Event-Triggered Malware Analysis for File Sharing Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security appliances cause latency in file sharing systems due to their complexity and the divergence of storage protocols, making it difficult to effectively detect and prevent malware attacks across different file systems.
Innovation Solution
A threat detection system that utilizes monitoring logic to intercept notification messages from storage systems for state change events, allowing for triggered malware analysis through static and behavioral analysis, and provides alerts and remediation actions such as quarantine or removal of malicious objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security appliances are deployed in-line with storage servers to detect malware, then malware detection capability is improved, but system latency increases and user experience deteriorates
Solution Approach 1:
The security system is segmented into separate components: the file sharing system continues to operate normally while the malware analysis is performed in a separate analysis system. The monitoring logic acts as an intermediary that triggers analysis only when needed, rather than blocking all file operations for continuous scanning.
Solution Approach 2:
Instead of continuous scanning that blocks all operations, the system performs periodic malware analysis only when state change events occur (file creation, modification, deletion). This event-driven approach reduces latency by analyzing files only when necessary rather than continuously.
2Reliability
If continuous malware scanning is performed on all files, then malware detection thoroughness is improved, but system overhead and processing time increase
Solution Approach 1:
The system performs partial scanning by analyzing only files that have state changes (newly created or modified files) rather than scanning all files continuously. This selective approach maintains thorough detection for relevant files while reducing overall system overhead and processing requirements.
Solution Approach 2:
The file system's native state change notification mechanism is leveraged to trigger malware analysis automatically. The system uses its own event infrastructure (file creation, modification, deletion events) to initiate security checks, eliminating the need for separate continuous scanning processes.
3Adaptability or versatility
If security appliances must understand and process multiple storage protocols, then compatibility with different file systems is improved, but device complexity increases
Solution Approach 1:
The monitoring logic acts as an intermediary between the file system and the malware analysis system. It intercepts state change events from the file system and forwards relevant information to the analysis system, which performs protocol-agnostic malware detection. This intermediary approach allows the security system to work with multiple file systems without requiring the analysis component to understand each storage protocol.
4Reliability
If malware analysis is performed on every file operation, then security coverage is improved, but system performance and user experience deteriorate
Solution Approach 1:
The system performs malware analysis periodically based on state change events rather than on every file operation. By triggering analysis only when files are created, modified, or deleted, the system maintains comprehensive security coverage for relevant files while minimizing performance impact and preserving smooth user experience during normal file access operations.
Data Source
AI summary
According to one embodiment, a system featuring one or more processors and memory that includes monitoring logic. During operation, the monitoring logic is configured to monitor for and detect a notification message that is directed to a destination other than the monitoring logic and identify an event associated with a change in state of a data store associated with the file system to occur. The notification message, at least in part, triggers a malware analysis to be conducted on an object associated with the state change event.