Malware Identification via Server-Based Database Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-virus systems face challenges with large databases that consume limited resources on devices like mobile phones, leading to increased bandwidth usage and processing times, which can impact user experience and device performance.
Innovation Solution
A method where a client device sends information about suspected malware to a network server, which determines a required information set and requests comparisons, allowing the server to identify malware by iteratively refining the comparison results, reducing the need for extensive local database storage and processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a large anti-virus database is stored locally on the client device, then malware identification accuracy is improved, but device memory consumption increases
Solution Approach 1:
The patent extracts the malware database and scanning processing from the client device and relocates them to a remote server. The client device only stores minimal local information ( recently modified files, device configuration) while the comprehensive malware database resides on the server, thereby reducing local memory consumption while maintaining identification accuracy through server-based comparison.
Solution Approach 2:
The patent introduces a remote server as an intermediary between the client device and the malware database. The server acts as a mediator that stores the comprehensive malware database and performs scanning operations, allowing the client device to benefit from accurate malware identification without directly storing or processing the large database locally.
2Reliability
If a comprehensive anti-virus database is transferred wirelessly to the client device, then malware identification capability is improved, but bandwidth consumption increases
Solution Approach 1:
The patent extracts the malware database from the client device's local storage requirements and places it on a remote server. Instead of transferring the entire database wirelessly to the client, the system only transfers minimal information (recently modified file lists, device configuration), dramatically reducing wireless bandwidth consumption while maintaining full malware identification capability through server-based scanning.
3Speed
If real-time scanning is performed on the client device, then malware detection speed is improved, but processing resource consumption increases
Solution Approach 1:
The patent extracts the scanning processing function from the client device and relocates it to a remote server. The client device quickly transmits file information to the server, and the server performs the computationally intensive scanning operations using its dedicated processing resources, thereby maintaining fast malware detection while minimizing the client device's processing resource consumption.
4Reliability
If a large anti-virus database is stored on the client device, then malware identification accuracy is improved, but available storage for user files decreases
Solution Approach 1:
The patent extracts the malware database from local storage requirements and stores it on a remote server. The client device only maintains minimal local storage for recently modified files and device configuration information, freeing up significant storage space for user files while preserving full malware identification accuracy through server-based database access.
Data Source
AI summary
A method and apparatus for determining the identity of suspected malware on a client device. Information pertaining to the malware is sent from the client device to a server. The server determines a first required information set, and sends a request to the client device for the required information set. The client device compares the required information set with information stored at the client device, and returns the results of the comparison to the server. The server uses the results of the comparison to attempt to determine an identity of the malware. If the results of the comparison indicate that the suspected malware is one of a plurality of types of malware, a new required information set is determined, which is sent back to the client device, and the process repeated. Otherwise the identity of the suspected malware is determined, or it is determined that the suspected malware is unknown to the server.