IoT Device Offloading Malware Detection to Remote Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IoT devices face significant security threats due to limited storage capacity and resources, making it challenging to implement conventional IT security technologies effectively, particularly in detecting and removing malware.
Innovation Solution
An IoT device architecture that utilizes a user application module, OS API module, file system driver module, file filter driver module, and network filter driver module to offload read/write operations to a remote server, leveraging network resources for malware detection and treatment, eliminating the need for local storage and additional resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional IT security technologies are introduced to IoT devices, then malware detection capability is improved, but device resource consumption and production costs increase
Solution Approach 1:
The patent extracts the malware detection function from the IoT device itself and relocates it to an external server. The IoT device only performs minimal local filtering while the heavy pattern matching and malware analysis are performed remotely on the server, which has sufficient computational resources and storage capacity for malware databases.
Solution Approach 2:
The patent introduces an intermediary server system that acts as a mediator between the IoT device and the malware database. This intermediary handles the resource-intensive pattern matching operations and returns only the necessary detection results to the IoT device, reducing the resource burden on the device while maintaining detection capability.
2Measurement precision
If storage capacity is increased to store malware pattern database, then malware detection accuracy is improved, but production costs increase
Solution Approach 1:
The patent extracts the malware pattern database from the IoT device storage and relocates it to the server storage. This allows the use of large-scale databases with comprehensive malware signatures without increasing the physical device's storage capacity, maintaining detection accuracy while avoiding additional hardware costs.
Solution Approach 2:
The server system serves multiple functions: storing the malware database, performing pattern matching, analyzing suspicious files, and providing update services to multiple IoT devices simultaneously. This multi-functionality eliminates the need for each device to have dedicated storage and processing resources for these functions.
3Productivity
If processing power is increased for pattern matching operations, then malware detection speed is improved, but power consumption and production costs increase
Solution Approach 1:
The patent extracts the computationally intensive pattern matching operations from the IoT device and performs them on the server with adequate processing power. This allows fast malware detection without requiring the IoT device to have high-performance processors, thus avoiding increased power consumption and cost.
Solution Approach 2:
The system performs partial pattern matching locally on the IoT device for quick initial screening, and then performs more comprehensive analysis on the server for suspicious files. This partial action approach balances detection speed with resource conservation, handling only necessary operations locally.
Data Source
AI summary
The present disclosure provides an IoT device which comprise a user application module; an OS API module; a kernel API module; a file system driver module; a file filter driver module; and a network filter driver module. The user application module generates read/write event when an external file is received. The OS API module calls the kernel API module when the event is generated. The kernel API module transmits the read/write event to the file system driver module. The file system driver module generates the read/write operation command and transmits the command to the file filter driver module. The file filter driver module transmits the read/write operation command to the network filter driver module. The network filter driver module generates a exclusive packet including the read/write operation command and transmits the packet to a packet processing application module of a remote server.