Software Detection via Signature Scanning in Isolated Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software detection methods are resource-intensive and time-consuming, particularly when detecting software in isolated sandbox environments or those not listed in package management tools, and they fail to detect software installed and later deleted within short periods.
Innovation Solution
The method involves scanning file systems for specific signatures indicative of isolated environments, selecting appropriate plugins to query these environments, and determining installed software without performing a full file system scan, thereby reducing resource usage and improving detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a full file system scan is performed to detect software, then detection completeness is improved, but resource consumption and detection time increase significantly
Solution Approach 1:
The patent segments the file system scanning process into two phases: first scanning for sandbox environment signatures to identify isolated environments, then selectively scanning only within those identified environments. This segmentation avoids the need to scan the entire file system, reducing resource consumption while maintaining detection completeness for targeted software instances.
Solution Approach 2:
The patent performs preliminary scanning for sandbox signatures before the main software detection process. By identifying isolated environments in advance through signature scanning, the system can then focus resource-intensive software detection only on the relevant portions of the file system, avoiding unnecessary scanning of non-isolated environments.
2Reliability
If a full file system scan is performed to detect software, then detection completeness is improved, but detection time increases significantly
Solution Approach 1:
The patent divides the detection process into two stages: first identifying sandbox environments through signature scanning, then performing software detection only within those identified environments. This segmentation dramatically reduces detection time by avoiding systematic scanning of the entire file system while maintaining completeness for detected software.
Solution Approach 2:
The patent performs preliminary signature scanning to identify sandbox environments before executing the main software detection routine. This preliminary action filters the search space, allowing the time-consuming software detection to focus only on relevant directories and files within identified sandboxes rather than scanning the entire file system.
3Ease of operation
If traditional package management tools are used for software detection, then ease of operation is improved, but detection capability for isolated sandbox environments deteriorates
Solution Approach 1:
The patent introduces sandbox signature scanning as an intermediary mechanism that bridges traditional package management tools and isolated sandbox environments. By first identifying sandbox environments through signature scanning, the system can then apply appropriate detection methods within those environments, enabling detection of software that traditional package managers cannot access or detect.
Solution Approach 2:
The patent creates a multi-functional detection system that can operate in two modes: traditional package management mode for standard software detection and sandbox signature scanning mode for isolated environment detection. This universality allows the same system to handle both conventional and advanced detection scenarios, maintaining ease of operation while extending detection capability to isolated environments.
Data Source
AI summary
A computer-implemented method for software detection is disclosed. The computer-implemented method includes scanning a list of file systems present on a computer system and described by a respective mount point for a signature from a set of predetermined signatures. The computer-implemented method further includes responsive to detecting the signature from the set of predetermined signatures, selecting a particular plugin from a predetermined list of plugins based, at least in part, on the detected signature. The computer-implemented method further includes querying, using the plug-in, an operating environment of the filesystem for data indicative of software running in the operating environment. The computer-implemented method further includes determining software running in the operating environment based, at least in part, on the data returned from querying the operating environment of the filesystem.