Streaming Malware Signature Updates via Delta Files

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current anti-malware systems face delays in distributing malware signature updates, which can leave computers vulnerable, and existing methods consume significant network bandwidth when trying to increase update frequency.

Innovation Solution

Implementing a mechanism for streaming malware signature definition updates that allows for frequent, minute-by-minute updates while conserving network resources by using additive streaming packages, where newly certified signatures are incorporated into both full and streaming signature definition files, with the streaming files containing only signatures received during a specific period.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If full signature definition files are downloaded frequently to improve malware detection coverage, then anti-malware protection effectiveness is improved, but network bandwidth consumption increases dramatically

Engineering Contradiction:
Improveanti-malware coverageVSAvoidnetwork bandwidth consumption
Core Design Contradiction:
ReliabilityVSLoss of energy

Solution Approach 1:

The patent segments the signature definition updates into two distinct types: full definition files containing all signatures and differential updates containing only new signatures. This segmentation allows clients to receive comprehensive updates periodically while obtaining incremental updates more frequently without proportionally increasing network bandwidth consumption, as differential updates are much smaller in size.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent implements partial action by providing differential updates that contain only the portion of signature data that has changed (new signatures) rather than transmitting complete signature sets. This partial transmission approach enables frequent updates with minimal bandwidth consumption, as clients receive only the necessary incremental changes rather than redundant full dataset transmissions.

Inventive Principle:
Principle #16Partial or excessive action

2Loss of time

If the publication rate of full definition files is increased to improve anti-malware coverage, then response time to new malware is reduced, but network bandwidth consumption increases dramatically

Engineering Contradiction:
Improveupdate delayVSAvoidnetwork bandwidth consumption
Core Design Contradiction:
Loss of timeVSLoss of energy

Solution Approach 1:

The patent divides update delivery into two segments: periodic full definition file publications and more frequent differential update publications. This segmentation enables the system to maintain up-to-date malware signatures with minimal delay by providing differential updates frequently, while full definition files are published less frequently to conserve network resources.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent prepares differential updates in advance by continuously tracking new signature definitions and packaging them for distribution. This preliminary preparation allows differential updates to be immediately available when published, reducing the time delay between malware discovery and client protection without requiring frequent full definition file redistributions.

Inventive Principle:
Principle #10Preliminary action

3Loss of energy

If differential updates are used to reduce network bandwidth consumption, then network resource efficiency is improved, but clients may miss updates if they are not available during the update period

Engineering Contradiction:
Improvenetwork bandwidth consumptionVSAvoidupdate completeness
Core Design Contradiction:
Loss of energyVSReliability

Solution Approach 1:

The patent implements a feedback mechanism where clients report their current signature definition version to the server, and the server responds with the appropriate differential update containing all signatures newer than the client's current version. This feedback loop ensures that clients receive complete update sets regardless of when they connect, as the server tracks and delivers all missing updates in sequence.

Inventive Principle:
Principle #23Feedback

Solution Approach 2:

The patent pre-packages differential updates sequentially, where each differential update build upon previous ones. This preliminary preparation ensures that even if a client misses an update publication, subsequent differential updates will contain cumulative changes that bring the client current, maintaining update completeness without requiring the client to be online at specific times.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP2650817B1Streaming malware definition updates
Publication Date: 2016.05.04 GEN DIGITAL INC
  • EP2650817B1 patent drawingFigure 1
  • EP2650817B1 patent drawingFigure 2
  • EP2650817B1 patent drawingFigure 3

AI summary

The invention relates to a method comprising: receiving a mini drive file after a threshold publication time (340, 515), wherein the mini drive file contains pointers to a plurality of delta definition files and a pointer to a storage area (435), and each of the plurality of delta definition files comprises changes to a full signature definition file; comparing a version identifier associated with a full signature definition file installed on a client computer with the versions identified in the mini drive file so as to identify information associated with an appropriate delta definition file (520); and requesting the delta definition file from the storage area.