Threat Detection Quality Control via Iterative Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for evaluating the quality of antivirus engines only assess threat detection at specific points in time, lacking real-time monitoring and dynamic analysis, which leads to inefficiencies in identifying false positives and areas for improvement, particularly due to discrepancies between internal and external scanning verdicts.
Innovation Solution
A computer-implemented method and system for iterative dynamic assessment of threat detection quality by periodically scanning objects from various sources, comparing internal and external scan results, and adjusting detection rules to maintain consistent verdicts, thereby continuously improving threat detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of energy
If conventional periodic testing is used to evaluate antivirus engine quality, then resource consumption is reduced, but real-time quality monitoring capability is lost
Solution Approach 1:
The system implements periodic scanning of objects from collections at defined frequencies, combining this with real-time verification against third-party services. This periodic action allows the system to balance resource consumption with maintaining current quality assessment, scanning at optimized intervals rather than continuously while still providing timely quality monitoring.
Solution Approach 2:
The system establishes feedback loops where scan results are continuously verified against third-party scanning services, and quality metrics are dynamically adjusted based on discrepancies detected. This feedback mechanism enables real-time quality monitoring by constantly comparing internal engine performance with external benchmarks and automatically responding to quality degradation.
2Device complexity
If manual testing and assessment methods are used, then system complexity is reduced, but assessment objectivity and efficiency are worsened
Solution Approach 1:
The system implements automated self-assessment where the antivirus engine independently scans objects, compares results with third-party services, and generates quality metrics without manual intervention. This self-service approach dramatically improves assessment efficiency while maintaining manageable system complexity through automated workflows that replace manual processes.
Solution Approach 2:
The system replaces manual mechanical testing processes with automated electronic assessment mechanisms. Automated scanning, verification, and analysis systems substitute human operators, improving efficiency and objectivity while keeping complexity controlled through standardized automated procedures rather than complex manual protocols.
3Measurement precision
If comprehensive continuous scanning is implemented, then detection quality is improved, but resource consumption increases
Solution Approach 1:
The system implements partial continuous scanning by selectively scanning objects from collections at defined frequencies rather than continuously scanning all objects. This partial action approach maintains adequate detection quality by focusing resources on high-priority objects while reducing overall resource consumption compared to comprehensive continuous scanning of all objects.
Solution Approach 2:
The system dynamically adjusts scanning parameters including frequency, depth, and scope based on quality metrics and resource availability. When detection quality is sufficient, scanning intensity is reduced to conserve resources; when quality degradation is detected, scanning parameters are increased to restore quality, optimizing the balance between detection quality and resource consumption.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of continuous development of an internal threat scan engine based on an iterative quality assessment includes iteratively performing a dynamic assessment of a quality of a threat detection with a frequency defined for each of objects in an object collection, wherein a result of the dynamic assessment includes internal and external scan results of the objects and a consistency verdict of the internal and external scan results of the objects, changing a frequency of scanning iteration of the objects based on the consistency verdict of the external and internal scan results of the objects, classifying the objects based on the result of the dynamic assessment, and creating a development task including the internal and external scan results of the objects, meta-data of the objects, and automated test results to provide details for developing a software to fix inconsistency of the internal and external scan results.