Risk-aware scanning using differential and incremental file analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus scanning methods consume significant processing cycles and degrade computer performance by scanning all files on storage devices, leading to prolonged scan operations and increased network utilization, while manual filtering techniques are time-consuming and inefficient.
Innovation Solution
Implementing incremental and differential scanning methods that utilize a file inclusion list to scan only files that have changed during a defined time period, leveraging a change log to monitor file operations and update scan lists dynamically, thereby reducing the number of files needing to be scanned without compromising virus detection efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all files on storage devices are scanned for viruses, then comprehensive virus detection is achieved, but processing cycles are significantly consumed and computer performance is degraded
Solution Approach 1:
The patent segments the file scanning process by dividing files into different categories based on their risk levels. High-risk files (executable files, scripts, downloaded content) are scanned thoroughly, while low-risk files (system files, trusted applications) are scanned less frequently or with reduced intensity. This segmentation allows comprehensive virus detection for critical files while minimizing the overall scanning burden on the system.
Solution Approach 2:
The patent applies different scanning qualities and depths to different files based on their location and characteristics. Files in high-risk directories (Downloads, Temp) receive intensive scanning, while files in trusted locations (System32, approved application folders) receive lighter scanning. This local quality differentiation ensures thorough protection where needed while preserving system performance in stable areas.
2Reliability
If a scheduled scan of all hard drive contents is performed, then complete virus coverage is achieved, but the scan operation period is prolonged and network utilization increases
Solution Approach 1:
The patent performs preliminary actions by maintaining continuous monitoring of file systems and maintaining updated risk assessments of files before a scheduled scan is initiated. This pre-processing allows the system to identify which files are likely to contain threats, so that during the scheduled scan, only those high-probability files require intensive scanning, dramatically reducing the overall scan time while maintaining detection coverage.
Solution Approach 2:
The patent applies partial scanning actions to files based on their risk profiles. Instead of scanning every file with the same exhaustive method, the system applies scanning intensity proportional to the detected risk level. High-risk files receive excessive (thorough) scanning, while low-risk files receive minimal or no scanning during scheduled operations, reducing total scan time while maintaining adequate protection.
3Productivity
If manual filtering techniques are used to select files for scanning, then scan operation time is reduced, but the process becomes time-consuming and requires frequent manual updates
Solution Approach 1:
The patent implements self-service by automatically monitoring file systems, detecting file changes, and dynamically updating the risk assessment of files without user intervention. The system automatically identifies new high-risk files, updates scanning priorities, and adjusts scan lists based on observed file behavior and characteristics. This eliminates the need for manual filtering maintenance while keeping scan operations efficient and up-to-date.
Solution Approach 2:
The patent incorporates feedback mechanisms where the scanning system continuously monitors file system changes, user interactions, and scan results to dynamically adjust scanning priorities. When files are created, modified, or accessed, the system receives feedback about these changes and automatically updates the risk assessment and scan scheduling. This closed-loop feedback system maintains optimal scan efficiency without requiring manual reconfiguration.
Data Source
AI summary
Scanning is disclosed. A system is monitored to detect object events. A risk level is determined for an object event, and a scan is scheduled for an object associated with the object event according to the risk level. The risk level may be based on the risk level of the object type, and on the risk level of the operation. An immediate on access scan may be scheduled for a first risk range, a differential scan may be scheduled for a second risk range, and an incremental scan may be scheduled for a third risk range. The scheduled scan is performed.