Virtual Machine Antivirus Queue Optimization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtual computing environments, simultaneous antivirus checking across multiple virtual machines can lead to performance issues due to overloading of the security virtual machine and redundant checks on identical files, especially during initial or update-related massive checks, where common databases are ineffective.
Innovation Solution
A system and method that involve forming a queue of identifiers for malware analysis on each virtual machine, determining a selection method based on the number of virtual machines performing analysis, and utilizing a security virtual machine to check for duplicate analyses, thereby optimizing the use of a common database and reducing redundant checks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If a common database is used to store antivirus check results, then resource usage is optimized, but during initial or update-related massive checks, the database is ineffective because identical files from multiple virtual machines are checked redundantly
Solution Approach 1:
Virtual machines perform preliminary actions by sending file identifiers and hashes to the security virtual machine before actual antivirus scanning. The security virtual machine pre-processes these identifiers, checks the common database, and determines which files require scanning. This preliminary filtering action prevents redundant scans of identical files while maintaining resource optimization through the common database approach.
2Reliability
If multiple virtual machines simultaneously send files for antivirus checking, then checking coverage is improved, but the security virtual machine becomes overloaded and performance decreases
Solution Approach 1:
The patent extracts the essential identifying features of files (identifiers and hash values) from the actual file content and sends only these extracted elements to the security virtual machine for preliminary processing. This extraction reduces the data volume significantly, allowing the security virtual machine to handle multiple virtual machines simultaneously without overload, while still maintaining comprehensive checking coverage through subsequent scanning of identified files.
3Reliability
If identical files from multiple virtual machines are checked simultaneously, then comprehensive coverage is achieved, but redundant checks increase overall processing time
Solution Approach 1:
The system implements feedback mechanisms where virtual machines send file identifiers and hash values to the security virtual machine, which then checks the common database for existing results. Based on this feedback, the security virtual machine determines whether files require scanning or can be skipped. This feedback loop prevents redundant checks of identical files across multiple virtual machines, reducing processing time while maintaining comprehensive coverage through the centralized database.
4Measurement precision
If all files from all virtual machines are scanned, then detection accuracy is improved, but the queue of requests overfills and virtual machines stand idle
Solution Approach 1:
Virtual machines perform preliminary actions by submitting file identifiers and hash values before actual scanning. The security virtual machine uses these preliminary submissions to check the common database and identify files that require scanning versus those that have been previously checked. This preliminary filtering maintains detection accuracy for files that need scanning while reducing idle time by preventing unnecessary queue buildup from redundant scan requests.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are a system and a method for malware detection on virtual machines. An example method comprises: forming, on a virtual machine, a queue of identifiers of objects for malware analysis; determining a method for selecting objects in the queue for malware analysis; selecting one or more objects from the queue for malware analysis; providing identifiers of the selected objects to a security virtual machine for malware analysis; checking, by the security virtual machine, whether each of the selected objects has been previously provided for malware analysis by another virtual machine; when a selected object has not been previously provided by another virtual machine, performing, by the security virtual machine, a malware analysis of the selected object; and providing, to the virtual machine, a malware analysis result for the selected object.