Malware Detection Using File System Time Point Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware inspection methods in computer systems are inefficient, as they often require full scans of all files, which can be time-consuming and may miss infected files, especially when only selective inspections are performed on specific system folders.
Innovation Solution
An apparatus and method that determine which files to inspect for malware based on their creation and modification history within the file system, identifying candidate files by analyzing time points and file system information to prioritize inspections on potentially infected files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a full malware inspection is performed on every file in mass storage, then detection coverage is improved, but inspection time increases significantly
Solution Approach 1:
The patent segments the file system into different folders and applies different inspection strategies to each segment. System folders (containing OS and application programs) are inspected selectively based on file age, while other folders are inspected based on specific criteria such as files created within a predetermined period. This segmentation allows the system to maintain high detection coverage in critical areas while reducing overall inspection time.
Solution Approach 2:
The patent implements partial inspection by not examining every file in the system. Instead, it performs selective inspection on files meeting specific criteria (e.g., files in system folders created within a certain time period, or files in other folders created within a predetermined period). This partial action approach maintains adequate detection coverage while significantly reducing the time and resources required for full system scanning.
2Loss of time
If malware inspection is selectively performed only on particular system folders, then inspection time is reduced, but detection coverage may be insufficient
Solution Approach 1:
The patent dynamically adjusts inspection scope and criteria based on file attributes and folder types. For system folders, it inspects files created within a specific time period after folder creation. For other folders, it inspects files created within a predetermined period. This dynamic approach ensures that high-risk files are inspected while minimizing unnecessary scans of low-risk files, thereby maintaining detection coverage while reducing inspection time.
Solution Approach 2:
The patent changes inspection parameters (such as time thresholds and folder selection criteria) based on the type of folder being inspected. System folders use one set of parameters (files created within a predetermined period after folder creation), while other folders use different parameters (files created within a predetermined absolute period). This parameter differentiation allows the system to optimize detection coverage for each folder type while controlling overall inspection time.
3Loss of time
If selective inspection is performed on particular folders, then inspection time is reduced, but the number of candidate files remains high making time reduction insignificant
Solution Approach 1:
The patent performs preliminary filtering of files based on their creation time relative to folder creation time before conducting actual malware inspection. By identifying and marking files that meet the inspection criteria (files created within a predetermined period after folder creation) in advance, the system prepares a reduced set of candidate files for inspection, thereby improving inspection efficiency and making time reduction significant.
Data Source
AI summary
An apparatus for detecting a malware in files includes an acquisition unit configured to obtain from a file system information about a first time point when an interested folder is created by the file system, and information about a second time point when an interested file is created in the interested folder by the file system, a candidate determination unit configured to determine whether the interested file is a candidate file to be subjected to a malware inspection, based on the information on the first and the second time point, and an inspection unit configured to perform the malware inspection on the interested file determined to be the candidate file for the malware inspection.