File Tampering Detection via Access-Based Scan Patterns

The patent implements dynamic scan interval adjustment where the scan interval for each file is not fixed but adapts based on access frequency. Files with higher access frequencies are scanned more frequently, while files with lower access frequencies are scanned less frequently. This dynamic adjustment resolves the contradiction by making the scan system flexible rather than rigid, reducing overall scan time while maintaining detection reliability for critical files.

The patent changes the parameter of scan interval from a constant value to a variable value that depends on file access frequency. By calculating access frequency based on file access logs and adjusting scan intervals accordingly, the system optimizes the balance between detection reliability and scan time. High-frequency files get shorter scan intervals while low-frequency files get longer intervals, resolving the time-reliability contradiction.

The patent transforms the random scan approach by introducing a parameter-based selection mechanism. Instead of purely random selection, files are selected based on their access frequency parameters. This ensures that files which are more likely to be tampered with (those accessed frequently) are scanned more often, while still maintaining some randomness to prevent predictable patterns. This resolves the contradiction by making scan timing dependent on file characteristics rather than pure chance.

The patent implements a feedback mechanism where file access logs are continuously monitored and used to adjust future scan schedules. The system learns from past access patterns and adapts its scanning behavior accordingly. Files that show signs of frequent access receive increased scanning attention, ensuring timely detection while optimizing overall system resource usage. This feedback loop resolves the time-reliability contradiction by making scan intervals responsive to actual file usage patterns.

The patent applies local quality by treating different files differently based on their individual access frequencies. Instead of uniformly scanning all files on every access (which consumes excessive resources), the system assigns different scan priorities and intervals to different files. High-frequency files receive more intensive monitoring while low-frequency files receive less intensive monitoring. This local differentiation resolves the contradiction by concentrating resources where they are most needed rather than wasting them on all files equally.

The patent implements partial action by selectively scanning only certain files based on access frequency thresholds rather than scanning all files on every access. The system identifies a subset of files that require immediate scanning based on their access patterns, and performs scans only on those files. This partial approach reduces overall resource consumption while maintaining detection reliability for the most critical files, resolving the contradiction between comprehensive monitoring and resource efficiency.

The patent changes the scan frequency parameter from a uniform high value to a variable value based on file access frequency. By calculating access frequency for each file and setting scan intervals proportionally, the system achieves high detection reliability for frequently accessed files while reducing scan frequency for less critical files. This parameter-based differentiation resolves the contradiction by optimizing scan frequency rather than uniformly increasing it across all files.

The patent implements dynamic scan frequency adjustment where scan intervals are not static but adapt continuously based on monitored access patterns. As file access frequencies change over time, the scan frequencies automatically adjust to match. This dynamic approach ensures high detection reliability when needed while reducing resource consumption during periods of lower activity, resolving the productivity-reliability contradiction through adaptive behavior rather than fixed high-frequency scanning.