Thin Client Antivirus Scanning via Server-Side Engine Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus methods consume significant local computing resources and bandwidth when detecting malicious codes, especially due to the need for periodic updates and scanning of large files, which can overwhelm computer systems.
Innovation Solution
A system that employs a client agent and a scan server communicating over a network, where the client agent locally receives scan requests and coordinates with the scan server to scan files using a scan engine, minimizing data transfer by only sending portions of files indicated as potentially malicious, and utilizing a file cache and digital signature checking to reduce network traffic and resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus scanning is performed locally on the client computer, then detection capability is improved, but computational burden and resource consumption increase
Solution Approach 1:
The antivirus system is segmented into client and server components. The client handles file access and initial processing, while the server performs the computationally intensive scanning operations. This division allows detection capability to be maintained through server-side scanning while reducing the computational burden on the client computer.
Solution Approach 2:
A server computer acts as an intermediary between the client and the scanning engine. The server receives scan requests from the client, performs the actual malicious code detection, and returns results to the client. This intermediary approach enables reliable detection while offloading computational resources from the client system.
2Measurement precision
If complete files are transferred for scanning, then detection accuracy is improved, but network bandwidth consumption increases
Solution Approach 1:
The system extracts only the necessary portions of files for scanning rather than transferring complete files. The server requests specific file segments or portions that contain potential malicious code, reducing network bandwidth consumption while maintaining detection accuracy through targeted analysis of critical file areas.
Solution Approach 2:
The scanning system performs partial scanning by analyzing only the portions of files that are most likely to contain malicious code, rather than scanning entire files. This partial action approach maintains sufficient detection accuracy while significantly reducing the amount of data that needs to be transferred over the network.
3Measurement precision
If periodic updates of scan patterns are performed, then detection precision is improved, but resource consumption and network traffic increase
Solution Approach 1:
The server maintains copies of scan patterns and malicious code signatures in its database, eliminating the need for frequent updates to client systems. The server can update its own pattern database independently and apply these updates to scanning operations without requiring clients to download and install updates, thereby reducing network traffic and client resource consumption while maintaining high detection precision.
Data Source
AI summary
A system for scanning a file for malicious codes may include a client agent running in a client computer and a scan server running in a server computer, the client computer and the server computer communicating over a computer network. The client agent may be configured to locally receive a scan request to scan a target file for malicious codes and to communicate with the scan server to scan the target file using a scan engine running in the server computer. The scan server in communication with the client agent allows the scan engine to scan the target file by issuing file I/O requests to access the target file located in the client computer. The client agent may be configured to check for digital signatures and to maintain a file cache of previously scanned files to minimize network traffic.