Malware Detection via Backup File Subgraph Indexing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Anti-malware scanners often fail to scan all files in high-capacity storage devices due to time constraints, leading to undetected malware and missed threats, especially when signature definitions become available after scanning has completed.
Innovation Solution
The method involves identifying backup file sets, detecting malware within them, determining the system file structure subgraphs, using an index to cross-reference string prefixes to locate matching subgraphs in original file sets, and scanning these areas for malware, thereby ensuring comprehensive malware detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full scans of high capacity storage devices are performed, then malware detection completeness is improved, but scanning time becomes too long to complete before next scheduled scans
Solution Approach 1:
The patent segments the scanning process by dividing files into two categories: frequently accessed files and backup files. The system performs rapid scans on frequently accessed files and uses backup files as a reference to identify potential malware locations without scanning every file in the high-capacity storage device, thus reducing total scanning time while maintaining detection effectiveness.
Solution Approach 2:
The system performs preliminary scanning of backup files to identify malware locations before conducting full scans. By analyzing backup files first to determine which files contain malware, the system can then target only those specific files in the main storage device, avoiding the need to scan all files and significantly reducing scanning time.
2Productivity
If non-full scan optimizations are used to accommodate time constraints, then scanning speed is improved, but some files may never be scanned
Solution Approach 1:
The system uses backup files as a feedback mechanism to identify which files in the main storage device may contain malware. By scanning backup files and comparing them against the main file set, the system generates a list of potential malware locations that are then targeted for scanning, ensuring that files which would otherwise be missed by optimization techniques are still detected.
Solution Approach 2:
Backup files serve as an intermediary between the incomplete scan of the main storage device and the identification of all malware locations. The system scans the backup file set to identify malware, uses the file structure to map corresponding files in the original file set, and then scans those specific files, using the backup files as a mediating reference to achieve comprehensive coverage without scanning everything.
3Productivity
If files that have not changed since previously being scanned are not scanned again, then scanning efficiency is improved, but infected files may be scanned without threats being detected
Solution Approach 1:
The system performs preliminary scanning of backup files to update knowledge about malware locations before determining which files to scan in the main storage device. Even if files appear unchanged based on timestamps or checksums, the backup file analysis may reveal new malware signatures or patterns, allowing the system to correctly identify and scan potentially infected files that would otherwise be skipped by change-detection-based optimizations.
Data Source
AI summary
The disclosed computer-implemented method for identifying malware locations based on analyses of backup files may include (i) identifying a presence of a backup file set and (ii) performing a security action that may include (a) detecting, based on a scan of the backup file set, malware in the backup file set, (b) determining, based on a location of the malware in a system file structure of the backup file set, a subgraph of the system file structure of the backup file set that includes the malware, (c) identifying a string prefix for the subgraph of the system file structure of the backup file set, (d) using an index to cross-reference the string prefix to a pointer identifying a subgraph of an original file set, and (e) scanning a file in the subgraph of the original file set for the malware. Various other methods, systems, and computer-readable media are also disclosed.