Malware Detection Whitelist Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems require extensive processor time for scanning large quantities of data, leading to inefficient processing and potential misidentification of file modifications, as they often store data for all previously clean files, which can result in unnecessary use of resource-intensive malware scanning methods.
Innovation Solution
A method is introduced to generate a whitelist of clean files that have previously been determined not to contain malware and satisfy a predetermined criterion, such as processing time, allowing for data verification operations instead of full malware scanning, thereby reducing unnecessary processing and improving efficiency by selectively using either data verification or malware scanning methods based on predetermined criteria.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all previously clean files are stored and processed using data verification methods, then malware detection coverage is improved, but processor time and resource usage increase significantly
Solution Approach 1:
The patent segments the set of all previously clean files into two distinct groups: a whitelist of files suitable for fast data verification and a blacklist of files requiring full malware scanning. This segmentation allows the system to apply different processing methods to different file subsets, optimizing both detection coverage and processing efficiency by matching the verification method to file characteristics.
Solution Approach 2:
Instead of applying data verification to all previously clean files (excessive action), the patent applies it only to a selected subset that meets specific criteria (partial action). Files that do not meet the criteria are processed using full malware scanning, ensuring comprehensive detection while avoiding unnecessary resource consumption on files where verification would be insufficient.
2Productivity
If data verification operations are used for all clean files, then processing speed is improved, but detection accuracy decreases for certain file types
Solution Approach 1:
The patent applies local quality by assigning different processing qualities (data verification vs. full malware scanning) to different files based on their specific characteristics. The whitelist contains files with properties making them suitable for fast verification, while the blacklist contains files requiring more thorough scanning, ensuring each file receives the appropriate level of detection scrutiny.
Solution Approach 2:
The system changes the processing parameter (verification method) based on file characteristics. By evaluating criteria such as file size, type, and historical behavior, the system dynamically selects whether to apply the fast verification method or the comprehensive scanning method, optimizing both speed and accuracy for each file context.
3Reliability
If full malware scanning is performed on every file, then detection thoroughness is improved, but system performance degradation increases
Solution Approach 1:
The patent introduces dynamics by making the processing method adaptive rather than static. The system dynamically determines whether to apply full malware scanning or fast data verification based on real-time evaluation of file characteristics and current system state. This dynamic approach allows the system to maintain high detection thoroughness when needed while preserving system performance during normal operations.
Data Source
Figure 1~1A
Figure 2
Figure 3~4
AI summary
A computer-implemented method of scanning a plurality of files stored in a memory of a computer for malware. The computer comprises a processor. The method comprises, for each respective file of said plurality of files in said memory determining, using said processor, whether a relationship between the respective file and stored data satisfies a predetermined criterion. The stored data indicates one or more files determined not to contain malware and for which data associated with each of said one or more files has a predetermined characteristic. If the relationship satisfies the predetermined criterion, the respective file is processed according to said first processing method and if said relationship does not satisfy said predetermined criterion, the respective file is processed according to said second processing method.