Streaming Malware Signature Updates via Delta Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-malware systems face delays in distributing malware signature updates, which can leave computers vulnerable, and existing methods consume significant network bandwidth when trying to increase update frequency.
Innovation Solution
Implementing a mechanism for streaming malware signature definition updates that allows for frequent, minute-by-minute updates while conserving network resources by using additive streaming packages, where newly certified signatures are incorporated into both full and streaming signature definition files, with the streaming files containing only signatures received during a specific period.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full signature definition files are downloaded frequently to improve malware detection coverage, then anti-malware protection effectiveness is improved, but network bandwidth consumption increases dramatically
Solution Approach 1:
The patent segments the signature definition updates into two distinct types: full definition files containing all signatures and differential updates containing only new signatures. This segmentation allows clients to receive comprehensive updates periodically while obtaining incremental updates more frequently without proportionally increasing network bandwidth consumption, as differential updates are much smaller in size.
Solution Approach 2:
The patent implements partial action by providing differential updates that contain only the portion of signature data that has changed (new signatures) rather than transmitting complete signature sets. This partial transmission approach enables frequent updates with minimal bandwidth consumption, as clients receive only the necessary incremental changes rather than redundant full dataset transmissions.
2Loss of time
If the publication rate of full definition files is increased to improve anti-malware coverage, then response time to new malware is reduced, but network bandwidth consumption increases dramatically
Solution Approach 1:
The patent divides update delivery into two segments: periodic full definition file publications and more frequent differential update publications. This segmentation enables the system to maintain up-to-date malware signatures with minimal delay by providing differential updates frequently, while full definition files are published less frequently to conserve network resources.
Solution Approach 2:
The patent prepares differential updates in advance by continuously tracking new signature definitions and packaging them for distribution. This preliminary preparation allows differential updates to be immediately available when published, reducing the time delay between malware discovery and client protection without requiring frequent full definition file redistributions.
3Loss of energy
If differential updates are used to reduce network bandwidth consumption, then network resource efficiency is improved, but clients may miss updates if they are not available during the update period
Solution Approach 1:
The patent implements a feedback mechanism where clients report their current signature definition version to the server, and the server responds with the appropriate differential update containing all signatures newer than the client's current version. This feedback loop ensures that clients receive complete update sets regardless of when they connect, as the server tracks and delivers all missing updates in sequence.
Solution Approach 2:
The patent pre-packages differential updates sequentially, where each differential update build upon previous ones. This preliminary preparation ensures that even if a client misses an update publication, subsequent differential updates will contain cumulative changes that bring the client current, maintaining update completeness without requiring the client to be online at specific times.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method comprising: receiving a mini drive file after a threshold publication time (340, 515), wherein the mini drive file contains pointers to a plurality of delta definition files and a pointer to a storage area (435), and each of the plurality of delta definition files comprises changes to a full signature definition file; comparing a version identifier associated with a full signature definition file installed on a client computer with the versions identified in the mini drive file so as to identify information associated with an appropriate delta definition file (520); and requesting the delta definition file from the storage area.