Recent File Malware Scanning with Alternative Data Streams
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional malware detection systems face inefficiencies in scanning recently downloaded Internet files, as they often require extensive computational resources and may not effectively monitor changes in files over time.
Innovation Solution
A system utilizing drivers to filter and scan recently downloaded files based on security zone identifiers, storing metadata in alternative data streams to track file scans and changes, and prioritizing executable files for scanning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malware detection systems scan all downloaded files, then malware detection coverage is improved, but computational resource usage increases
Solution Approach 1:
The patent segments the file scanning process by creating two distinct groups: recently downloaded files (scanned by first driver) and existing files (monitored by second driver). This segmentation allows the system to apply different scanning strategies to different file categories, reducing overall computational resource usage while maintaining comprehensive malware detection coverage.
Solution Approach 2:
The system performs preliminary scanning of downloaded files immediately upon download using the first driver, storing results in alternative data streams. This preliminary action ensures that files are scanned before they can potentially execute malware, while the pre-stored scan results enable efficient change detection without requiring full re-scans of unchanged files.
2Reliability
If malware scanners continuously monitor all files, then malware detection effectiveness is improved, but system performance deteriorates
Solution Approach 1:
The patent implements dynamic monitoring where the second driver continuously watches for file changes and only triggers rescanning when actual modifications occur. This dynamic approach adjusts the monitoring intensity based on file state, maintaining high malware detection effectiveness while minimizing unnecessary scanning operations that would degrade system performance.
Solution Approach 2:
The system uses feedback from the alternative data streams to determine whether files have changed. By comparing current file states against stored baseline information, the system receives feedback that triggers rescanning only when necessary, optimizing the balance between detection effectiveness and system performance.
3Use of energy by moving object
If the system scans only recently downloaded files, then computational resource usage is reduced, but malware detection coverage may be compromised
Solution Approach 1:
The patent adds a temporal dimension to file monitoring by implementing two-time monitoring: initial scanning of recently downloaded files and subsequent monitoring of file changes over time. This dimensional approach ensures that both newly downloaded files and modified existing files are detected, maintaining comprehensive malware coverage while focusing computational resources efficiently.
Solution Approach 2:
The alternative data streams serve as an intermediary mechanism that stores baseline file information. This intermediary enables the second driver to efficiently detect file changes without requiring continuous full-scanning, thus maintaining comprehensive monitoring coverage while reducing computational resource consumption.
4Measurement precision
If the system monitors file changes by comparing stored information, then malware detection accuracy is improved, but device complexity increases
Solution Approach 1:
The patent embeds alternative data streams within the file system structure itself, nesting the monitoring mechanism inside the existing file metadata. This nesting approach allows the system to maintain high file change detection accuracy while avoiding the need for separate external monitoring systems, thereby reducing overall device complexity.
Data Source
AI summary
Systems and methods for recent file malware scanning are provided herein. In some embodiments, a security system may include a processor programmed to download one or more files; filter, by a first driver, the one or more downloaded files using a security zone identifier; scan, by the first driver, the filtered subset of one or more files for malware; store, by a second driver, a first set of information associated with each of the scanned files to indicate that each the filtered subset of one or more files have been scanned, wherein the first set of information is stored as metadata using alternative data stream (ADS) associated with each scanned file; monitor, by the second driver, changes to existing files based on the metadata stored; send instructions to rescan any existing file that has changed for malware; and update the information associated with any rescanned file's metadata using the ADS.