Malware Signature Tiering for Detection Efficiency
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional antivirus and antispyware solutions face inefficiencies due to large malware signature databases, leading to increased resource consumption and higher likelihood of false positive detections, as they rely on scan-based technologies that are not optimized for managing the growing number of malware threats.
Innovation Solution
A system that categorizes malware signatures into active, dormant, and semi-active tiers, dynamically adjusting their usage based on prevalence, with a provisioning module distributing these signatures to clients and servers to optimize detection efficiency and reduce database size, and an update module moving signatures between tiers based on detection rates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware signature databases are expanded to cover more threats, then detection capability is improved, but resource consumption (CPU, memory, disk) increases
Solution Approach 1:
The patent segments the malware signature database into multiple categories (e.g., critical signatures, common signatures, rare signatures) and applies different provisioning strategies to each segment. Critical signatures are provisioned to all clients, while less critical signatures are provisioned selectively based on client risk profiles and resource constraints, thereby reducing overall resource consumption while maintaining detection capability for the most important threats.
Solution Approach 2:
The patent applies local quality by tailoring the signature database composition to individual client characteristics. Different clients receive different subsets of signatures based on their specific risk exposure, industry sector, device type, and resource availability. This ensures each client has optimal detection coverage for their local context without unnecessarily consuming resources on signatures irrelevant to their environment.
2Reliability
If malware signature databases are expanded to cover more threats, then detection capability is improved, but false positive rate increases
Solution Approach 1:
The patent segments signatures based on their false positive propensity and criticality. High-criticality, low false-positive signatures are universally provisioned, while signatures with higher false positive rates are provisioned selectively only to clients where the detection benefit outweighs the false positive risk. This segmentation approach maintains high detection capability while minimizing overall false positives.
Solution Approach 2:
The patent applies local quality by adjusting signature provisioning based on client-specific factors that influence false positive rates, such as the client's file types, scanning patterns, and historical false positive experience. This ensures that signatures are applied in contexts where they are most effective and least likely to generate false alarms.
3Reliability
If server-side signature databases are enlarged, then detection coverage is improved, but lookup time increases
Solution Approach 1:
The patent applies preliminary action by pre-provisioning signature subsets to clients before they are needed for scanning. Clients receive critical signatures in advance, allowing them to perform local detection without requiring real-time server lookups for every file. This preliminary provisioning dramatically reduces lookup time while maintaining comprehensive detection coverage through periodic updates.
Solution Approach 2:
The patent segments the signature database into frequently accessed critical signatures and less frequently accessed supplementary signatures. Critical signatures are kept locally on clients for rapid lookup, while supplementary signatures remain on the server for periodic updates and occasional use, optimizing the balance between detection coverage and lookup speed.
Data Source
AI summary
A computer-implemented method for managing malware signatures. The method may include maintaining a set of active malware signatures and maintaining a set of dormant malware signatures. The method may also include providing the set of active malware signatures for use in malware detection more frequently than the set of dormant malware signatures and determining that a first malware signature from the set of dormant malware signatures triggers one or more positive malware detection responses. The method may further include, in response to the determination, moving the first malware signature from the set of dormant malware signatures to the set of active malware signatures. Various other methods, systems, and computer-readable media are also disclosed.