Preliminary File Filtering for Application Control Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current application control systems burden computing resources by analyzing every file launched on a network, which is inefficient and slows down processing.
Innovation Solution
Implementing preliminary file filtering to intercept operations, apply filters to selected file parts, determine characteristics, and decide whether to exclude files from further analysis, thereby reducing the load on clients and optimizing resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If application control systems analyze every file launched on the network, then security coverage is improved, but computing resource burden increases
Solution Approach 1:
The patent divides file analysis into two segments: preliminary filtering (performed by the system before file execution) and full analysis (performed by the application control system client). The preliminary filter analyzes only the first portion of the file (e.g., header, metadata) to determine if full analysis is needed, thereby segmenting the analysis workload and reducing computing resource burden while maintaining security coverage.
Solution Approach 2:
The patent applies partial action by analyzing only the first portion of the file (e.g., first N bytes or specific file sections) during preliminary filtering, rather than analyzing the entire file. This partial analysis is sufficient to identify malicious files in many cases, reducing the computing resources required while maintaining effective security coverage.
2Measurement precision
If application control systems analyze every file, then detection accuracy is improved, but processing speed decreases
Solution Approach 1:
The patent implements preliminary action by performing file filtering before the application control system client receives the file for analysis. The preliminary filter processes files in advance using lightweight criteria (such as file type, size, location, or header analysis), creating a decision log that determines whether full analysis is needed. This preliminary action speeds up the overall processing by avoiding unnecessary full file analyses while maintaining detection accuracy for malicious files.
Solution Approach 2:
The patent segments the file analysis process into a fast preliminary filtering stage and a more thorough analysis stage. By analyzing only the first portion of the file during preliminary filtering, the system achieves fast processing for the majority of files while reserving full analysis for suspicious files, thus maintaining detection accuracy without sacrificing processing speed.
3Reliability
If the system analyzes all files, then security thoroughness is improved, but time consumption increases
Solution Approach 1:
The patent applies partial action by performing only the necessary preliminary analysis (first portion of the file) to determine security threats. This partial analysis is sufficient to identify malicious files, reducing time consumption for the majority of benign files while maintaining security thoroughness for files that require full analysis.
Solution Approach 2:
The patent implements preliminary action by making quick preliminary decisions about file analysis before the application control system client processes the file. By using fast preliminary filtering criteria (file type, size, location, header analysis), the system quickly determines whether full analysis is needed, significantly reducing time consumption while maintaining thorough security checks for suspicious files.
Data Source
AI summary
Disclosed are systems, methods and computer program products for control of applications using preliminary file filtering. An example method includes intercepting, by a processor, an operation on a file performed by an application; selecting at least a part of the file; applying one or more file filters to the selected part of the file; determining a set of file characteristics based on outcomes of the file filters; determining a decision, based on the set of file characteristics, whether to exclude the file from further analysis by a client of an application control system; and based on the decision, excluding the file from the further analysis by the client of the application control system or providing the file to the client of the application control system for further analysis whether to allow or prohibit the operation on the file.