
Solution Approach 2:
The patent combines the computational resources and detection capabilities of multiple computer nodes into a unified distributed detection network. By merging individual node capabilities through peer-to-peer communication, the system achieves collective intelligence that surpasses any single node while maintaining distributed autonomy.
2Productivity
If centralized servers are used for malware information distribution, then information management is centralized and controlled, but the system fails to keep up with the rapid emergence and spread of new malware
Solution Approach 1:
The patent implements preliminary action by having security clients continuously perform malware analysis on local files and proactively share detection results with other nodes before widespread infection occurs. This proactive approach allows the network to pre-identify and respond to emerging threats, eliminating the reactive delay inherent in centralized update models.
Solution Approach 2:
The patent establishes a feedback mechanism where security clients continuously exchange malware analysis results and detection data with other nodes in real-time. This distributed feedback loop enables rapid propagation of threat intelligence across the network, allowing all nodes to benefit from detections made by any individual node without waiting for centralized server updates.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are a system and a method of distributed detection of malware. An example system includes a security client deployed on a computer node. The security client is operable to identify and communicate with similar security clients deployed on other computer nodes located in a local or remote computer networks. The security client is configured to: perform a malware analysis of files on the computer node; identify unknown files; collect information and statistics data about the unknown file; transmit to other computer nodes a request for identification about the unknown file; receive from at least one other computer node a response containing the identification of the unknown file as a malicious file and a malware remediation tool, wherein the remediation tool includes information, statistics data and malware repair or removal instructions for the malicious file; and use the received malware remediation tool to repair or remove the malicious file.