Kaspersky Lab patents dynamic antivirus technology

Kaspersky Lab has patented a method of antivirus scanning that assesses files according to when and how they first appeared on the computer.

The method has been granted Patent No. 7 392 544 by the U.S. Patent and Trademark Office. Internally, it has been unofficially named ‘FirstTimeCheck’.

By dynamically varying the scanning level and set of tools used for file scanning, FirstTimeCheck is expected to minimise the impact of antivirus scanning on the overall system performance.

The technology also makes it possible to extend the time taken to scan new files and files received via ‘high-risk’ sources such as suspicious Web sites, P2P networks and e-mail attachments.

“In the past, antivirus products were scanning files with a standard set of technologies,” said Nikolay Grebennikov, Kaspersky Lab’s Vice-President for Research & Development.

“Now, the antivirus arsenal includes many new technologies, which significantly raise detection rate, but use more RAM and CPU time.”

“The standard solution for this situation is to limit the usage of these technologies to a level where antivirus scanning will not affect users’ activities too much," he told iTnews.

Grebennikov explained that the ‘standard solution’ to limit the resource usage of antivirus programs has been to set strict limits on the time taken to scan files.

He described such methods as a ‘compromise’ that may affect the quality of scanning and decrease the level of user protection.

“The main advantage of our method is that it minimises the impact on the overall system performance,” Grebennikov told iTnews.

“Normally such a deep system scan would greatly affect performance of the computer it is running on, but our new technology manages to bypass this negative effect to ensure maximum system performance all the time,” he said.

Kaspersky Lab is working on implementing FirstTimeCheck in current products and plans to implement the technology in the next version of its consumer products.