Network Stream Scanning Facility for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current file scanning technologies on network devices are inefficient in terms of throughput and resource utilization, as they often rely on methods developed for endpoint computing devices, which may not be suitable for the resource-constrained environment of network devices.
Innovation Solution
A network device scanning facility that utilizes efficient low-resource file analysis tools combined with outside network database resources for malware scanning, including source and checksum lookups, to provide real-time anti-malware intelligence and quicker responses to emerging threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional endpoint file scanning techniques are used on network devices, then malware detection capability is maintained, but scanning throughput and resource efficiency deteriorate
Solution Approach 1:
The patent segments the malware scanning process into two distinct parts: (1) rapid signature-based detection using checksum databases for known threats, and (2) behavior-based analysis using sandboxing for unknown threats. This segmentation allows the system to handle the majority of traffic efficiently through signature matching while dedicating computational resources only to suspicious files that require deeper analysis, thereby resolving the contradiction between detection capability and scanning throughput.
Solution Approach 2:
The patent introduces a sandbox environment as an intermediary layer between the network device and the potentially malicious files. The sandbox acts as a controlled intermediary that can safely execute and analyze suspicious files without compromising the network device's resources. This intermediary approach enables the system to maintain high scanning throughput while preserving malware detection capability through isolated behavioral analysis.
2Measurement precision
If comprehensive malware scanning is performed on every file, then detection accuracy is improved, but resource consumption and latency increase
Solution Approach 1:
The patent implements preliminary action by performing rapid checksum-based signature matching on all files before subjecting them to resource-intensive behavior analysis. Files that match known malware signatures are immediately identified, while files with mismatched checksums are quickly cleared. Only files with suspicious characteristics proceed to the sandbox environment for deeper analysis. This preliminary filtering action significantly reduces scanning latency while maintaining high detection accuracy.
Solution Approach 2:
The patent applies partial action by performing comprehensive behavior-based analysis only on a subset of files that exhibit suspicious characteristics, rather than analyzing every file in detail. The system uses checksum databases and rapid signature matching to handle the bulk of traffic with minimal resource consumption, applying excessive (full) analysis only where necessary. This approach optimizes the balance between detection accuracy and scanning latency.
3Reliability
If resource-intensive scanning methods are used, then malware detection capability is enhanced, but network device performance and throughput deteriorate
Solution Approach 1:
The patent uses copying by creating virtual copies of suspicious files within the sandbox environment for analysis, rather than executing them directly on the network device. The sandbox generates isolated copies that can be safely analyzed without consuming the network device's computational resources. This copying approach enables enhanced malware detection capability while preserving the network device's performance and throughput.
Solution Approach 2:
The sandbox environment serves as an intermediary that performs resource-intensive analysis tasks away from the network device. By offloading behavior-based analysis to the sandbox intermediary, the system enhances malware detection capability without compromising the network device's performance. The intermediary handles the computationally expensive tasks while the network device maintains its primary function of high-speed packet forwarding.
Data Source
AI summary
In embodiments of the present invention improved capabilities are described for providing a scanning of data associated with a network computer facility. In the process, a request may be received for network content from a content requesting computing facility. A source lookup associated with the request for network content may be performed, where the source lookup may be from a networked source lookup database. The requested network content may then be retrieved, where the type of the content may be determined as a further aid in scanning the content. A checksum of at least a portion of the retrieved network content may then be calculated, and a checksum lookup associated with the portion of the retrieved network content be performed, where the checksum lookup may be from a networked checksum lookup database. Finally, an action may be taken based on at least one of the source lookup and checksum lookup, where the action is associated with protecting the content requesting computing facility from malware.