Serverless Malicious Code Scanning via Memory-Mapped File Sections
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Scanning large files for malicious code in public cloud storage is challenging due to limitations in memory allocation within ephemeral environments of serverless computing platforms, which restricts the ability to execute applications and incur high costs when transferring large files for scanning.
Innovation Solution
A security module creates a memory-mapped space for the entire file content, retrieving and scanning sections as needed, without initial full memory allocation, allowing for efficient scanning of arbitrarily large files within limited memory resources, and destroying the ephemeral environment after scanning is complete.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire file is loaded into memory for scanning, then scanning completeness is improved, but memory allocation requirements worsen
Solution Approach 1:
The patent divides the file into multiple sections and scans them sequentially. The security module loads only one section at a time into memory, scans it, then releases the memory before loading the next section. This segmentation approach maintains scanning completeness while reducing peak memory allocation requirements, allowing large files to be scanned within the memory constraints of ephemeral serverless environments.
2Adaptability or versatility
If large files are transferred to external systems for scanning, then scanning capability is improved, but network bandwidth consumption worsens
Solution Approach 1:
The patent introduces a memory-mapped space as an intermediary between the cloud storage and the security scanning process. The memory-mapped space allows the security module to access file sections directly from cloud storage without full file transfer, enabling scanning capability while minimizing network bandwidth consumption by only retrieving the portions of the file that need to be scanned.
3Adaptability or versatility
If applications are executed in cloud storage, then scanning flexibility is improved, but operational costs worsen
Solution Approach 1:
The patent enables the security module to perform scanning operations directly within the serverless function's ephemeral environment, eliminating the need to transfer files to external scanning systems. The module retrieves file sections as needed, scans them in-place, and releases resources, providing scanning flexibility while reducing operational costs by avoiding unnecessary data transfer and external processing.
Data Source
AI summary
A file is stored in a public cloud storage. A serverless computing platform receives an event notification that the file has been stored and, in response, creates an instance of an ephemeral environment wherein a security module is executed. The security module creates a memory-mapped space with memory locations that are mapped to the entire content of the file but does not allocate memory for all of the memory locations. Instead, the security module retrieves sections of the file from the public cloud storage as these sections are accessed in their designated memory locations in accordance with the memory mapping, allocates memory for the retrieved sections, stores the retrieved sections in their designated memory locations, and scans the retrieved sections in their designated memory locations for malicious code. The security module continues scanning the file in sections until relevant sections of the file have been scanned.