Malicious User File Priority Scanning in Data Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network-attached storage (NAS) systems face security challenges due to the potential for malicious users to inject malware, which can spread and cause damage, especially in distributed systems with multiple users where traditional scanning methods may not prioritize infected files effectively.
Innovation Solution
Implementing a system that includes a user lookup component to identify modifying users, a comparison component to match these users with known malicious users, and a scan priority component to assign higher priority to files modified by malicious users for enhanced malware scanning, thereby reducing the time malware can reside on the system and limiting further infections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional scanning methods are used to detect malware in NAS systems, then all files can be scanned systematically, but the scanning process is too slow and allows malware to spread before detection
Solution Approach 1:
The system performs preliminary actions by tracking user activities and file modifications in real-time, maintaining a database of user behaviors and file access patterns. This preliminary monitoring enables the system to identify suspicious activities before malware can spread extensively, allowing prioritized scanning of high-risk files rather than waiting for traditional scheduled scans.
Solution Approach 2:
The patent applies local quality by implementing differentiated scanning priorities for different files based on their risk assessment. Instead of uniform scanning, the system assigns higher scan priorities to files modified by suspicious users or containing suspicious code patterns, while maintaining lower priorities for normal files. This localized approach concentrates scanning resources on critical areas where malware detection is most urgent.
2Reliability
If comprehensive malware scanning is performed on all files, then system security is improved, but system resource usage increases significantly
Solution Approach 1:
The system applies partial action by performing comprehensive scanning only on files identified as high-risk through user behavior analysis and code pattern detection. For low-risk files, scanning is performed at reduced frequency or skipped entirely. This partial scanning approach maintains adequate security for the majority of files while conserving system resources, avoiding the excessive resource consumption of scanning every file at maximum intensity.
Solution Approach 2:
The patent utilizes parameter changes by dynamically adjusting scan priority levels based on risk assessments. Files are assigned priority parameters that determine scanning frequency and resource allocation. When a file's risk parameter increases (e.g., modified by a suspicious user), its scan priority parameter is increased accordingly. This dynamic parameter adjustment allows the system to optimize resource usage while maintaining security proportional to actual risk levels.
3Loss of time
If real-time monitoring of all file modifications is implemented, then malware injection is detected faster, but system complexity and processing overhead increase
Solution Approach 1:
The system extracts and focuses monitoring efforts on critical elements rather than attempting to monitor all file modifications uniformly. It extracts key indicators such as user behavior patterns, file access frequencies, and code modification types. By taking out only the most relevant monitoring targets and indicators, the system achieves effective malware detection without the prohibitive complexity of comprehensive real-time monitoring of every file operation.
Solution Approach 2:
The patent introduces intermediary components such as risk assessment algorithms and priority assignment mechanisms that mediate between raw file modification events and actual scanning actions. These intermediaries filter and prioritize modification events, translating raw data into actionable scan priorities. This intermediary layer reduces the direct processing burden by pre-filtering events before they reach the scanning system, thereby reducing overall system complexity while maintaining detection effectiveness.
Data Source
AI summary
Priority scanning of files written by malicious users in a data storage system is described herein. A data storage system as described herein can include a user lookup component that obtains identities of users that have made at least one modification to a first file stored on the data storage system, resulting in a set of modifying users; a comparison component that compares respective modifying users of the set of modifying users to respective malicious users of a set of malicious users; and a scan priority component that, in response to the comparison component identifying at least one match between a modifying user of the set of modifying users and a malicious user of the set of malicious users, assigns a first scan priority to the first file that is higher than a second scan priority assigned to a second, different file stored on the data storage system.