Executable File DNA Value Segmentation for Low-Resource Antivirus
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus systems for dedicated computer systems with low performance hardware face challenges in resource consumption and false-positive detections, leading to operational disturbances and incompatibility issues, particularly in systems like POS terminals and production facilities.
Innovation Solution
An apparatus and method that calculates a DNA value for individual parts of an executable file and compares it with stored DNA values to determine if the file is malicious or normal, minimizing resource usage and network traffic by using a server-based database for inspection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an antivirus engine is installed in a dedicated computer system with low performance hardware, then the system can detect and prevent malicious code, but the antivirus engine consumes significant system resources (CPU, memory, network traffic) and disturbs the operation of programs and application programs
Solution Approach 1:
The patent divides the file inspection process into segments by calculating hash values of individual parts (sections) of executable files rather than processing entire files. The calculation unit computes hash values of specific parts of files, and the inspection unit compares these partial hash values against stored values, significantly reducing CPU and memory consumption while maintaining detection capability.
Solution Approach 2:
The patent applies partial action by performing file inspection on selected parts rather than complete files. The system calculates hash values of only certain parts of executable files (such as headers or specific sections) and compares these against a database of known malicious code signatures, achieving effective detection with minimal resource usage.
2Reliability
If an antivirus engine is updated periodically to prevent infection by malicious code, then the detection capability is improved, but false-positive detection occurs causing normal files to be misidentified as malicious
Solution Approach 1:
The patent segments the file identification process by using multiple hash value comparisons. Instead of relying on a single hash comparison that may produce false positives, the system divides files into parts and compares hash values of multiple sections, cross-referencing against a comprehensive database to verify file legitimacy and reduce false-positive detections.
Solution Approach 2:
The patent implements a feedback mechanism where the inspection unit compares calculated hash values against a database of known files and their hash values. When a match is found, the system provides feedback to confirm the file's legitimacy. Additionally, the system can update its database based on inspection results, improving future detection accuracy while maintaining low false-positive rates.
3Reliability
If a Secure Operating System checks hash values of all executable files before execution, then file legitimacy is verified, but the terminal experiences increased load especially with large size files
Solution Approach 1:
The patent resolves this contradiction by segmenting the hash calculation process. Instead of calculating hash values for entire executable files which burdens the terminal, the system calculates hash values of only specific parts or sections of files. This partial processing approach maintains file verification capability while dramatically reducing processing time and terminal load.
Solution Approach 2:
The patent applies partial action by performing hash verification on selected parts of files rather than complete files. The calculation unit targets specific sections (such as file headers or critical code segments) for hash computation, enabling the terminal to verify file safety with minimal processing overhead and maintained productivity.
Data Source
AI summary
The invention relates to an apparatus for preventing infection by malicious code, comprising: a database in which files installed in an agent system, DNA values for each part of the files, and index information for indicating whether each file is normal or malicious are stored; a calculation unit which calculates a DNA value for a part of a file for which an execution is requested in the agent system; and a file inspection unit which searches the database to extract, in a group, files having the DNA value calculated by the calculation unit, inspects whether an object file is normal or malicious on the basis of the index information on the files extracted in a group, and allows the execution of the object file or makes a request for the calculation of DNA values of other parts which selectively include one part of the object file.