Remote Malware Scanning via File Segmentation and Metadata Reconstruction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional remote malware scanning techniques face inefficiencies in data transmission and computational resources due to the need to upload entire files for analysis, limiting the ability to perform both static and dynamic file analysis, which compromises security and reliability.
Innovation Solution
A method where metadata is used to identify unknown file items, allowing only those items to be transmitted and reconstructed at a remote node for dynamic malware analysis, enabling comprehensive file scanning without uploading the entire file.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire file is uploaded for remote malware scanning, then comprehensive malware analysis (both static and dynamic) can be performed, but network traffic and computational requirements increase significantly
Solution Approach 1:
The patent segments the file into multiple parts and transmits them separately. The remote entity reconstructs the file by assembling these segments only when needed for dynamic analysis, rather than transmitting the entire file upfront. This segmentation allows selective transmission of only necessary file portions.
Solution Approach 2:
The patent performs preliminary static analysis on file segments before committing to full file reconstruction. The remote entity analyzes uploaded segments to determine whether dynamic analysis of the complete file is necessary, allowing early termination if malware is detected in segments alone, thus avoiding unnecessary full file transmission and processing.
2Quantity of substance
If only a portion of the file is uploaded to reduce network traffic, then bandwidth and storage requirements are reduced, but dynamic analysis of the entire file cannot be performed
Solution Approach 1:
The patent implements a dynamic approach where the decision to reconstruct and perform dynamic analysis on the full file is made based on results from preliminary static analysis of segments. The system adapts its behavior - either performing only static analysis on segments or proceeding to full reconstruction and dynamic analysis - based on what the preliminary analysis reveals about potential malware threats.
3Reliability
If the entire file is processed at the remote entity, then complete malware analysis is achieved, but processing time and computational effort increase
Solution Approach 1:
The patent performs preliminary static analysis on file segments before deciding whether full file reconstruction and dynamic analysis are necessary. This preliminary action enables early detection of malware in segments, allowing the system to terminate the scanning process early and avoid the time-consuming full file reconstruction and dynamic analysis when not required.
Data Source
AI summary
Measures for enabling resource-efficient remote malware scanning capable of static and dynamic file analysis including, at a remote entity, obtaining metadata of an electronic file to be scanned for malware, said metadata including at least information for identification of one or more file items contained in the electronic file, identifying whether at least one file item of the electronic file is not pre-known at the remote entity, instructing delivery of any identified at least one file item of the electronic file, reconstructing the electronic file by assembling its file items, including any file item of the electronic file, which is not pre-known at the remote entity, and any remaining file item of the electronic file, which is pre-known at the remote entity, on the basis of the obtained metadata of the electronic file, and executing a dynamic malware analysis on a runtime behavior of the reconstructed electronic file.