Low-Latency Network Virus Detection via File Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current virus scanning methods on gateway systems cause significant latency in network transmissions due to the need to store and scan entire files before transmission, leading to delays and potential time-outs, especially when dealing with large packets or compressed files like ZIP files.
Innovation Solution
The system checks individual sections of files for viruses as they are received, allowing only non-infected sections to be passed through without delay, thereby reducing latency by scanning and transmitting sections concurrently.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire file is stored and scanned before transmission, then virus detection accuracy is improved, but network transmission latency increases
Solution Approach 1:
The patent divides the file into multiple sections and scans each section independently as it arrives, rather than waiting for the entire file. This segmentation allows partial files to be scanned and transmitted sooner, reducing overall latency while maintaining detection capability for complete sections.
Solution Approach 2:
The patent performs preliminary scanning on file sections as they arrive, before the entire file is received. This preliminary action allows the system to identify and quarantine suspicious sections early, reducing the waiting time for clean sections to be transmitted while maintaining security.
2Reliability
If the entire file is stored before scanning, then complete virus detection is improved, but memory usage increases
Solution Approach 1:
The patent processes the file in segmented sections rather than loading the entire file into memory. Each section is scanned independently and then discarded or transmitted, significantly reducing peak memory requirements while maintaining the ability to detect viruses in each section.
Solution Approach 2:
The patent performs partial scanning on sections that have arrived, rather than waiting for complete file accumulation. This partial action approach allows the system to use memory efficiently by processing and releasing sections incrementally, rather than holding the entire file in memory.
3Productivity
If sections are scanned and transmitted concurrently, then transmission speed is improved, but system complexity increases
Solution Approach 1:
The patent organizes the scanning and transmission process into independent section-handling units that can operate concurrently. Each section is processed through a standardized pipeline of receipt, scanning, and transmission/queuing operations, enabling parallel processing without requiring complex coordination between different processing stages.
Solution Approach 2:
The patent introduces a queueing mechanism as an intermediary between the scanning process and the transmission process. This mediator allows scanned sections to be staged for transmission without blocking the scanning of subsequent sections, enabling concurrent operations while managing system complexity through a well-defined intermediate buffer.
4Productivity
If only suspicious sections are scanned, then scanning efficiency is improved, but false positive rate increases
Solution Approach 1:
The patent applies partial scanning to all file sections that have arrived, rather than attempting to selectively identify only suspicious sections. This excessive action of scanning all available sections ensures comprehensive detection while maintaining efficiency by processing only the portions of the file that have been received, avoiding false negatives while minimizing unnecessary scanning of incomplete data.
Data Source
AI summary
This invention relates generally to systems and methods for rapid, low-latency detection of viruses in network transmissions and specifically to methods for determining which parts of a network transmission might contain viruses and checking and cleaning only those parts of the transmission which could potentially be infected as soon as sufficient information is available for such a check.