Whitelist Blacklist File Identification via Directory Structure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The rapid growth of malware poses a persistent challenge for computer systems, as existing technologies struggle to effectively identify and differentiate between good and malicious files, leading to ongoing updates in detection and removal lists.
Innovation Solution
A node initiates a scan of files on a data store, creating a directory structure that is sent to whitelist and blacklist servers, allowing for identification of known good and malicious files by comparing hashes and directory information, using whitelists and blacklists to determine file legitimacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If centralized whitelist and blacklist servers are used to store known good and malicious files, then the accuracy of malware identification is improved, but the network communication overhead and server dependency increase
Solution Approach 1:
The patent introduces centralized whitelist and blacklist servers as intermediary components that store and provide information about known good and malicious files. These servers act as mediators between the node and the vast amount of malware detection data, allowing the node to query for specific file information without needing to maintain comprehensive databases locally. This resolves the contradiction by improving identification accuracy through centralized knowledge storage while accepting increased architectural complexity as a trade-off for enhanced detection capability.
2Reliability
If the node scans all files on the data store and compares against updated whitelists and blacklists, then the completeness of malware detection is improved, but the scanning time and processing resources increase
Solution Approach 1:
The patent implements preliminary action by having the node send directory information to the whitelist and blacklist servers before actually scanning files. The servers provide pre-filtered information about which files are known to be good or malicious, allowing the node to prioritize scanning efforts and focus on potentially suspicious files rather than systematically checking every file. This approach improves detection completeness while reducing scanning time by performing preliminary classification work before the actual file scanning begins.
Solution Approach 2:
The system employs feedback mechanisms where the node receives updated whitelist and blacklist information from the servers, processes this feedback about known good and malicious files, and adjusts its scanning strategy accordingly. The node uses the feedback information to guide its file scanning process, focusing resources on files that require closer examination while quickly accepting or rejecting files based on the feedback. This feedback loop enables comprehensive detection while managing scanning time through intelligent resource allocation.
3Speed
If the node maintains local copies of whitelists and blacklists, then the speed of local file identification is improved, but the data synchronization and updates become more complex
Solution Approach 1:
The patent implements periodic action by having the node send its directory information to the whitelist and blacklist servers at regular intervals or when changes are detected. This periodic synchronization allows the node to maintain reasonably up-to-date local copies of the whitelists and blacklists without requiring constant real-time updates. The node can perform identification operations at high speed using locally cached data, while the synchronization complexity is managed through periodic rather than continuous updates. This resolves the contradiction by achieving fast local identification through caching while limiting synchronization complexity through time-based update mechanisms.
Data Source
AI summary
Aspects of the subject matter described herein relate to identifying good files and malware based on whitelists and blacklists. In aspects, a node starts a scan of files on a data store. In conjunction with starting the scan, the node creates a data structure that indicates the directories on the data store. The node sends the data structure to a whitelist server and a blacklist server and an indication of a last successful time of communication. The whitelist and blacklist servers respond to the node with information about any new files that have been added to the directories since the last successful communication. The node may subsequently use the information to identify known good files and malware.