File Analysis System for Zero-Day Virus Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-virus software faces challenges in detecting and preventing unknown viruses, as they often require large databases of signatures and frequent updates, leading to increased latency and the risk of missing recent, dangerous viruses, and can be activated even if the software fails to run.
Innovation Solution
The method involves analyzing incoming electronic files to determine if they conform to predetermined data formats and regenerating them into 'clean' files that cannot execute unwanted code, thereby preventing viruses from reaching the computer and eliminating the need for extensive signature databases and frequent updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-virus software uses large databases of virus signatures and scanning modes to detect viruses, then detection capability is improved, but system latency increases and productivity decreases
Solution Approach 1:
The system performs preliminary analysis of files before they are executed, examining characteristics such as code density, instruction sequences, and structural patterns to identify viruses early in the process, thereby preventing execution without requiring extensive signature databases
Solution Approach 2:
The patent replaces the traditional mechanical approach of signature-based scanning with a behavioral and structural analysis system that examines file characteristics and execution patterns, eliminating the need for large signature databases and reducing scanning time
2Reliability
If anti-virus software maintains extensive signature databases to detect unknown viruses, then detection accuracy is improved, but the risk of missing recent viruses increases due to update frequency requirements
Solution Approach 1:
The system performs self-analysis by examining the structural and behavioral characteristics of files and programs to automatically identify viral patterns, eliminating the need for external database updates and enabling continuous protection against new viruses
Solution Approach 2:
The patent changes the detection parameters from static virus signatures to dynamic analysis of file characteristics, code density, instruction sequences, and execution behavior, allowing the system to adapt to new virus variants without database updates
3Reliability
If anti-virus software operates in monitor mode to check files at access time, then protection coverage is improved, but the time taken to access files increases
Solution Approach 1:
The system performs virus detection analysis before file access occurs by pre-examining file characteristics and structural patterns, allowing files to be accessed immediately after verification without the latency of continuous monitoring
Solution Approach 2:
The patent implements rapid analysis techniques that quickly examine file characteristics and identify viruses through streamlined processing of code density, instruction sequences, and structural patterns, minimizing the time required for verification
Data Source
AI summary
A method of processing an electronic file by identifying portions of content data in the electronic file and determining if each portion of content data is passive content data having a fixed purpose or active content data having an associated function. If a portion is passive content data, then a determination is made as to whether the portion of passive content data is to be re-generated. If a portion is active content data, then the portion is analyzed to determine whether the portion of active content data is to be re-generated. A re-generated electronic file is then created from the portions of content data which are determined to be re-generated.