Probabilistic File Scanning Reducing Resource Consumption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing real-time file monitoring systems are resource-intensive and inefficient due to the high number of file operations, resulting in poor benefits from scanning for viruses and trojans, as the probability of encountering malicious files is low.
Innovation Solution
A file scanning method and system where a server determines a property indicator of a file based on attribute information from multiple clients, indicating the probability of the file being malicious, and sends this indicator to clients to decide whether to scan, thereby reducing the number of files scanned and optimizing resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If real-time file monitoring is performed on all file operations, then virus detection capability is improved, but system resource consumption increases significantly
Solution Approach 1:
The patent changes the parameter of file scanning from a binary decision (scan or not) to a probabilistic approach. By calculating a scanning probability value based on multiple attributes (file type, location, behavior patterns, reputation data), the system dynamically adjusts which files warrant scanning resources. This transforms the monitoring strategy from uniform real-time scanning to selective probabilistic scanning, reducing overall resource consumption while maintaining detection effectiveness for high-risk files.
Solution Approach 2:
Instead of applying full scanning resources to all files, the patent implements partial action by scanning only those files whose calculated scanning probability exceeds a predetermined threshold. This selective approach applies scanning resources partially and disproportionately to high-risk files rather than uniformly across all file operations, optimizing the balance between detection capability and resource usage.
2Reliability
If all files are scanned in real-time, then security coverage is improved, but scanning efficiency deteriorates
Solution Approach 1:
The patent introduces a scanning probability parameter calculated from multiple file attributes to transform the scanning decision process. Files are assigned probability scores based on their characteristics (type, location, behavior, reputation), and only files exceeding a threshold probability are scanned. This parameter-driven approach maintains comprehensive security coverage for high-risk files while dramatically improving scanning efficiency by excluding low-risk files from the scanning process.
Solution Approach 2:
The system performs partial scanning action by selectively applying virus scanning only to files with high scanning probability values. This partial action approach ensures that security coverage is concentrated on files most likely to be malicious, thereby maintaining effective security coverage while significantly improving scanning efficiency by avoiding unnecessary scans of benign files.
3Measurement precision
If continuous file scanning is performed, then virus detection accuracy is improved, but impact on system operations increases
Solution Approach 1:
The patent employs parameter changes by calculating a scanning probability value based on multiple file attributes including file type, location, behavior patterns, and reputation data. This probabilistic parameter allows the system to maintain high virus detection accuracy for files that exhibit suspicious characteristics while minimizing the impact on normal system operations by avoiding scanning of files with low probability scores. The parameter-driven approach ensures detection accuracy is preserved for high-risk files without the overhead of continuous scanning across all files.
Solution Approach 2:
The system implements partial scanning action by selectively scanning only those files whose scanning probability exceeds a predetermined threshold. This approach maintains high virus detection accuracy for files that warrant scrutiny while significantly reducing the impact on system operations by excluding the majority of benign files from the scanning process. The partial action strategy optimizes the balance between detection accuracy and operational smoothness.
Data Source
AI summary
A file scanning method and a file scanning system, a client and a server are disclosed. The server may determine a property indicator of a file, that represents probability of the file being a malicious program. The server may make this determination based on a comprehensive consideration of attribute information of the file. The attribute information may be reported by a plurality of clients. The server may send the property indicator to the clients. The clients may determine, according to the property indicator, a scanning strategy on whether to scan the file. Alternatively, the server may determine, according to the property indicator, a scanning strategy on whether to scan the file, and may send the scanning strategy to the clients. The clients may scan the file in accordance with the scanning strategy. Accordingly, only the file with higher probability of being a malicious program may be selectively scanned.