Virtual Machine Malicious File Detection via Server Selection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current antivirus systems face challenges in efficiently detecting malicious files in distributed networks, particularly under heavy workloads or system malfunctions, as they require significant computing resources and time to scan large volumes of data.

Innovation Solution

A method and system that utilize thin client software on virtual machines to calculate the scanning speed of multiple servers based on computing resource characteristics, selecting the most efficient server to perform antivirus scans, and distributing files for scanning across the network to optimize resource utilization.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If distributed systems are used to scan files for maliciousness, then the productivity of detecting malicious files is improved, but the device complexity increases

Engineering Contradiction:
Improvedetecting malicious filesVSAvoiddistributed system
Core Design Contradiction:
ProductivityVSDevice complexity

Solution Approach 1:

The patent divides the file scanning task into multiple segments distributed across multiple servers. Each server independently scans files and reports results, allowing parallel processing and improving overall detection productivity while managing complexity through modular architecture

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces a coordinator component that acts as an intermediary between clients and scanning servers. This mediator manages task distribution, result collection, and system coordination, improving productivity through centralized control while abstracting the complexity of distributed operations from end users

Inventive Principle:
Principle #24Intermediary (Mediator)

2Productivity

If more computing resources are allocated to scanning, then the productivity of detecting malicious files is improved, but the loss of time for scanning increases

Engineering Contradiction:
Improvescanning speedVSAvoidscanning time
Core Design Contradiction:
ProductivityVSLoss of time

Solution Approach 1:

The patent implements periodic scanning where files are scanned at scheduled intervals rather than continuously. This allows computing resources to be allocated in periodic bursts, improving scanning speed when resources are available while reducing overall scanning time through efficient resource utilization during scanning windows

Inventive Principle:
Principle #19Periodic action

Solution Approach 2:

The patent performs preliminary actions by pre-processing files, pre-loading scanning signatures, and preparing scanning contexts before actual malicious file detection begins. This preliminary preparation reduces the time required for actual scanning operations and improves productivity by having resources ready in advance

Inventive Principle:
Principle #10Preliminary action

3Measurement precision

If signature-based detection is used, then the measurement precision of detecting known malicious files is improved, but the difficulty of detecting and measuring new malicious files increases

Engineering Contradiction:
Improvedetection accuracyVSAvoiddetecting new malicious files
Core Design Contradiction:
Measurement precisionVSDifficulty of detecting and measuring

Solution Approach 1:

The patent merges multiple detection methods including signature-based detection, heuristic analysis, and behavior monitoring into a unified system. This combination maintains high measurement precision for known malicious files through signature matching while adding capability to detect new malicious files through heuristic and behavioral analysis

Inventive Principle:
Principle #5Merging (Combining)

Solution Approach 2:

The patent applies partial signature-based detection for known threats while using excessive heuristic analysis and behavioral monitoring for unknown threats. This selective approach maintains high detection accuracy for known files while investing additional analytical resources in detecting new malicious files that lack signatures

Inventive Principle:
Principle #16Partial or excessive action

Data Source

PatentEP3252647B1System and method of detecting malicious files on a virtual machine in a distributed network
Publication Date: 2019.07.17 AO KASPERSKY LAB
  • EP3252647B1 patent drawingFigure 1
  • EP3252647B1 patent drawingFigure 2
  • EP3252647B1 patent drawingFigure 3

AI summary

A method and system is provided for detecting malicious files on a virtual machine in a distributed network. An example method includes, receiving, by a thin client operating on the virtual machine, data relating to characteristics of computing resources of servers in the distributed network with each server being able to scan files to detect malicious files. The method for includes obtaining a on the virtual machine, identifying and selecting, using the data relating to characteristics of the computing resources, one of the servers to perform the scan of the file on the virtual machine, and transmitting to the selected server the file for scanning.