Remote Malware Scanning via File Segmentation and Recipe Reconstruction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional remote malware scanning techniques require uploading entire files for analysis, leading to significant network traffic, computational effort, and storage requirements, while only allowing static analysis, preventing dynamic analysis of file behavior.
Innovation Solution
A method where a first node compares the file to be scanned with previously scanned files, generates a recipe for the second node to reconstruct the file, and performs dynamic malware analysis on the reconstructed file, allowing both static and dynamic analysis without uploading the entire file.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire file is uploaded for remote malware scanning, then comprehensive malware analysis (including dynamic analysis) can be performed, but network traffic and storage requirements increase significantly
Solution Approach 1:
The patent segments the file into multiple blocks and transmits only those blocks that differ from previously scanned files (delta blocks). This segmentation allows the remote scanning system to receive minimal data while still performing comprehensive analysis, resolving the contradiction between analysis completeness and network traffic volume.
Solution Approach 2:
The patent performs preliminary comparison of incoming file blocks against previously scanned files before transmission. By identifying and transmitting only the differential blocks that contain changes, the system prepares the data in advance, allowing complete malware analysis to be performed on reconstructed files while minimizing network traffic.
2Quantity of substance
If only a portion of the file is uploaded to reduce network traffic, then bandwidth and storage requirements are reduced, but dynamic analysis of the entire file cannot be performed
Solution Approach 1:
The patent performs preliminary identification of differential blocks and transmits only those portions of the file that contain changes. The receiving system then reconstructs the complete file by combining received delta blocks with data from previously scanned files, enabling full dynamic analysis without requiring transmission of the entire original file.
Solution Approach 2:
The patent creates a reconstructed copy of the original file at the remote scanning system by assembling transmitted delta blocks with data from previously scanned files. This copying approach allows the complete file to be available for dynamic analysis while only minimal differential data needs to be transmitted over the network.
3Measurement precision
If the entire file is transmitted for scanning, then accurate malware detection is achieved, but computational effort and processing time increase
Solution Approach 1:
The patent segments the file into blocks and transmits only differential blocks for scanning. This segmentation maintains malware detection accuracy by ensuring all relevant changes are transmitted, while improving scanning efficiency by reducing the total volume of data that requires computational processing at the remote system.
Solution Approach 2:
The patent changes the parameter of data transmission from complete files to differential blocks only. This parameter change reduces the amount of data requiring computational effort while maintaining detection accuracy, as the differential blocks contain all necessary information about file changes that may indicate malware.
Data Source
AI summary
There are provided measures for enabling resource-efficient remote malware scanning capable of static and dynamic file analysis. Such measures could exemplarily comprise include, at a local entity, comparing file items of an electronic file to be scanned for malware with the file items of previously scanned electronic files, generating a recipe of the electronic file to be scanned, sending the generated recipe of the electronic file to be scanned for malware to a remote entity for enabling reconstructing the electronic file by assembling its file items on the basis of the obtained recipe and executing a dynamic malware analysis on a runtime behavior of the reconstructed electronic file.