Distributed Malware Detection via Peer-to-Peer Node Communication

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Centralized mechanisms for distributing malware information are inadequate in keeping pace with the rapid emergence and spread of new malware types, leading to increased infections as antivirus software often fails to detect new threats in a timely manner.

Innovation Solution

A distributed malware detection system where security clients on multiple computer nodes within local or remote networks communicate directly to share information about new malware, with nodes selecting the most suitable source based on geographic proximity or other criteria to facilitate rapid identification and remediation of unknown files.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If centralized mechanisms are used for distributing malware information, then system structure is simple and easy to manage, but detection speed and responsiveness to new malware are insufficient

Engineering Contradiction:
Improvemalware detection speedVSAvoidsystem complexity
Core Design Contradiction:
SpeedVSDevice complexity

Solution Approach 1:

The patent segments the centralized antivirus system into multiple distributed security clients deployed on different computer nodes. Each client independently performs malware analysis and shares results with others, eliminating the single-point bottleneck of centralized systems and enabling parallel processing of malware detection tasks across the network.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent combines the computational resources and detection capabilities of multiple computer nodes into a unified distributed detection network. By merging individual node capabilities through peer-to-peer communication, the system achieves collective intelligence that surpasses any single node while maintaining distributed autonomy.

Inventive Principle:
Principle #5Merging (Combining)

2Productivity

If centralized servers are used for malware information distribution, then information management is centralized and controlled, but the system fails to keep up with the rapid emergence and spread of new malware

Engineering Contradiction:
Improvemalware detection efficiencyVSAvoidtime lag in detecting new malware
Core Design Contradiction:
ProductivityVSLoss of time

Solution Approach 1:

The patent implements preliminary action by having security clients continuously perform malware analysis on local files and proactively share detection results with other nodes before widespread infection occurs. This proactive approach allows the network to pre-identify and respond to emerging threats, eliminating the reactive delay inherent in centralized update models.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent establishes a feedback mechanism where security clients continuously exchange malware analysis results and detection data with other nodes in real-time. This distributed feedback loop enables rapid propagation of threat intelligence across the network, allowing all nodes to benefit from detections made by any individual node without waiting for centralized server updates.

Inventive Principle:
Principle #23Feedback

Data Source

PatentEP3038006B1System and method for distributed detection of malware
Publication Date: 2024.04.10 AO KASPERSKY LAB
  • EP3038006B1 patent drawingFigure 1
  • EP3038006B1 patent drawingFigure 2
  • EP3038006B1 patent drawingFigure 3

AI summary

Disclosed are a system and a method of distributed detection of malware. An example system includes a security client deployed on a computer node. The security client is operable to identify and communicate with similar security clients deployed on other computer nodes located in a local or remote computer networks. The security client is configured to: perform a malware analysis of files on the computer node; identify unknown files; collect information and statistics data about the unknown file; transmit to other computer nodes a request for identification about the unknown file; receive from at least one other computer node a response containing the identification of the unknown file as a malicious file and a malware remediation tool, wherein the remediation tool includes information, statistics data and malware repair or removal instructions for the malicious file; and use the received malware remediation tool to repair or remove the malicious file.