Two Stage Virus Detection Using Segmented Pattern Files

Solution Overview

Problem

Traditional virus detection methods using simple pattern matching algorithms face inefficiencies due to increased CPU time, memory consumption, and network resource usage as the number of virus patterns grows, leading to slow scanning speeds and high network traffic during updates.

Innovation Solution

The virus scanning procedure is divided into multiple levels, employing machine learning approaches like Novelty Detection and Classification models to reduce pattern matching iterations, with traditional virus pattern files segmented into smaller files for efficient detection.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the number of virus patterns is increased to detect more viruses, then virus detection coverage is improved, but CPU time and memory consumption increase

Engineering Contradiction:

Improvevirus detection coverageVSAvoidCPU time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The virus pattern file is divided into multiple segments, each containing virus patterns from specific virus families or groups. The system loads only the relevant segments into memory during scanning, reducing memory consumption and enabling faster processing by avoiding the need to search through the entire virus pattern file.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary classification of virus patterns into groups and pre-organizes them in segmented files. Before actual virus scanning, the system prepares the virus patterns in advance by grouping them, so that during scanning only the necessary segments need to be processed, reducing CPU time requirements.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If the number of virus patterns is increased to detect more viruses, then virus detection coverage is improved, but memory consumption increases

Engineering Contradiction:

Improvevirus detection coverageVSAvoidmemory consumption

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The virus pattern file is divided into multiple segments, each containing virus patterns from specific virus families or groups. The system loads only the relevant segments into memory during scanning, reducing memory consumption and enabling faster processing by avoiding the need to search through the entire virus pattern file.

Inventive Principle:

Principle #1Segmentation

3Device complexity

If traditional pattern matching algorithms are used, then simplicity is maintained, but scanning speed decreases as virus patterns increase

Engineering Contradiction:

Improvealgorithm simplicityVSAvoidscanning speed

Core Design Contradiction:

Device complexityVSProductivity

Solution Approach 1:

The virus pattern file is divided into multiple segments, each containing virus patterns from specific virus families or groups. The system loads only the relevant segments into memory during scanning, reducing memory consumption and enabling faster processing by avoiding the need to search through the entire virus pattern file.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary classification of virus patterns into groups and pre-organizes them in segmented files. Before actual virus scanning, the system prepares the virus patterns in advance by grouping them, so that during scanning only the necessary segments need to be processed, reducing CPU time requirements.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS8935788B1Two stage virus detection

Publication Date: 2015.01.13 TREND MICRO INC

AI summary

A two stage virus detection system detects viruses in target files. In the first stage, a training application receives a master virus pattern file recording all known virus patterns and generates a features list containing fundamental virus signatures from the virus patterns, a novelty detection model, a classification model, and a set of segmented virus pattern files. In the second stage, a detection application scans a target file for viruses using the generated outputs from the first stage rather than using the master virus pattern file directly to do traditional pattern matching. The results of the scan can vary in detail depending on a fuzzy scan level. For fuzzy scan level “1,” the existence of a virus is returned. For fuzzy scan level “2,” the grant virus type found is returned. For fuzzy scan level “3,” the exact virus name is returned. This invention provides a solution for the problems caused by traditional virus detection solution: slow scanning speed, big pattern file, big burden on computation resource (CPU, RAM etc.), as well as heavy pattern updating traffic via networks.