Verdict Cache for Antivirus Scanning Optimization

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing antivirus scanning methods for virtual machines often result in unnecessary resource duplication due to simultaneous scanning of identical files, leading to inefficiencies in computing resources such as disk, memory, and processor usage.

Innovation Solution

A method and system that utilize a verdict cache to determine if a file has been scanned before, and if so, assign the previous verdict, or block scanning until the parallel thread completes if the file is being scanned, thereby preventing duplicate scans and optimizing resource usage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If antivirus scanning is performed in parallel threads for multiple files, then scanning speed and productivity are improved, but duplicate scanning of identical files causes excessive resource consumption

Engineering Contradiction:

Improvescanning speedVSAvoidresource consumption

Core Design Contradiction:

ProductivityVSLoss of energy

Solution Approach 1:

The system performs preliminary actions by checking the verdict cache before initiating a scan to determine if a file has been previously scanned and stored. This preliminary check prevents duplicate scanning of identical files, thereby reducing resource consumption while maintaining high scanning productivity through parallel processing of unique files.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system uses a verdict cache that stores results of previous file scans. Instead of re-scanning identical files, the system copies and reuses the stored verdicts from the cache, eliminating redundant scanning operations and reducing resource consumption while maintaining scanning speed for unique files.

Inventive Principle:

Principle #26Copying

2Power

If duplicate file scans are allowed to proceed in parallel threads, then resource utilization is maximized, but unnecessary waste of computing resources occurs

Engineering Contradiction:

Improveresource utilizationVSAvoidwaste of computing resources

Core Design Contradiction:

PowerVSLoss of substance

Solution Approach 1:

The system implements feedback by continuously monitoring the verdict cache for existing scan results before initiating new scans. This feedback mechanism allows the system to adjust its scanning behavior dynamically, preventing duplicate scans of identical files and eliminating waste of computing resources while maintaining efficient resource utilization for unique files.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The system discards redundant scanning operations by detecting duplicate files through the verdict cache and recovering resources that would otherwise be wasted on unnecessary scans. By identifying and eliminating duplicate scan operations, the system recovers computing resources for more productive uses while maintaining high overall resource utilization.

Inventive Principle:

Principle #34Discarding and recovering

3Loss of energy

If a verdict cache is implemented to store previous scan results, then resource consumption is reduced, but system complexity increases

Engineering Contradiction:

Improveresource consumptionVSAvoidsystem complexity

Core Design Contradiction:

Loss of energyVSDevice complexity

Solution Approach 1:

The system introduces a verdict cache as an intermediary component between the file scanning process and the results storage. This intermediary layer simplifies the overall system architecture by centralizing the storage and retrieval of scan results, making it easier to manage and query previous scan outcomes while reducing resource consumption through efficient result reuse.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Loss of substance

If scanning of files currently being scanned in parallel is blocked, then duplicate scans are prevented, but scanning completion time increases

Engineering Contradiction:

Improveduplicate scan preventionVSAvoidscanning completion time

Core Design Contradiction:

Loss of substanceVSLoss of time

Solution Approach 1:

The system performs preliminary actions by checking the verdict cache and tracking in-progress scans before initiating new scan operations. This preliminary verification prevents duplicate scans of files currently being scanned, eliminating wasted resources while minimizing delays by quickly detecting and preventing duplicates before they consume additional time.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS11281774B2System and method of optimizing antivirus scanning of files on virtual machines

Publication Date: 2022.03.22 AO KASPERSKY LAB

AI summary

Disclosed herein are systems and methods for optimizing antivirus scanning of files on virtual machines. In one aspect, an exemplary method comprises, determining whether there is a record about a file in a verdict cache, when there is, assigning the verdict found in the verdict cache to the file, and when no record is found in the verdict cache, determining whether the file is currently being scanned in a parallel thread, when the file is currently being scanned in a parallel thread, blocking the scanning of the file until the scanning in the parallel thread is completed, and placing a result of the scanning in the parallel thread in the verdict cache, and when the file is not currently being scanned in a parallel thread, performing the scanning of the file on a current thread, and placing a result of the scanning on the current thread in the verdict cache.