Virtual Machine Malicious File Detection via Server Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus systems face challenges in efficiently detecting malicious files in distributed networks, particularly under heavy workloads or system malfunctions, as they require significant computing resources and time to scan large volumes of data.
Innovation Solution
A method and system that utilize thin client software on virtual machines to calculate the scanning speed of multiple servers based on computing resource characteristics, selecting the most efficient server to perform antivirus scans, and distributing files for scanning across the network to optimize resource utilization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If distributed systems are used to scan files for maliciousness, then the productivity of detecting malicious files is improved, but the device complexity increases
Solution Approach 1:
The patent divides the file scanning task into multiple segments distributed across multiple servers. Each server independently scans files and reports results, allowing parallel processing and improving overall detection productivity while managing complexity through modular architecture
Solution Approach 2:
The patent introduces a coordinator component that acts as an intermediary between clients and scanning servers. This mediator manages task distribution, result collection, and system coordination, improving productivity through centralized control while abstracting the complexity of distributed operations from end users
2Productivity
If more computing resources are allocated to scanning, then the productivity of detecting malicious files is improved, but the loss of time for scanning increases
Solution Approach 1:
The patent implements periodic scanning where files are scanned at scheduled intervals rather than continuously. This allows computing resources to be allocated in periodic bursts, improving scanning speed when resources are available while reducing overall scanning time through efficient resource utilization during scanning windows
Solution Approach 2:
The patent performs preliminary actions by pre-processing files, pre-loading scanning signatures, and preparing scanning contexts before actual malicious file detection begins. This preliminary preparation reduces the time required for actual scanning operations and improves productivity by having resources ready in advance
3Measurement precision
If signature-based detection is used, then the measurement precision of detecting known malicious files is improved, but the difficulty of detecting and measuring new malicious files increases
Solution Approach 1:
The patent merges multiple detection methods including signature-based detection, heuristic analysis, and behavior monitoring into a unified system. This combination maintains high measurement precision for known malicious files through signature matching while adding capability to detect new malicious files through heuristic and behavioral analysis
Solution Approach 2:
The patent applies partial signature-based detection for known threats while using excessive heuristic analysis and behavioral monitoring for unknown threats. This selective approach maintains high detection accuracy for known files while investing additional analytical resources in detecting new malicious files that lack signatures
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and system is provided for detecting malicious files on a virtual machine in a distributed network. An example method includes, receiving, by a thin client operating on the virtual machine, data relating to characteristics of computing resources of servers in the distributed network with each server being able to scan files to detect malicious files. The method for includes obtaining a on the virtual machine, identifying and selecting, using the data relating to characteristics of the computing resources, one of the servers to perform the scan of the file on the virtual machine, and transmitting to the selected server the file for scanning.