Early File Security Classification via Metadata Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security platforms face high temporal and resource costs in determining security classifications of files, as they need to wait for complete file receipt, and rely on unreliable methods like URL reputations and partial file analysis, which can lead to delayed protection and resource inefficiency.
Innovation Solution
A security platform computes a hash based on metadata during file receipt and compares it to a stored hash to determine security classification before file completion, allowing for early in-line blocking and reducing resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the security platform waits for complete file receipt before determining security classification, then the accuracy of security analysis is improved, but the temporal cost and resource consumption increase significantly
Solution Approach 1:
The patent applies preliminary action by computing a hash of the file during receipt based on metadata (such as file header information) before the complete file is received. This hash is then compared against stored hashes in a database to determine security classification early in the process, eliminating the need to wait for complete file receipt while maintaining reliable security assessment through hash-based identification of known malicious files.
2Reliability
If the security platform performs complete file analysis, then the security classification reliability is improved, but the resource consumption increases
Solution Approach 1:
The patent extracts only the essential identifying characteristics of the file (metadata and hash values) rather than analyzing the entire file content. By computing a hash based on metadata during file receipt and comparing it against a database of known malicious file hashes, the system achieves reliable security classification with minimal resource consumption, avoiding the need to process the complete file.
3Speed
If the security platform uses URL reputations and partial file analysis, then the processing speed is improved, but the reliability of security classification deteriorates
Solution Approach 1:
The patent uses a hash value (a digital fingerprint or copy of the file's identifying characteristics) rather than analyzing the actual file content or relying on URL reputations. This hash-based approach enables fast processing by comparing compact hash values against a database, while maintaining high reliability because the hash uniquely identifies the file and can definitively match known malicious files in the security database.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
A security platform may determine, during receipt of a file, metadata associated with the file. The file may be intended for a client device. The security platform may compute, based on the metadata and during the receipt of the file, a hash associated with the file. The security platform may identify, during the receipt of the file, a stored hash that matches the hash associated with the file. The security platform may determine a security classification of the file based on information associated with a security classification corresponding to the stored hash. The security classification of the file may be determined before the receipt of the file is complete. The security platform may selectively permit, based on the security classification of the file, the client device to complete a receipt of the file.