Gateway Anti-Virus Scanning of Partial File Downloads
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-virus solutions face challenges in detecting viruses when files are downloaded in portions, as virus signatures may span multiple portions, and current methods either require downloading the entire file or insufficiently scan partial content, leading to inefficiencies in bandwidth usage and detection effectiveness.
Innovation Solution
An anti-virus scanning system that assembles received file portions into blocks and scans the largest contiguous block for viruses, allowing for early detection and aborting the download if a virus is found, while performing a final scan on the entire file once all portions are received, thus enhancing detection efficiency and security without disrupting user experience.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If the gateway scans each file portion individually as it is received, then the scanning process can begin earlier, but the virus detection effectiveness deteriorates because virus signatures may span multiple portions and cannot be identified when scanned separately
Solution Approach 1:
The patent segments the scanning process into two distinct phases: an initial phase that scans individual file portions as they are received (using signature-based detection for quick matches), and a subsequent phase that scans the complete assembled file (using heuristic analysis for comprehensive detection). This segmentation allows the system to begin scanning early while maintaining detection effectiveness through the combination of both phases.
Solution Approach 2:
The patent performs preliminary scanning actions on individual file portions as they are received during download, rather than waiting for the complete file. This preliminary action uses virus signature comparison to quickly identify known threats, enabling early detection and potential download termination while maintaining security effectiveness.
2Reliability
If the gateway waits for the entire file to be downloaded before scanning, then comprehensive virus scanning can be performed, but bandwidth usage increases and download time is extended
Solution Approach 1:
The patent performs preliminary virus signature scanning on individual file portions as they are received during download, rather than waiting for the complete file. This allows the system to identify and terminate downloads of infected files early, avoiding the waste of bandwidth that would occur if entire infected files were fully downloaded before detection.
Solution Approach 2:
The patent implements a mechanism to skip the remainder of the download process once a virus is detected in any file portion. Instead of completing the full download and then scanning, the system rushes through the detection phase by continuously scanning received portions and immediately terminating the download upon virus detection, thereby conserving bandwidth and reducing unnecessary data transfer.
3Loss of energy
If the gateway limits scanning to only the downloaded portions, then bandwidth usage is reduced, but the virus detection capability deteriorates because virus signatures may be spread across multiple portions
Solution Approach 1:
The patent segments the virus detection approach into two complementary methods: signature-based scanning of individual file portions (which works for viruses contained within single portions) and heuristic analysis of the complete assembled file (which detects viruses spanning multiple portions). This segmentation allows the system to maintain low bandwidth usage while preserving comprehensive detection capability.
Solution Approach 2:
The patent merges two different scanning approaches—individual portion scanning using virus signatures and complete file scanning using heuristic analysis—into a unified detection system. This combination allows the gateway to effectively detect viruses regardless of whether they are contained within single file portions or distributed across multiple portions, thereby overcoming the limitation of portion-based scanning alone.
4Reliability
If the gateway downloads the entire file before scanning, then complete file scanning is possible, but the download time and processing time increase significantly
Solution Approach 1:
The patent performs preliminary virus signature scanning on individual file portions as they are received during download, rather than waiting for the complete file. This preliminary action enables the system to detect and terminate downloads of infected files early, significantly reducing the total time required compared to downloading entire files before scanning.
Solution Approach 2:
The patent implements a mechanism to skip the remainder of the download process once a virus is detected in any file portion. Instead of completing the full download and then scanning, the system rushes through the detection phase by continuously scanning received portions and immediately terminating the download upon virus detection, thereby conserving both time and bandwidth.
Data Source
Figure 1
Figure 2a~2c
Figure 3
AI summary
A client device transmits requests via a gateway to a server in a network environment. The requests indicate specific portions of a file on a server to be transmitted as part of the download process. The gateway receives into its memory the requested portions of the file and assembles the received portions into an assembly file. The gateway continuously scans the largest contiguous sequence of the portions in the assembly file for viruses while the requested portions of the file are being received and become available before feeding the received portions to the client computer. By scanning the largest consecutive sequence while new portions become available, the time to complete the scan is reduced thereby increasing the throughput of the gateway.