Selective Malware Scanning via Update Identifier Feedback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Anti-malware programs consume substantial resources by scanning content even if malware signatures have not changed, as they lack efficient methods to determine if updates are necessary, leading to resource wastage.
Innovation Solution
A method and system that utilize metadata and update logs to selectively scan objects for malware infection by using an update identifier to track changes, allowing operations on unchanged objects without scanning, thus reducing resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If content is scanned to determine whether it has changed, then malware detection reliability is improved, but resource consumption increases
Solution Approach 1:
The system performs preliminary actions by scanning content only when the update identifier changes, rather than scanning on every access. The update identifier is updated in advance when content changes occur, allowing the scanning decision to be made efficiently without unnecessary scans.
Solution Approach 2:
The system uses feedback from the update identifier to determine whether scanning is necessary. The update identifier provides feedback about content changes, allowing the system to skip scanning when content is unchanged and perform scanning only when needed, thus optimizing resource usage while maintaining detection reliability.
2Reliability
If content is scanned on every signature update, then malware detection coverage is improved, but time consumption increases
Solution Approach 1:
The update identifier is updated in advance when content changes occur, so that when scanning is needed, the system already has the information about whether changes occurred. This preliminary action eliminates the need to scan on every signature update, reducing time consumption while maintaining detection coverage.
Solution Approach 2:
The update identifier provides feedback about content changes since the last scan. This feedback mechanism allows the system to determine whether scanning is necessary, avoiding unnecessary scans on every signature update and thereby reducing time consumption while maintaining adequate malware detection coverage.
3Use of energy by moving object
If caching techniques are used to reduce resource consumption, then resource efficiency is improved, but the benefit is reduced when content changes are uncertain
Solution Approach 1:
The update identifier provides reliable feedback about content changes, allowing the caching system to confidently determine whether to serve cached content or scan for malware. This feedback mechanism maintains reliability in content change detection while preserving the resource efficiency benefits of caching.
Solution Approach 2:
The update identifier acts as an intermediary between the content storage system and the malware scanning system. It mediates the decision-making process by providing information about content changes, allowing the system to efficiently determine whether scanning is necessary without sacrificing detection reliability.
Data Source
AI summary
Techniques are described herein that are capable of selectively scanning objects for infection by malware (i.e., to determine whether one or more of the objects are infected by malware). For instance, metadata that is associated with the objects may be reviewed to determine whether update(s) have been made with regard to the objects since a determination was made that the objects were not infected by malware. An update may involve increasing a number of the objects, modifying one of the objects, etc. Objects that have been updated (e.g., added and/or modified) since the determination may be scanned. Objects that have not been updated since the determination need not necessarily be scanned. For instance, an allowance may be made to perform operations with respect to the objects that have not been updated since the determination without first scanning the objects for infection by malware.