Partial File Signature Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for blocking malicious files in networks are time-consuming and resource-intensive, often resulting in false positives and negatives due to the need to process entire files for full-file hashes, which slows network traffic and consumes computing resources.
Innovation Solution
A security system that identifies file types and characteristics of malicious files to generate partial file signatures, allowing for early detection and blocking by applying specific rules to a few bytes or kilobytes of the file, preventing false positives and conserving resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If full-file hashes are used to identify malicious files, then detection accuracy is improved, but processing time and resource consumption increase significantly
Solution Approach 1:
The patent segments the file processing task by using partial file signatures (hashes of only the first N bytes) instead of processing entire files. This segmentation allows the system to quickly identify and block malicious files based on their headers without consuming excessive resources on full-file hashing, thereby resolving the contradiction between detection accuracy and processing time.
Solution Approach 2:
The patent applies partial action by computing hashes of only a portion of each file (the first N bytes) rather than complete files. This partial hashing approach provides sufficient detection capability for most malicious files while dramatically reducing processing time and resource consumption, directly addressing the technical contradiction.
2Reliability
If full-file hashes are computed for all files, then malicious file detection is improved, but network traffic speed decreases
Solution Approach 1:
The system segments the file inspection process by applying partial file signatures to only the beginning portions of files. This allows network devices to quickly scan and block malicious traffic without processing entire files, thereby maintaining detection reliability while preserving network traffic speed.
Solution Approach 2:
The patent implements preliminary action by computing partial file signatures early in the file transmission process, before the entire file is received. This allows the system to make blocking decisions based on file headers alone, preventing malicious files from fully traversing the network and thus maintaining both detection reliability and traffic speed.
3Measurement precision
If comprehensive file analysis is performed to reduce false positives, then detection accuracy is improved, but computing resource consumption increases
Solution Approach 1:
The patent applies partial action by using hashes of only the first N bytes of files rather than comprehensive full-file analysis. This partial hashing approach reduces computing resource consumption significantly while maintaining sufficient detection accuracy to minimize false positives, directly resolving the contradiction between detection accuracy and resource consumption.
Solution Approach 2:
The system uses inexpensive partial file signatures as a first-line defense mechanism. These partial hashes serve as disposable, low-cost filters that quickly eliminate obvious threats without requiring expensive comprehensive analysis, thereby reducing overall computing resource consumption while maintaining detection effectiveness.
Data Source
AI summary
A device may receive a malicious file associated with a network of network devices and may identify a file type and file characteristics associated with the malicious file. The device may determine one or more rules to apply to the malicious file based on the file type and the file characteristics associated with the malicious file and may apply the one or more rules to the malicious file to generate a partial file signature for the malicious file. The device may provide the partial file signature for the malicious file to one or more of the network devices of the network. The partial file signature may cause the one or more of the network devices to block the malicious file.