File Classification via Digest Query for Security Scan Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The frequent updates of malware signatures in security software lead to performance losses in computers and networks due to the need for rescaning numerous files, which can be resource-intensive and result in a negative user experience, especially with large databases of known good files and asymmetric internet connections.
Innovation Solution
A security module on a client device computes a digest of files and sends identification information to a server, which queries a classification database to determine if files are trusted, allowing the client to skip trusted files during scans and reducing network bandwidth by only uploading one digest for multiple files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware signature updates are performed frequently, then security protection is improved, but computer performance deteriorates due to rescan requirements
Solution Approach 1:
The system performs preliminary classification of files as trusted or untrusted before malware scanning. By pre-identifying trusted files and storing their classification, the system avoids rescanning these files during signature updates, thus maintaining security while preserving performance.
Solution Approach 2:
The file system is segmented into trusted and untrusted files based on classification. This segmentation allows the security software to selectively scan only untrusted files while skipping trusted files, reducing the scanning workload during signature updates.
2Productivity
If a database of hashes of known good files is maintained, then scan speed is improved by skipping known files, but network traffic increases due to frequent updates
Solution Approach 1:
The system extracts only the essential classification information (trusted/untrusted status) from files and stores this metadata in a local database rather than storing complete file hashes. This extraction approach maintains scan speed benefits while reducing network traffic for updates.
Solution Approach 2:
Instead of copying and storing complete file hashes, the system creates simplified copies representing only the classification status. These lightweight classification records are stored locally and updated efficiently without requiring frequent large-scale network transfers.
3Measurement precision
If file hashes are uploaded to a server for verification, then file classification accuracy is improved, but client-server communication overhead increases
Solution Approach 1:
The server performs preliminary classification of files during a single upload operation, determining which files are trusted or untrusted. This preliminary action eliminates the need for repeated verification communications, reducing client-server interaction overhead while maintaining classification accuracy.
Solution Approach 2:
The system combines multiple file classification operations into a single server communication event. By batching classification requests and receiving comprehensive classification results in one transaction, the system reduces communication overhead while achieving accurate classification for multiple files.
4Reliability
If upload bandwidth is used to send file hashes to the server, then file verification is achieved, but network resource consumption increases due to asymmetric connections
Solution Approach 1:
The system extracts only the necessary classification result (trusted/untrusted determination) from the server rather than uploading complete file hashes for verification. This extraction approach achieves file verification reliability while minimizing upload bandwidth consumption by transmitting only essential classification metadata.
Data Source
AI summary
A computer-implemented method for determining file classifications. The method may include determining identification information of a first file stored on a first computing system. The method may also include querying a second computing system for classification information by sending the identification information of the first file to the second computing system. The first computing system may receive, in response to the query, identification information of a second file. The first computing system may also receive the classification information. The classification information may indicate that the first file and second file are trusted. The first computing system may use the identification information of the second file to determine that the second file is stored on the first computing system. The first computing system may also apply the classification information to the first and second files by excluding the first and second files from a security scan.