Look Ahead Malware Scanning for Application Performance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
On-access malware scanning in modern computer systems is inefficient due to sequential file access patterns, which block application execution and degrade system performance, as anti-virus software cannot perform batch or parallel scanning without knowing future file access requests.
Innovation Solution
Implement a method to detect file access patterns and scan groups of files in advance before the application accesses them, using multi-threading and batch scanning to minimize delays and optimize system performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sequential on-access scanning is performed for each file access, then malware detection is achieved, but application execution is blocked and system performance degrades
Solution Approach 1:
The patent performs malware scanning in advance before the application actually needs to access the files. When sequential file access patterns are detected, the system proactively scans the entire directory or file group beforehand, so that subsequent file accesses can proceed without blocking. This preliminary scanning action resolves the contradiction by ensuring malware detection is completed before it would otherwise block application execution.
Solution Approach 2:
The patent segments the scanning process from the application execution process. Instead of blocking application execution for each file scan, the system separates these operations by performing scans in the background or parallel to application operations. This segmentation allows malware detection to occur without directly blocking application productivity.
2Productivity
If batch or parallel scanning is implemented, then scanning efficiency is improved, but the system cannot identify future file access requests to scan appropriate groups
Solution Approach 1:
The patent uses feedback from detected sequential file access patterns to trigger batch scanning. When the system observes that an application is accessing files in a sequential manner (e.g., accessing multiple files in a directory one after another), it uses this feedback information to proactively initiate scanning of the entire directory or file group. This feedback mechanism allows the system to perform efficient batch scanning without needing to predict future access requests, as the pattern detection provides the necessary information.
3Reliability
If on-access scanning monitors each file access individually, then security is maintained, but system resources are consumed and performance is degraded
Solution Approach 1:
The patent merges multiple individual file scan operations into a single batch scan operation. Instead of scanning each file separately when accessed, the system combines scanning of multiple files in a directory into one unified batch operation. This merging reduces the total number of scan operations and minimizes system resource consumption while maintaining the same security level, as all files in the group are still thoroughly scanned.
Data Source
AI summary
According to a first aspect of the present invention there is provided a method of scanning for malware during execution of an application on a computer system. The method includes detecting accesses by the application to files within a common directory, using the detected accesses to identify one or more groups of files within said common directory that the application may subsequently want to access, and scanning said one or more groups of files for malware prior to the application attempting to access files of the group or groups.