Document File Healing via Object Segmentation and Reconstruction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to seamlessly and efficiently heal infected document files, particularly those received via electronic messages, as they often diagnose without correcting or do so inefficiently, lacking automated and bulk processing capabilities.
Innovation Solution
A computer-implemented method that parses document files into separate objects, identifies and removes potentially malicious content, reconstructs the files to preserve readability, and provides access to the healed documents, incorporating a security program with modules for reception, discovery, healing, reconstruction, and provisioning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional systems diagnose corrupted document files without correcting them, then diagnostic capability is provided, but productivity and user convenience deteriorate due to lack of automated correction
Solution Approach 1:
The system segments the document file into multiple separate objects during parsing, allowing individual identification and healing of infected objects without processing the entire file as one unit. This enables efficient automated correction while maintaining convenience for users.
Solution Approach 2:
The system performs preliminary parsing and identification of infected objects before final document reconstruction. By detecting and healing infected objects in advance during the parsing phase, the system automates the correction process, improving both convenience and processing efficiency.
2Measurement precision
If systems work directly on document files with multiple passes during parsing, then thorough detection is achieved, but processing efficiency deteriorates due to large number of passes
Solution Approach 1:
By dividing the document into separate parseable objects and analyzing them individually, the system achieves thorough detection of infected content without requiring multiple complete passes through the entire document, thereby improving processing speed while maintaining detection accuracy.
Solution Approach 2:
The system extracts and identifies infected objects during the parsing process itself, rather than requiring separate detection passes. This extraction approach allows thorough detection to be integrated into the single parsing operation, improving processing efficiency without sacrificing detection precision.
3Productivity
If automated healing processes are implemented, then productivity and convenience improve, but system complexity increases due to additional processing steps
Solution Approach 1:
The system merges the detection, healing, and reconstruction operations into an integrated automated process that occurs during document parsing. By combining these functions into a unified workflow, the system achieves high productivity through automation while managing complexity through functional integration rather than separate independent systems.
Solution Approach 2:
The system enables self-service automated healing where the security program independently identifies infected objects, applies healing operations, and reconstructs the document without requiring external intervention. This self-service capability improves productivity while the automation is managed through the existing parsing infrastructure, controlling system complexity.
4Measurement precision
If document files are parsed into separate objects for detection, then detection accuracy improves, but processing time increases due to detailed analysis required
Solution Approach 1:
The system segments the document into objects during a single parsing operation and performs detection on these segments. This segmentation approach enables accurate identification of infected objects while avoiding the time penalty of multiple complete document passes, as the segmentation and detection occur in an integrated single-pass process.
Data Source
AI summary
A computer-implemented method for healing infected document files may include (1) receiving an electronic message directed to a target client computing system, the electronic message including a document file, (2) in response to receiving the electronic message, discovering, by a security program, that the document file is infected with potentially malicious content by, parsing the document file into separate objects and detecting that one of the separate objects is infected with potentially malicious content, (3) healing, by the security program, the infected object by removing the potentially malicious content from the object, (4) reconstructing, by the security program, the document file by reuniting the healed separate object with a remainder of the separate objects in a manner that preserves readability of the document, and (5) providing access to the readable reconstructed document file at the target client computing system. Various other methods, systems, and computer-readable media are also disclosed.