Secure File Modification Logging for Malware Scan Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-malicious code scanning methods are inefficient due to slow scan times on large volumes and the unreliability of file system modification dates and volume change logs, which can be tampered with by malicious code, leading to potential overlooking of infected files.
Innovation Solution
A scanning optimization manager maintains a secure, non-tamperable record of file modifications and prioritizes scanning based on the most recent modification times, scanning only recently modified files upon receipt of new malicious code signatures, optimizing the scanning process by focusing on files most likely to be malicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire volume is scanned every time new malicious code signatures are received, then detection reliability is improved, but scan time increases significantly
Solution Approach 1:
The patent segments the scanning task by dividing files into groups based on their modification times. Instead of scanning the entire volume, it identifies and scans only the most recently modified files (e.g., files modified within the last 24 hours), which are statistically more likely to contain new malicious code. This segmentation maintains detection reliability for new threats while dramatically reducing scan time.
Solution Approach 2:
The patent applies partial action by scanning only a subset of files (recently modified ones) rather than the complete volume. This partial scanning approach is sufficient to detect new malicious code since infections require recent file modifications, while avoiding the time cost of scanning unchanged files.
2Productivity
If file system modification dates are used to determine which files to scan, then scan efficiency is improved, but reliability deteriorates due to tampering
Solution Approach 1:
The patent implements preliminary action by maintaining a secure, tamper-proof log of file modification times that is created and updated in advance. This log is generated by a trusted component of the file system and stored in a secure location, preventing malicious code from manipulating it. The log serves as a reliable basis for identifying recently modified files without relying on easily tampered file system timestamps.
Solution Approach 2:
The patent introduces an intermediary component - a secure logging mechanism that mediates between the file system and the scanning process. This intermediary maintains an authoritative record of file modifications that cannot be manipulated by applications, providing a trustworthy basis for scan prioritization while preserving scan efficiency.
3Use of energy by moving object
If scheduled scans are performed (e.g., weekly), then system resources are preserved, but detection timeliness worsens
Solution Approach 1:
The patent transforms the static scheduled scanning approach into a dynamic event-driven approach. Scanning is triggered dynamically based on actual events - specifically, when new malicious code signatures are received or when file modifications are detected in the secure log. This dynamic approach ensures timely detection without wasting resources on unnecessary scans when no new threats are present.
Solution Approach 2:
The patent implements feedback by continuously monitoring the secure log for new file modifications and triggering scans based on this feedback. When the log indicates recent file changes or when new malware signatures are received, the system automatically initiates a scan. This feedback mechanism ensures timely detection while optimizing resource usage by scanning only when necessary.
Data Source
AI summary
A scanning optimization manager efficiently scans files for malicious code. The scanning optimization manager maintains a non-tamperable record of modifications to files on a volume. The scanning optimization manager receives at least one malicious code signature. Responsive to the receipt of the at least one malicious code signature, the scanning optimization manager scans at least some files on the volume for the at least one malicious code signature at a priority corresponding to an associated modification status.