Malware Detection via Database Lookup and Change Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware detection methods are processor intensive, leading to inefficiencies in preventing the spread of malware as they consume significant CPU cycles, limiting the number of concurrent scans that can be performed by firewalls.
Innovation Solution
Implementing a system where previously detected malware is recorded, and checks are performed to determine if resources have changed, allowing downloads to proceed only if changes are detected, thereby avoiding traditional malware detection scans for unchanged resources, thus reducing processor load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malware detection scanning is performed for every downloaded resource, then malware can be detected with high reliability, but processor load increases significantly reducing productivity
Solution Approach 1:
The system performs preliminary malware detection on downloaded resources and stores the detection results in a database. When the same resource is downloaded again, the system first checks the database for previous detection results before performing a new scan. This preliminary check approach maintains high malware detection reliability while significantly reducing processor load and increasing the number of concurrent scans that can be performed.
Solution Approach 2:
The system applies different detection strategies to different resources based on their characteristics. For resources with identical identifiers (same URL, filename, size, modification date), the system performs a simple database lookup rather than a full scan. This localized quality adjustment maintains detection reliability for unique resources while improving overall system productivity through efficient handling of duplicate resources.
2Measurement precision
If processor-intensive malware detection is performed on every resource download, then detection accuracy is maintained, but the speed of malware detection decreases
Solution Approach 1:
The system performs malware detection in advance and stores results in a database. When the same resource is encountered again, the system retrieves the pre-stored detection result instead of performing a new intensive scan. This preliminary action maintains detection accuracy while dramatically improving detection speed for repeated resources.
Solution Approach 2:
The system copies detection results from the database for identical resources instead of re-scanning. By copying the identifier-based lookup results for resources with matching URLs, filenames, sizes, and modification dates, the system maintains detection accuracy while achieving near-instantaneous detection speed for duplicates.
3Reliability
If traditional malware detection methods are used, then comprehensive malware identification is achieved, but the complexity of the detection system increases
Solution Approach 1:
The detection system is segmented into two distinct components: a simple identifier-based lookup mechanism for known resources, and a comprehensive malware scanning system for new or changed resources. This segmentation maintains comprehensive malware identification capability while reducing overall system complexity by handling common cases through the simpler lookup path.
Solution Approach 2:
The system introduces a database as an intermediary between the resource download process and the malware detection process. The database stores identifier-detection result pairs, allowing the system to resolve many detection requests without invoking the complex scanning machinery. This intermediary maintains comprehensive identification reliability while reducing the apparent complexity of the detection system for routine operations.
Data Source
AI summary
An example implementation of the present techniques determines, in response to a request to download a resource, whether the resource has previously been determined to comprise malware. Additionally, it is determined, if the resource has previously been determined to comprise malware, whether the resource has changed since the previous determination. Further the request to download the resource is terminated if the resource has not changed.