Malware Detection via Deduplication Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods struggle to efficiently identify and track malware spread in deduplicated data environments, where large files and evolving malware variants complicate traditional scanning approaches.
Innovation Solution
A computer-implemented method and system that utilizes deduplication signatures to identify and track malware by obtaining deduplication signatures of suspicious files, storing suspect signature blocks in a searchable format, and outputting these blocks for identification of other instances across the deduplication environment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional malware scanning methods are used, then malware detection capability is maintained, but detection efficiency and speed deteriorate due to large file sizes and deduplicated data environments
Solution Approach 1:
The patent segments malware detection from file-level scanning to block-level analysis. By dividing files into blocks and using deduplication to identify unique blocks, the system scans only necessary portions of data rather than entire files, significantly improving detection efficiency and reducing time loss in large file environments
Solution Approach 2:
The patent uses deduplication technology to create references (copies) of unique data blocks instead of storing or scanning complete files. The malware detection system operates on these block references and signatures, enabling rapid identification of malware across multiple files without redundant scanning of identical content
2Reliability
If comprehensive malware scanning is performed across all files, then detection coverage is improved, but system resource consumption and complexity increase
Solution Approach 1:
The patent makes the deduplication infrastructure serve multiple functions: both data compression/storage and malware detection. The existing deduplication database and block management systems are repurposed for security scanning, eliminating the need for separate comprehensive scanning infrastructure and reducing overall system complexity while maintaining detection coverage
Solution Approach 2:
The patent introduces deduplication block signatures as an intermediary layer between storage and malware detection. Instead of directly scanning files or dealing with complex file system structures, the system uses standardized block signatures as a mediator that simplifies the detection process while maintaining comprehensive coverage across all stored data
3Adaptability or versatility
If traditional file-based malware detection is used, then malware in standard formats is detected, but detection of malware in large files and evolving variants becomes difficult
Solution Approach 1:
The patent changes the fundamental parameter of detection from file-level to block-level. By operating on fixed-size blocks rather than entire files, the system adapts to various malware formats and sizes uniformly. This block-based approach with deduplication signatures makes detection equally effective whether malware is embedded in small or large files, or in evolving variants
Data Source
AI summary
A computer-implemented method, computer program product, and computer system for detection of malware is provided. The computer-implemented method includes: obtaining a deduplication signature of a file identified as being suspicious to obtain suspect signature blocks. The computer-implemented method further includes storing the suspect signature blocks in a searchable format store. The computer-implemented method may also include outputting the suspect signature block store for use in identification of other instances of the suspect data blocks.