File Tampering Detection via Access-Based Scan Scheduling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional software tampering detection methods face challenges in reducing the likelihood of authorized programs executing illicitly tampered files while efficiently managing resource usage, with cyclic scans being time-consuming, random scans being unpredictable, and on-access scans consuming significant resources.
Innovation Solution
A tampering detection system that determines a scan pattern based on access patterns and file sizes to optimize scanning order, using a genetic algorithm to minimize the time between scanning and file access, thereby reducing the risk of executing tampered files while conserving resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cyclic scan method is used, then all files are scanned in a fixed order, but the time taken to scan all files becomes long and tampering detection is delayed
Solution Approach 1:
The patent applies dynamics by transitioning from a fixed cyclic scan order to a dynamic scan pattern that adapts to file access characteristics. The scan pattern is adjusted based on which files are most frequently accessed, allowing the system to prioritize scanning of recently or frequently accessed files, thereby reducing the time to detect tampering while maintaining comprehensive coverage.
Solution Approach 2:
The patent applies local quality by differentiating the scanning strategy for different files based on their access patterns. Instead of uniform scanning, the system identifies files with higher access frequency or recent access and prioritizes their scanning, allocating scanning resources more efficiently to where they are most needed for tampering detection.
2Adaptability or versatility
If random scan method is used, then file selection is unpredictable, but it may take an enormous amount of time between scans of certain files
Solution Approach 1:
The patent applies feedback by using access pattern information to adjust the scan pattern. The system monitors which files are accessed most frequently or recently and uses this feedback to modify the scanning schedule, ensuring that files with higher access patterns are scanned more frequently. This eliminates the unpredictability of random scanning while preventing excessive wait times for frequently accessed files.
3Reliability
If on-access scan method is used, then tampering execution possibility is reduced to almost zero, but memory and CPU resources are consumed considerably and I/O response is reduced
Solution Approach 1:
The patent applies partial action by implementing scanning only for files that are most likely to be tampered with based on access patterns, rather than scanning all files continuously as in on-access methods. The system calculates a risk score for each file based on access frequency and recent access timing, and prioritizes scanning of high-risk files, thereby achieving tampering prevention for critical files while reducing overall resource consumption.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A tampering detection device (10) includes: an acquisition unit (14a) that acquires an access pattern of a monitoring target file; an extraction unit (14b) that extracts a time-series pattern of access for each monitoring target file from the access pattern acquired by the acquisition unit (14a); and a determination unit (14c) that determines a scan pattern on the basis of the time-series pattern of access extracted by the extraction unit (14b).