Malicious Code Diagnosis Using File Change Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for diagnosing malicious codes in a computer's file system are time-consuming and unreliable, as they require searching all files directory by directory, leading to prolonged diagnosis times and potential missed infections outside designated folders.
Innovation Solution
A method utilizing file change log information to identify and diagnose only files likely infected by malicious codes, generating a diagnosis target file list based on modification events, thereby reducing the scope of the diagnosis to files that have been modified, generated, or deleted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all files are searched directory by directory, then detection reliability is improved, but diagnosis time becomes excessively long
Solution Approach 1:
The patent applies preliminary action by checking file change log information before performing the actual diagnosis. The system identifies files that have been modified, generated, or deleted recently and prioritizes these files for diagnosis. This preliminary filtering based on change logs reduces the scope of files to be diagnosed while maintaining detection reliability, as malicious codes typically modify or create files rather than leaving unchanged files in the file system.
2Loss of time
If only significant directories are searched, then diagnosis time is reduced, but detection reliability deteriorates
Solution Approach 1:
The patent applies local quality by differentiating the diagnosis approach based on file characteristics rather than uniformly treating all files. Files with change log information indicating recent modifications are prioritized for diagnosis, while files without such changes are deprioritized. This creates a non-uniform diagnosis strategy where diagnostic resources are concentrated on files with higher suspicion of malicious activity, achieving both time reduction and reliability maintenance.
3Reliability
If all files are diagnosed, then detection reliability is maintained, but productivity becomes excessively low
Solution Approach 1:
The patent applies the extraction principle by separating the file system into two groups: files with change log information indicating recent modifications and files without such information. The system extracts and prioritizes only the modified files for diagnosis, excluding unchanged files from the diagnosis scope. This extraction of relevant files from the entire file system maintains detection reliability for malicious codes while significantly improving diagnosis efficiency by reducing the number of files processed.
Data Source
AI summary
Provided are a malicious code diagnosing system and a method of diagnosing malicious codes. According to embodiments of the present disclosure, a malicious code diagnosing operation is performed only on files that are likely to be infected by malicious codes by utilizing file change log information recorded in a file system. Accordingly, malicious code diagnosing operation can be performed more quickly and reliably than conventional diagnosing method.