Malware Defense via Segmented Filtering Table
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Multimedia devices with limited data processing capability face challenges in running traditional antivirus software or intrusion detection systems, necessitating a malware defense system with lower system requirements to enhance security.
Innovation Solution
A malware defense method and system that coordinates between a user-end electronic device and a server-end malware analyzing device to generate and update filtering rules, where the user-end device performs simple packet content comparisons and the server-end handles resource-intensive sorting and determination, reducing system resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus software or intrusion detection system is deployed on multimedia playing devices, then malware defense capability is improved, but system resource consumption increases beyond the limited processing capability of the devices
Solution Approach 1:
The malware defense system is segmented into two parts: a lightweight filtering table stored locally in the multimedia playing device for basic packet filtering, and a comprehensive malware database maintained on external servers for advanced threat detection. This segmentation allows the device to operate with minimal local resources while still providing robust malware defense through server-assisted updates and analysis.
Solution Approach 2:
A filtering table acts as an intermediary between the limited-capability multimedia device and the resource-intensive malware detection system. The filtering table contains pre-processed filtering rules that can be quickly applied locally, while the server acts as another intermediary to generate and update these rules based on comprehensive malware analysis, thereby reducing the direct resource burden on the end device.
2Measurement precision
If comprehensive malware detection is performed locally on the device, then detection accuracy is improved, but device complexity and processing requirements increase
Solution Approach 1:
Malware characteristics and filtering rules are pre-analyzed and pre-processed on powerful external servers before being deployed to the multimedia playing device. The server performs comprehensive malware detection, extracts characteristic patterns, and compiles them into a compact filtering table that can be efficiently stored and applied locally, thereby achieving high detection accuracy without requiring the device to perform complex analysis.
Solution Approach 2:
Instead of storing and processing complete malware databases locally, the system uses a simplified copy or representation of malware characteristics in the form of filtering rules and patterns. This copied information captures the essential detection capabilities while occupying minimal storage space and requiring minimal processing power, allowing the device to achieve effective malware detection without the complexity of maintaining a full malware database.
Data Source
AI summary
A method and a system for defending against malware and a method for updating a filtering table thereof are provided. The method for defending against malware includes: receiving a network packet by an electronic device, which stores a filtering table; determining whether the network packet conforms to a specific filtering rule of the filtering table by the electronic device; if the network packet conforms to the specific filtering rule, performing a specific operation on the network packet by the electronic device according to the specific filtering rule; and if the network packet does not conform to the specific filtering rule, uploading characteristic information of the network packet to a malware analyzing device by the electronic device.