Scanning Rule Update System for Security Software
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional scanning rules for security software are not adaptable to different user environments and fail to timely address newly created files or scanning points, leading to high false alarm rates and reduced data security.
Innovation Solution
A method and system for updating scanning rules by obtaining operation records, extracting scanning information, calculating a matching degree between operation records and recommended operations, and updating the rules based on this degree, incorporating a device with modules for operation record retrieval, recommended operation retrieval, matching degree calculation, and scanning rule update.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If scanning rules are predetermined based on limited testing data and updated periodically, then the rules are simple to implement, but they result in high false alarm rates and reduced adaptability to different user environments
Solution Approach 1:
The system implements feedback by collecting user operation records (trust operations, removal operations, ignore operations) and using them to continuously update scanning rules. The server receives operation records from multiple clients, calculates matching degrees between operation records and recommended operations, and updates scanning rules based on this feedback to improve adaptability while reducing false alarms.
Solution Approach 2:
The system enables self-service by automatically updating scanning rules based on aggregated user operations without requiring manual intervention. The server autonomously processes operation records, calculates matching degrees, and updates scanning rules, allowing the system to adapt to new threats and user environments automatically.
2Reliability
If scanning rules are updated periodically on the server, then the update process is simple, but the rules are not timely adapted for newly created files or scanning points
Solution Approach 1:
The system implements continuous updating by continuously collecting operation records from multiple clients, continuously calculating matching degrees, and continuously updating scanning rules on the server. This continuous process ensures timely adaptation to newly created files and scanning points without requiring complex periodic update schedules.
Solution Approach 2:
The system performs preliminary actions by pre-calculating matching degrees between operation records and recommended operations before finalizing rule updates. This preliminary calculation ensures that only rules with sufficient matching degree support are updated, improving timeliness while maintaining controlled complexity.
3Ease of manufacture
If scanning rules are based on a small range of testing data, then the rule development is simple, but they are not suitable for application environments of different user groups
Solution Approach 1:
The system achieves universality by collecting operation records from multiple users across different application environments and using this diverse data to update scanning rules that serve all users. The server aggregates operations from various user groups and updates rules that are universally applicable while accounting for different environments, moving from simple rule development to multi-functional adaptability.
Data Source
AI summary
Systems and methods are provided for updating one or more scanning rules. For example, one or more first operation records being uploaded are obtained; scanning information corresponding to the first operation records is extracted; one or more recommended operations corresponding to the scanning information are obtained based on at least information associated with one or more scanning rules; a matching degree between the first operation records and the recommended operations is calculated; and the scanning rules are updated based on information associated with the matching degree.