Malware Detection via Byte-Serving Request Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods, such as stream-based and file-based scanning, can fail to detect malware when a user initiates an HTTP byte-serving request after a partial download, allowing infected resources to be reassembled and potentially infect the client device.
Innovation Solution
A system that maintains a hash lookup table for previously detected malware resources and intercepts HTTP byte-serving requests to ensure the entire resource is downloaded for scanning, modifying the request to disable byte-serving features if malware is detected, thereby preventing incomplete downloads and ensuring full resource scanning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If stream-based scanning is used to detect malware during download, then malware detection capability is improved, but byte-serving requests can bypass detection and allow incomplete malware downloads to be completed
Solution Approach 1:
The system performs preliminary malware detection on the initial download using stream-based scanning. When malware is detected, the system proactively prevents byte-serving requests by checking the hash of the partially downloaded file against known malware hashes before allowing the download to be completed, thus preventing malware infection before it can occur.
Solution Approach 2:
The system implements a feedback mechanism where the result of malware detection (malicious or benign) is used to control subsequent byte-serving requests. If malware is detected in the initial download, the system feeds this information back to block any byte-serving requests for that file, ensuring that incomplete downloads cannot be completed to infect the device.
2Object-affected harmful factors
If the firewall stops the download of malware infected file before complete, then malware installation is prevented, but user requests to complete the download can bypass detection and infect the device
Solution Approach 1:
The system performs preliminary malware detection during the initial download process using stream-based scanning. Before allowing the user to complete the download via byte-serving requests, the system checks the hash of the partially downloaded file against a database of known malware hashes. If a match is found, the system proactively blocks the completion request, preventing malware installation even if the user attempts to finish the download.
3Productivity
If HTTP byte-serving requests are allowed, then partial download completion is enabled, but malware can be reassembled and infect the client device
Solution Approach 1:
The system performs preliminary security verification by computing the hash of the partially downloaded file and comparing it against known malware hashes before allowing byte-serving requests to complete the download. This preliminary check ensures that even if a download is interrupted and needs to be completed via byte-serving requests, malware cannot be reassembled and infect the client device.
Solution Approach 2:
The system introduces an intermediary security check mechanism that mediates between the download completion process and the client device. Before allowing byte-serving requests to complete the download, the system acts as an intermediary that verifies the file's safety through hash comparison, blocking the completion process if malware is detected, thus preventing malware reassembly and infection.
Data Source
AI summary
An example embodiment of the present techniques determines, in response to a byte-serving request to download a portion of a resource, that the resource has previously been determined to comprise malware. Further, the byte-serving request is modified to request downloading all the resource. Additionally, all the resource is requested for downloading using the modified byte-serving request.