Virtualized Snapshot Malware Scanning With Metadata-Based Skips
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Scanning large quantities of files in virtual computing instance (VCI) snapshots for malware is resource- and time-intensive, as many files remain unchanged between snapshots, leading to inefficient use of computing resources.
Innovation Solution
A method that selectively scans files by comparing metadata across snapshots, skipping files with matching metadata and clean reputation indicators, using generated file system data structures to determine if files are clean without full malware scans.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all files in VCI snapshots are scanned for malware, then malware detection reliability is improved, but scanning time and computing resource usage increase
Solution Approach 1:
The patent applies preliminary action by comparing file metadata (such as hash values, timestamps, and file attributes) against previously scanned snapshots before performing full malware scans. This preliminary comparison identifies files that have not changed, allowing the system to skip redundant scanning of those files while maintaining comprehensive security coverage for modified files.
Solution Approach 2:
The patent implements partial action by selectively scanning only the subset of files that have changed between snapshots, rather than scanning all files. By identifying and scanning only the modified files (those with different metadata or hash values), the system achieves adequate malware detection coverage while significantly reducing scanning time and resource consumption.
2Reliability
If all files in VCI snapshots are scanned for malware, then malware detection completeness is improved, but computing resource usage increases
Solution Approach 1:
The system performs preliminary metadata comparison against previously scanned snapshots to identify unchanged files before initiating resource-intensive malware scanning. This preliminary step allows the system to maintain complete malware detection coverage for modified files while avoiding redundant processing of unchanged files, thereby reducing overall computing resource usage.
Solution Approach 2:
The patent applies partial action by limiting malware scanning to only those files that have changed between snapshots. By using metadata comparison to identify the subset of files requiring scanning, the system achieves adequate detection completeness while significantly reducing CPU, memory, and I/O resource consumption compared to scanning all files.
3Productivity
If metadata comparison is performed for all files, then scanning efficiency is improved, but system complexity increases
Solution Approach 1:
The patent implements preliminary metadata comparison as a lightweight pre-processing step before full malware scanning. By comparing file attributes such as hash values, timestamps, and sizes against previously scanned snapshots, the system efficiently identifies unchanged files to skip, thereby improving scanning efficiency without requiring complex analysis of file contents.
Data Source
AI summary
A VCI snapshot associated with a version of a malware infected VCI is scanned for malware. The malware scanning includes selecting a first file of the VCI snapshot and determining that a file, in a previously scanned VCI snapshot associated with another version of the malware infected VCI, which corresponds to the selected first file has a clean reputation indicator. Further, it is determined that the metadata of the selected first file matches metadata of the corresponding file. Based on these determinations, the malware scanning proceeds to scan the next file for malware without scanning the selected first file for malware.