False Alarm Detection for Malware Scanning via Partial File Hash Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Automated malware detection systems face challenges in distinguishing between genuine malware and false alarms, particularly with partial files that can lead to customer frustration and increased technical support requirements, as conventional methods like full file whitelisting and code signing signature checks are ineffective.
Innovation Solution
Implementing a mechanism to detect and suppress false alarms by identifying partial files, temporarily blocking their execution, searching for the original complete file, and comparing hashes to confirm if the partial file is a false alarm, thereby reducing manual intervention and enhancing the reliability of malware detection services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automated malware scanning is performed on all files, then detection speed and productivity are improved, but false alarm rate increases due to partial files
Solution Approach 1:
The system performs preliminary actions by checking file completion status (via extension, download state, or hash verification) before initiating malware scanning. This prevents partial files from being scanned, thereby maintaining high detection speed while eliminating false alarms caused by incomplete files.
2Measurement precision
If manual review is performed on detected malware, then accuracy of malware identification is improved, but processing time and operational complexity increase
Solution Approach 1:
The system performs preliminary filtering by identifying and excluding partial files before malware detection. This automated pre-screening achieves high accuracy in distinguishing genuine malware from partial files without requiring manual review, thereby maintaining precision while minimizing time loss.
3Reliability
If comprehensive file scanning is performed, then malware detection capability is improved, but system resource consumption and complexity increase
Solution Approach 1:
The system extracts and handles partial files separately from the main malware scanning process. By identifying partial files through specific criteria (extensions, download status, hash mismatches) and excluding them beforehand, the system maintains comprehensive malware detection capability while simplifying the overall system architecture and reducing resource consumption.
Data Source
AI summary
A method of scanning files for malware on a computer system. The method comprises detecting a file to be scanned for malware in the computer system, determining the file being a partial file that comprises only a part of the file content, searching for an original clean file associated with the partial file, wherein the original clean file is a full copy of the partial file, based on finding a candidate original clean file associated with the partial file, calculating a partial hash of the same length as the partial file for the candidate original clean file, and based on determining that partial hashes of the candidate original clean file and the partial file match, signalling a false alarm.