Selective Malware Scanning via File Integrity Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face performance issues due to the resource-intensive process of scanning every file on a computing device for malware, especially when new malware is identified, leading to decreased performance and increased computational resources being allocated to unnecessary scans.
Innovation Solution
A system that selectively scans files by validating their integrity using a unique signature comparison and tracking modifications through an integrity table, preventing unnecessary scans for files from trusted sources that have not been modified, thereby reducing computational resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If every file on a computing device is scanned for malware when new malware is identified, then malware detection reliability is improved, but computing device performance deteriorates due to resource-intensive scanning operations
Solution Approach 1:
The patent segments files into two categories: those from trusted sources and those from untrusted sources. Files from trusted sources are excluded from malware scanning, while only files from untrusted sources are scanned. This segmentation allows the system to maintain high malware detection reliability for potentially malicious files while avoiding the performance penalty of scanning all files.
Solution Approach 2:
The patent applies different scanning policies to different files based on their source characteristics. Instead of uniform scanning of all files, the system applies localized quality control by scanning only specific files from untrusted sources while exempting files from trusted sources. This local quality approach maintains security where needed while preserving overall system performance.
2Measurement precision
If integrity verification is performed by comparing processed representations of files, then file integrity validation is improved, but computational resource usage increases equivalently to performing full antivirus scans
Solution Approach 1:
The patent performs integrity verification in advance by comparing file representations when files are first received or modified. The system pre-validates file integrity using hashing algorithms and stores verification results. This preliminary action ensures that when malware scanning is needed, the system already has integrity information, avoiding the need to perform computationally expensive verification operations at scan time.
Solution Approach 2:
The patent creates and stores copies of processed file representations (hashes) in an integrity verification database. Instead of re-computing file hashes during scanning operations, the system retrieves pre-computed hash copies from the database for comparison. This copying approach maintains precise integrity validation while dramatically reducing computational resource usage during actual scanning operations.
Data Source
AI summary
In accordance with this invention, a system, method, and computer-readable medium that selectively scans files stored on a computing device for malware is provided. One or more files may be sent from a trusted source to a computing device that implements the present invention. The integrity of the files that originate from a trusted source is validated using a signature-based hashing function. Any modifications made to files stored on the computing device are tracked by a component of the operating system. In instances when the file is not modified after being validated, an aspect of the present invention prevents the file from being scanned for malware when a scanning event is directed to the file. As a result, the performance of the computing device is improved as static files from trusted sources are not repeatedly scanned for malware.