Virus Scanning During Application Package Decompression

Solution Overview

Problem

Current virus scanning methods for application installation packages require complete decompression of large executable files, leading to high memory usage and time-consuming decompilation, resulting in low efficiency in identifying rogue software or viruses.

Innovation Solution

Performing a virus scan on decompressed sub-portions of the application installation package in parallel with decompression, checking each sub-portion against a virus feature library, and stopping the decompression process if a virus is detected, thereby reducing memory usage and scanning time.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If the application installation package is completely decompressed to acquire a complete executable file for virus checking, then the virus scanning accuracy is improved, but the memory usage increases significantly and the scanning time increases

Engineering Contradiction:

Improvevirus scanning accuracyVSAvoidmemory usage

Core Design Contradiction:

Measurement precisionVSQuantity of substance

Solution Approach 1:

The patent divides the application installation package into multiple sub-portions during decompression. Each sub-portion is decompressed and scanned independently for virus signatures. This segmentation allows the system to scan only the necessary parts of the file without loading the entire executable into memory, thus reducing memory consumption while maintaining virus detection capability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary virus scanning on sub-portions during the decompression process itself, before the complete executable file is fully decompressed and loaded into memory. By integrating the virus scan with the decompression process and checking sub-portions as they are decompressed, the system identifies viruses early without requiring full file decompression, thereby reducing peak memory usage.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If the complete executable file is decompressed and decompiled for feature information extraction, then the virus detection completeness is improved, but the scanning time increases

Engineering Contradiction:

Improvevirus detection completenessVSAvoidscanning time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent performs preliminary virus scanning on sub-portions during the decompression process itself, before the complete executable file is fully decompressed and loaded into memory. By integrating the virus scan with the decompression process and checking sub-portions as they are decompressed, the system identifies viruses early without requiring full file decompression, thereby reducing peak memory usage.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent allows the decompression and scanning process to continue through subsequent sub-portions only if no virus is detected in earlier portions. If a virus signature is found in any sub-portion, the scanning process can be terminated immediately, skipping the need to process the remaining sub-portions. This rushing through approach significantly reduces scanning time when viruses are present.

Inventive Principle:

Principle #21Skipping (Rushing through)

3Measurement precision

If the application installation package is decompressed completely before virus scanning, then the scanning accuracy is improved, but the productivity of the system decreases

Engineering Contradiction:

Improvescanning accuracyVSAvoidsystem efficiency

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The patent divides the application installation package into multiple sub-portions during decompression. Each sub-portion is decompressed and scanned independently for virus signatures. This segmentation allows the system to scan only the necessary parts of the file without loading the entire executable into memory, thus reducing memory consumption while maintaining virus detection capability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent integrates the virus scanning operation with the decompression process, making them occur simultaneously rather than sequentially. As each sub-portion is decompressed, it is immediately scanned for viruses. This continuous parallel processing eliminates idle time and improves system productivity by keeping the processor actively engaged in useful work throughout the entire process.

Inventive Principle:

Principle #20Continuity of useful action

Data Source

PatentEP2875466B1Method and apparatus for performing virus scan during decompression of application installation package

Publication Date: 2020.06.03 TENCENT TECHNOLOGY (SHENZHEN) CO LTD

Figure 1
Figure 2A
Figure 2B

AI summary

Disclosed in the present invention are a method and apparatus for checking a process of decompressing an application installation package. The present invention belongs to the technical field of security. The method comprises: decompressing a sub-portion of data in an application installation package to acquire decompressed data, the sub-portion of data being not greater than a threshold size; checking the decompressed data according to the virus samples in a virus feature library; and determining that the application installation package is a virus-infected file or rogue software when the decompressed data includes any of the virus samples. The technical solution of the present invention can effectively save the internal memory, shorten the checking time, and improve the checking efficiency in determining whether an application installation package is a virus-infected file or rogue software.