Preemptive Malware Scanning via Priority Scheduling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware scanning methods consume increasing system resources, lead to inefficient repetitive scanning, introduce network latencies, and result in incomplete scans due to high resource usage, making systems vulnerable to malware attacks.
Innovation Solution
Implement a preemptive scheduling method that prioritizes targets for scanning based on predictive qualities and an opportunistic scanning approach that monitors system resource usage to minimize intrusion and interference with other processes, allowing for efficient and timely malware detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware scanning is performed frequently and thoroughly, then malware detection effectiveness is improved, but system resource consumption increases
Solution Approach 1:
The system preemptively schedules malware scanning for high-priority targets before they are likely to be accessed or executed, rather than waiting for actual access events. This preliminary action ensures malware is detected early while allowing lower-priority scanning during resource-constrained periods, resolving the contradiction between detection effectiveness and resource consumption.
Solution Approach 2:
The system dynamically adjusts scanning parameters including priority levels, resource thresholds, and scheduling intervals based on current system conditions and target characteristics. By changing these parameters adaptively, the system optimizes the balance between thorough malware detection and acceptable resource usage without requiring constant full-system scanning.
2Reliability
If malware scanning is performed on all targets, then comprehensive security coverage is improved, but scanning time and productivity are reduced
Solution Approach 1:
The system applies different scanning strategies to different targets based on their priority classification. High-priority targets receive intensive preemptive scanning, while low-priority targets receive deferred or reduced scanning. This local differentiation maintains comprehensive security coverage overall while preserving system productivity by avoiding uniform intensive scanning of all targets.
Solution Approach 2:
The system performs partial scanning on lower-priority targets by deferring scans until resource availability increases, rather than attempting to scan everything immediately. This partial action approach ensures that critical security needs are met through focused scanning of high-priority targets while maintaining the option to expand coverage when resources permit.
3Loss of time
If malware scanning is performed during high resource usage periods, then timely malware detection is improved, but system performance and user experience deteriorate
Solution Approach 1:
The system dynamically monitors system resource usage levels and adjusts scanning schedules in real-time. When resource usage exceeds thresholds, the system automatically defers or reduces scanning activities. This dynamic adaptation allows timely malware detection when resources are available while preventing performance degradation during high-usage periods, resolving the contradiction between detection speed and system responsiveness.
Solution Approach 2:
The system preemptively identifies and schedules scanning of high-priority targets during low-resource periods before resource constraints arise. By taking preliminary anti-action to schedule these scans in advance during favorable conditions, the system ensures timely detection of critical threats without forcing scans during periods when they would harm system performance.
Data Source
AI summary
One embodiment relates to a computer-implemented method of preemptively scanning targets for malicious codes. Input qualities regarding said targets are received. A first computer-implemented procedure is applied to generate a measure of priority for scanning of said targets. Targets are selected for preemptive scanning using said measure of priority. In addition, resource utilization inputs may be received, and a second computer-implemented procedure may be applied to determine a system resource usage level using the resource utilization inputs. In that case, the malware scanning may be performed opportunistically based on the system resource usage level. Other embodiments, aspects and features may also be disclosed.