Malware Detection via Digital Signature Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods face challenges in efficiently identifying trusted files on devices with limited memory, as large trusted file lists consume significant memory and require frequent updates, leading to increased processing burdens and data traffic.
Innovation Solution
A method that dynamically identifies trusted files within a device by verifying digital signatures using a database of trusted public keys, eliminating the need for a comprehensive trusted file list and reducing the number of files requiring full malware scans.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a comprehensive trusted file list is maintained to identify trusted files, then the accuracy of malware detection is improved, but memory consumption increases significantly
Solution Approach 1:
The patent extracts only the essential verification element (digital signature) from the comprehensive trusted file list approach. Instead of storing and comparing against a large list of trusted file hashes, the system verifies digital signatures attached to files, which provides the same trust verification functionality with minimal memory requirements. This extracts the core trust verification mechanism while eliminating the need for large reference databases.
Solution Approach 2:
The patent transitions from a one-dimensional approach (comparing file hashes against a list of known trusted file hashes) to a two-dimensional approach (verifying digital signatures that encode trust information). The digital signature dimension adds cryptographic verification capability without requiring proportional increases in memory storage, as signatures are compact and can be verified without storing the entire trusted file database.
2Reliability
If a large trusted file list is maintained and updated frequently, then the coverage of trusted files is improved, but processing burden increases
Solution Approach 1:
The system enables files to self-verify their trustworthiness through embedded digital signatures. Each trusted file carries its own cryptographic proof of authenticity, allowing the anti-virus software to verify trust independently without requiring centralized updates or maintenance of a comprehensive trusted file list. This self-service approach reduces the processing burden on the anti-virus system while maintaining wide coverage.
Solution Approach 2:
Trust verification is performed preliminarily through digital signature validation before files are scanned for malware. By verifying the digital signature in advance, the system can quickly identify and exclude trusted files from subsequent expensive malware scanning operations, reducing overall processing burden while maintaining comprehensive coverage of trusted files.
3Reliability
If digital signature verification is performed for all files, then the accuracy of trusted file identification is improved, but processing time increases
Solution Approach 1:
The system applies digital signature verification selectively rather than universally. Files are first checked for the presence of digital signatures, and only files with signatures undergo verification. Files without signatures are handled differently (either scanned directly or flagged for user attention). This partial application of verification maintains high accuracy for identified trusted files while minimizing overall processing time by avoiding unnecessary verification of files that cannot be verified.
Data Source
AI summary
According to a first aspect of the present invention there is provided a malware detection method implemented within a computer. The method includes, for a given electronic file, determining if the file is associated with a valid digital signature. If the file is associated with a valid digital signature, then verifying that the signature belongs to a trusted source. If the signature does belong to a trusted source then not performing a malware scan of said file, and if the signature cannot be verified as belonging to a trusted source then performing said scan.