File Filter Driver Virus Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus software struggles to effectively prevent the propagation of computer viruses due to their strong infectivity, leading to decreased system safety as cleaned files can become re-infected shortly after scanning.
Innovation Solution
A method that involves obtaining the file type and process information of infected files, monitoring for malicious events, and refusing access to files of the same type to prevent further infection, using a file filter driver to record and manage correspondence between file types and process IDs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus software cleans virus codes from infected files, then the infected files are cleaned, but cleaned files can be re-infected very shortly due to strong virus infectivity
Solution Approach 1:
The patent applies preliminary action by proactively monitoring file access requests and comparing them against a database of malicious process-file type combinations before the virus can execute. This preemptive approach prevents re-infection by blocking malicious processes from accessing susceptible file types, rather than waiting for infection to occur and then cleaning it.
Solution Approach 2:
The system implements feedback by continuously monitoring file access events, comparing process information against stored correspondence data, and dynamically responding to potential threats. The monitoring module provides real-time feedback on file access attempts, enabling the system to adaptively block malicious activities while allowing legitimate operations to proceed.
2Reliability
If antivirus software scans and cleans files, then virus codes are removed, but it is difficult to effectively prevent the propagation of the virus in the system
Solution Approach 1:
The patent extracts the harmful element by identifying and isolating the malicious process information associated with virus propagation. By separating the identification of malicious processes from the file cleaning function, the system can specifically target and block the propagation mechanism while preserving legitimate file operations.
Solution Approach 2:
The system introduces an intermediary monitoring module that acts as a mediator between file access requests and the file system. This intermediary layer checks process information against the correspondence database and blocks malicious access attempts before they can propagate the virus, without interfering with legitimate file operations.
3Reliability
If the system monitors and refuses process access to file types, then virus propagation is prevented, but the system complexity increases due to additional monitoring and correspondence management
Solution Approach 1:
The monitoring module performs multiple functions: it monitors file access requests, identifies malicious processes by comparing process information against the correspondence database, and blocks suspicious activities. By consolidating these functions into a single multi-functional module, the system reduces overall complexity while maintaining comprehensive security.
Solution Approach 2:
The system manages complexity by dynamically adjusting monitoring parameters based on the correspondence database. Rather than implementing complex real-time analysis of all file access patterns, the system uses pre-established correspondence between process information and file types to efficiently identify and block malicious activities with simpler, faster parameter-based matching.
Data Source
AI summary
A method, an apparatus and a system for processing a computer virus. The method comprises: obtaining the file type of a file which is infected with a computer virus and the process information of a process which is used by the virus when accessing the file; monitoring whether a malicious event occurs in s system, wherein the malicious event is an event which is triggered when the process corresponding to the process information accesses the file of the file type; and refusing the process to access the file of the file type when it is monitored that the malicious event occurs.