Trusted-Domain File Verification via Pre-Approval Whitelists
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-virus technologies, including whitelist systems, are ineffective in protecting computing resources due to the inability to manually create comprehensive whitelists and limitations in web-spidering techniques, which fail to identify legitimate files and often misclassify files, leading to low detection rates and false positives.
Innovation Solution
A computer-implemented method that intercepts files, creates hash values using secure-hash algorithms, and stores them in approved-file databases, allowing only verified legitimate files to be accessed, while denying access to unverified files, thereby enhancing the accuracy of file legitimacy verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If web-spidering techniques are used to automatically identify legitimate files, then the productivity of whitelist creation is improved, but the measurement precision and reliability of file legitimacy verification deteriorate due to false positives and inability to access files behind authentication walls
Solution Approach 1:
The system performs preliminary actions by having users explicitly approve files before they are added to the whitelist. This pre-approval mechanism ensures that only files users have consciously selected are added, eliminating false positives while maintaining automated collection capabilities. The system collects files in advance but withholds whitelist status until explicit user approval is obtained.
Solution Approach 2:
The system introduces an intermediary approval mechanism between file collection and whitelist inclusion. Instead of directly adding files to the whitelist through automated spidering, the system uses an intermediate approval step where users verify file legitimacy. This intermediary layer resolves the contradiction by maintaining automated productivity while ensuring verification accuracy through user judgment.
2Measurement precision
If manual methods are used to create comprehensive whitelists, then the measurement precision of file legitimacy verification is improved, but the productivity and time required for whitelist creation deteriorate
Solution Approach 1:
The system performs preliminary automated collection of candidate files before user approval is obtained. This preliminary action captures files that users may want to approve, reducing the time users would otherwise spend manually searching for and selecting files. The system prepares the groundwork in advance while maintaining high precision through subsequent user verification.
Solution Approach 2:
The system enables users to self-service the whitelist creation process by allowing them to review and approve files at their convenience. Users can manually add files to the whitelist without administrator intervention, and the system automatically processes these additions. This self-service approach combines manual precision with automated efficiency, eliminating time losses associated with manual creation while maintaining accuracy.
3Ease of operation
If conventional anti-virus technologies are used, then the ease of operation is maintained, but the reliability of protecting computing resources deteriorates due to increasing ineffectiveness against modern malware
Solution Approach 1:
The system inverts the traditional anti-virus approach by implementing a whitelist system that allows only approved files to execute, rather than attempting to block all malicious files. This inversion fundamentally changes the protection model from reactive blocking to proactive permitting, significantly improving reliability while maintaining ease of operation through automated whitelist management and user-friendly approval interfaces.
Data Source
AI summary
Computer-implemented methods and systems for creating or updating approved-file and trusted-domain databases and verifying the legitimacy of files are disclosed. A method for creating or updating an approved-file database may include intercepting a first file, identifying a source domain associated with the first file, identifying a trusted-domain database, determining whether a database record for the source domain associated with the first file exists within the trusted-domain database, creating a hash value for the first file if a database record for the source domain associated with the first file exists within the trusted-domain database, and storing the hash value for the first file in an approved-file database. Methods and systems for verifying the legitimacy of a file and for creating or updating a trusted-domain database are also disclosed.