Network File Collection System for Malware Trend Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus systems are ineffective in real-time detection of malware trends and require frequent updates, producing outputs not easily integrated into automated systems, and often interfere with malware operation rather than preventing it.
Innovation Solution
A cloud-based system that collects files transmitted over networks, performs static and dynamic analysis, stores them in an indexed database for rapid search functionality, and provides an API for identifying malware campaigns, allowing for retrospective analysis and trend identification without immediate determination of file malice.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing antivirus systems perform sequential local analysis of files, then they can provide immediate verdicts, but they fail to detect malware trends in real-time and require frequent updates
Solution Approach 1:
The system performs preliminary actions by collecting and storing file metadata (hashes, sizes, types) in a database before full analysis is needed. When files are submitted for analysis, the system first checks the database for duplicate metadata, allowing rapid identification of known files without re-uploading or re-analyzing them fully. This preliminary metadata storage and comparison mechanism eliminates the need for frequent full-system updates while maintaining detection accuracy.
Solution Approach 2:
The patent introduces an intermediary database that stores file metadata between the file collection point and the analysis engine. This intermediary layer allows the system to track file trends and patterns over time without requiring direct sequential processing of every file. The database acts as a mediator that enables real-time trend detection while decoupling the file submission rate from the analysis rate, solving the update timing problem.
2Productivity
If antivirus systems analyze large numbers of files locally, then they can provide immediate detection, but they produce output not easily incorporated into automated systems
Solution Approach 1:
The system segments the file analysis process into distinct modular components: file collection, metadata extraction, database storage, duplicate detection, and full analysis. Each component operates independently and communicates through standardized data structures. The collection system submits files with metadata, the database stores and retrieves based on query criteria, and the analysis engine processes files autonomously. This segmentation enables automated orchestration and integration with external systems through defined interfaces.
Solution Approach 2:
The analysis system operates autonomously by automatically querying the database for files requiring analysis, retrieving them, performing detection, and storing results without human intervention. The system self-manages the workflow from file identification through analysis to result storage, enabling seamless integration into automated security operations centers and incident response systems.
3Reliability
If existing systems store and analyze every file, then they ensure comprehensive detection, but they cannot efficiently handle large volumes of transmitted files
Solution Approach 1:
The system applies partial action by performing metadata-level comparison for all files (excessive action at low cost) and full analysis only for files that pass the metadata filter (partial action at high cost). The database stores metadata for a comprehensive set of known files, and incoming files are quickly compared against this metadata set. Only files that don't match existing metadata patterns proceed to full analysis, dramatically increasing processing speed while maintaining detection reliability through the two-layer approach.
Data Source
AI summary
A computer-implemented method for collecting files transmitted on a network for subsequent malware analysis is disclosed. The method comprises determining, by a sensor, that a file has been transmitted on the network; transmitting, from the sensor to an intermediate agent, the file; storing, by the intermediate agent, the file, pending a determination whether metadata of the file indicates an identical copy of the file has likely already been stored by a source collection subsystem; responsive to a determination that the file has not likely already been stored by the source collection subsystem, transmitting the file from the intermediate agent to the source collection subsystem; verifying, by the source collection subsystem, that the file has not likely already been stored by the source collection subsystem; and storing the file for future analysis.