Remote Security Server with Zero False Negative Filter
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional computer security systems face challenges in efficiently protecting client computers from malicious threats due to high network bandwidth consumption and latency when relying on remotely located security servers, as they require bulk operations and pattern matching, which can lead to increased costs and delays.
Innovation Solution
The implementation of a Zero False Negative Filter (ZFNF) on client computers, which filters query inputs before forwarding them to a remote security server, using algorithms like Bloom filters to ensure only relevant queries are transmitted, reducing unnecessary network traffic and latency, and maintaining a local filter to prevent false negatives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional client-based scan engine and pattern file are used locally, then security scanning capability is maintained, but processing requirements and memory usage increase significantly
Solution Approach 1:
The patent extracts the pattern file database from the client computer and relocates it to a remote security server. The client retains only the scan engine and communication interface, significantly reducing local processing requirements and memory usage while maintaining security scanning capability through remote pattern matching operations.
Solution Approach 2:
The patent introduces a communication interface as an intermediary between the client scan engine and the remote security server's pattern file database. This intermediary manages the interaction and data transfer, allowing the client to perform security scans using remote patterns without requiring the full pattern database to be present locally.
2Measurement precision
If pattern file is continually updated to keep up with newly discovered viruses, then security detection accuracy is improved, but size of pattern file and processing requirements increase
Solution Approach 1:
By extracting the large pattern file database from the client and storing it remotely on the security server, the system can maintain up-to-date security patterns with high detection accuracy while the client computer experiences minimal local storage requirements. The remote server handles the burden of storing and managing the large pattern file.
Solution Approach 2:
The remote security server serves multiple functions: it stores the pattern file database, updates the patterns with newly discovered viruses, and provides pattern matching services to multiple client computers. This multi-functional approach allows continuous updates and high detection accuracy to be maintained centrally while serving many clients efficiently.
3Reliability
If all query inputs are forwarded to the remote security server, then comprehensive security checking is performed, but network bandwidth consumption increases
Solution Approach 1:
The patent implements a local filter that performs partial security checking before forwarding queries to the remote server. The filter screens out obviously safe files locally, forwarding only those requiring comprehensive remote checking. This partial local action reduces network bandwidth consumption while maintaining comprehensive security through remote verification of suspicious files.
Solution Approach 2:
The local filter performs preliminary security assessment of files before they are forwarded to the remote security server. By pre-screening files and identifying only those that require remote pattern matching, the system reduces the volume of network traffic while ensuring that all potentially malicious files receive comprehensive remote security checking.
Data Source
AI summary
A client computer may be configured to perform computer security operations in conjunction with a remotely located security server. Upon detection of a computer security event, such as reception of a file, the client computer may generate a query input and determine if the query input has corresponding security information in the security server. When the query input has corresponding security information, the client computer may forward the query input to the security server. In response, the security server may retrieve the security information using the query input and provide the security information to the client computer. As a particular example, the security event may be reception of a file in the client computer and the security information may indicate whether or not the file is infected with a computer virus.