Shared Verdict Database for Deduplicating Network Malware Scans
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware scanners consume excessive computing resources due to redundant scanning of objects, especially in network environments where the same files are present across multiple devices, leading to inefficient resource utilization.
Innovation Solution
Implement a system and method for deduplicating malware scan attempts by using a shared verdict database and probabilistic data structures like bloom filters to identify and share scan results across computing devices, thereby avoiding redundant scans.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple computing devices perform independent malware scans on the same objects, then security coverage is improved, but computing resource consumption increases
Solution Approach 1:
The patent merges the malware scan verdicts from multiple computing devices into a shared verdict database. When a computing device needs to scan an object, it first queries the shared database to see if other devices have already scanned the same object (using hash values for identification). If a verdict exists in the shared database, the current device uses that existing verdict instead of performing a redundant scan, thus consolidating scanning efforts across the network.
Solution Approach 2:
The shared verdict database acts as an intermediary mechanism between multiple computing devices. It stores hash values and corresponding malware scan verdicts, enabling devices to coordinate their scanning activities. The database mediates by providing scan results from one device to other devices, eliminating the need for each device to independently scan every object.
2Speed
If computing devices scan all objects locally without sharing results, then scanning speed is maintained, but redundant scanning occurs
Solution Approach 1:
The system performs preliminary actions by having computing devices query the shared verdict database before initiating a malware scan. A computing device checks whether the object it needs to scan has been previously scanned by others and if a verdict is available in the shared database. This preliminary check prevents redundant scanning by identifying duplicate objects beforehand.
Solution Approach 2:
Instead of each device creating its own independent scan results, the system copies and shares verdict information from one device to others through the shared verdict database. When a device scans an object, it stores the verdict and hash value in the shared database, allowing other devices to copy this information and avoid re-scanning the same object.
3Productivity
If a shared verdict database is implemented across the network, then redundant scans are reduced, but system complexity increases
Solution Approach 1:
The shared verdict database is designed to serve multiple computing devices simultaneously, making it a universal system. It handles queries from any device in the network, stores verdicts from multiple sources, and provides consistent responses across all devices. This multi-functional approach consolidates what would otherwise be multiple separate scanning systems into one coordinated network-wide solution.
Data Source
AI summary
Disclosed herein are systems and method for deduplicating malware scan attempts. In one exemplary aspect, a method may include: receiving, from a first computing device of a plurality of computing devices in a network, a first hash value of an object and a verdict of a malware scan performed on the object by the first computing device; storing the first hash value and the verdict in a shared verdict database; receiving, from a second computing device in the network, a verdict request including a second hash value; determining that the first hash value and the second hash value match; in response to determining the match, transmitting, to the second computing device, the verdict of the malware scan performed on the object by the first computing device, wherein the second computing device does not perform a redundant malware scan on the object.