File Classification via Timestamp-Based Trust Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional file classification systems in security software face challenges with overwhelming numbers of suspicious or unknown files, leading to resource exhaustion and potential evasion of malicious files due to polymorphism, resulting in inefficient detection and classification processes.
Innovation Solution
The method involves identifying a point in time before which there is a non-zero probability that files have been classified, prioritizing analysis and security actions for files with timestamps before this point, and assigning a classification indicating they are not trusted, thereby focusing on potential threats and improving efficiency and effectiveness of security systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security systems analyze all suspicious files, then detection coverage is improved, but system resources are overwhelmed and productivity decreases
Solution Approach 1:
The system performs preliminary classification of files into trusted and untrusted categories based on timestamp comparison before detailed security analysis. Files with timestamps before the calculated point in time are automatically classified as untrusted, enabling early filtering that reduces the volume of files requiring resource-intensive analysis while maintaining detection coverage
Solution Approach 2:
The file population is segmented into distinct groups based on timestamp criteria: files before the point in time (classified as untrusted) and files after the point in time (requiring further analysis). This segmentation allows the system to apply different processing strategies to different segments, improving overall efficiency by handling the majority of files through rapid classification while dedicating resources only to the smaller subset requiring detailed inspection
2Speed
If security systems prioritize recent files, then analysis speed is improved, but detection of older malicious files deteriorates
Solution Approach 1:
The system performs preliminary classification of files into trusted and untrusted categories based on timestamp comparison before detailed security analysis. Files with timestamps before the calculated point in time are automatically classified as untrusted, enabling early filtering that reduces the volume of files requiring resource-intensive analysis while maintaining detection coverage
Solution Approach 2:
Files effectively classify themselves as untrusted or requiring analysis based on their own timestamp attributes. The system calculates a point in time representing when 95.4% of files should have been classified, then files with timestamps before this point automatically indicate they are candidates for untrusted classification, eliminating the need for resource-intensive analysis of obviously old files
3Measurement precision
If human experts manually inspect all unclassified files, then classification accuracy is improved, but labor resources are exhausted and time consumption increases
Solution Approach 1:
The system extracts and automatically classifies files that clearly meet the timestamp criteria (files before the point in time) as untrusted, removing these from the pool of files requiring human expert review. This leaves only the small subset of files after the point in time for potential manual inspection, dramatically reducing labor resource consumption while maintaining accuracy for the critical cases
Data Source
AI summary
The disclosed computer-implemented method for classifying files may include (i) identifying a point in time before which there is a non-zero probability that at least one file within a group of files has been classified by a security system, (ii) identifying, within the group of files, a file with a timestamp that indicates the file was created or modified before the point in time, (iii) assign, based on the timestamp of the file, a classification to the file that indicates the file is not trusted, and (iv) perform, by the security system, a security action based on the classification of the file. Various other methods, systems, and computer-readable media are also disclosed.