File Falsification Detection Using Position and Size Changes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods struggle to accurately and quickly detect file falsification, particularly in large files or numerous files, due to the need to read entire file contents for digest value generation and the challenge of patterns where attribute information remains unchanged despite content alteration.
Innovation Solution
A detection device that acquires position information and file size of target files, using these parameters to determine changes and detect falsification by comparing them against pre-defined criteria, thereby reducing the need to read entire file contents.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the entire file content is read to generate a digest value for falsification detection, then the detection accuracy is improved, but the detection time increases significantly
Solution Approach 1:
The patent extracts only the essential elements (position information and file size) from the complete file content verification process. Instead of reading and hashing entire file contents, the system extracts and compares just the position information and file size attributes, which are sufficient to detect falsification while avoiding the time cost of processing complete file contents.
Solution Approach 2:
The patent applies partial action by performing falsification detection on only the critical attributes (position information and file size) rather than the entire file content. This partial verification approach provides sufficient detection capability for most falsification scenarios while dramatically reducing the computational burden and time required compared to complete content hashing.
2Productivity
If attribute information is used for falsification detection, then the detection speed is improved, but the detection accuracy deteriorates due to patterns where attribute information remains unchanged
Solution Approach 1:
The patent merges two types of verification criteria: position information (which reflects file content integrity) and file size (an attribute property). By combining these two elements, the system achieves both speed and accuracy - the file size check provides quick filtering while the position information verification ensures detection of content changes even when size remains constant.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A detection device (10) acquires position information and a file size of a falsification detection target file. Then, the detection device (10) determines a change in the acquired position information or file size, and in a case where there is a change in the position information or file size, detects falsification of the falsification detection target file.