File System Call Interception for Antivirus Efficiency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity and volume of antivirus technologies lead to inefficient operations due to 'needless scans' and data desynchronization during file system scanning, particularly when antivirus applications perform scans that are not utilized or interfere with other processes.
Innovation Solution
A system and method that intercepts calls to the file system, determines their parameters and priorities, and selectively executes them based on interference and priority, using a software agent to manage and redirect calls to minimize unnecessary operations and maintain data integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus applications perform comprehensive file system scanning, then detection capability is improved, but system performance deteriorates due to needless scans and data desynchronization
Solution Approach 1:
The patent implements preliminary action by intercepting file system calls before they reach the antivirus scanning engine. The software agent analyzes incoming calls, determines their priority and necessity, and filters out needless scans in advance. This preliminary filtering prevents unnecessary scanning operations from consuming system resources, thereby maintaining high detection capability for genuine threats while preserving overall system performance.
Solution Approach 2:
The patent introduces a software agent as an intermediary component between the file system and the antivirus scanning engine. This intermediary intercepts file system calls, evaluates their parameters and priorities, and selectively routes them to the scanning engine. By acting as a mediator, the software agent prevents needless scans from reaching the antivirus engine, reducing unnecessary system load while ensuring that legitimate scanning operations are executed with high detection capability.
2Measurement precision
If antivirus applications increase scanning frequency and depth, then detection accuracy is improved, but data desynchronization with other processes increases
Solution Approach 1:
The patent implements dynamics by making the antivirus scanning process adaptive rather than static. The software agent dynamically evaluates the priority and characteristics of each file system call in real-time, adjusting the scanning behavior based on current system conditions. High-priority calls that require immediate scanning are processed with high detection accuracy, while low-priority calls are deferred or filtered out, preventing data desynchronization with other processes that are modifying the same files.
Solution Approach 2:
The patent applies parameter changes by analyzing multiple parameters of file system calls (such as call type, file attributes, process identifiers) and using these parameters to determine scanning priority. The software agent changes the execution parameters of scanning operations based on the evaluated priority levels, ensuring that scanning occurs at the appropriate moment when data synchronization can be maintained while still achieving high detection accuracy for critical files.
3Reliability
If antivirus libraries and heuristic algorithms are expanded, then malware detection capability is improved, but computational overhead increases
Solution Approach 1:
The patent extracts the function of preliminary call evaluation and filtering from the main antivirus scanning engine and places it in a separate software agent. This extraction allows the antivirus libraries and heuristic algorithms to remain expanded and sophisticated for high detection capability, while the software agent handles the computationally intensive task of filtering needless calls before they reach the scanning engine, thereby reducing the computational overhead on the main system.
Solution Approach 2:
The patent applies partial action by having the software agent perform selective filtering of file system calls rather than scanning all calls. The agent evaluates call parameters and priorities, applying the sophisticated antivirus libraries and heuristic algorithms only to high-priority calls that are likely to be malicious. This partial application of the detection capability reduces computational overhead while maintaining high malware detection effectiveness for the most critical cases.
Data Source
AI summary
Disclosed are system and method for executing calls to a file system of a computer. An exemplary method comprises intercepting, by a software agent, a call to the file system; determining one or more parameters of the call that identify its functionality; determining a priority of executing the call based on the one or more parameters; storing information about the call, the parameters and the priority into a database; selecting from the database, one or more calls for execution based at least in part on relative priorities of execution of the plurality of calls stored in the database; determining whether to execute or not to execute a selected call based on whether the selected call interferes with execution of an earlier selected call; and when the selected call does not interfere with execution of an earlier selected call, passing the selected call to the file system for execution.