# Design a malware detection system: system design interview question

> Malware checks at scale: hostile files, slow sandbox execution, and verdicts that change as new threats appear.

Source: https://sysround.com/questions/design-malware-detection-system
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a malware detection service for uploaded files. Users submit files and receive a verdict."

## What to clarify first

- Users and required checks
- Volume and read:write mix
- File sizes and formats
- Work per file
- Latency
- Verdict meaning
- Availability, consistency, and durability
- Retention
- Security boundary
- Scope limits

## Scope of a strong answer

Core requirements:

- Accept file uploads and provide scan status
- Check files with signatures and a supplied machine learning model
- Execute selected files in a sandbox
- Return a verdict while protecting the service and other tenants

Usually out of scope:

- Develop signature feeds or machine learning models
- Build endpoint antivirus software
- Distribute files to end users
- Give sandbox code unrestricted internet access

## What interviewers probe

### What a verdict means

Each detector gives incomplete evidence. A quiet sandbox or a failed check does not prove that a file is safe.

### Hostile files

The service deliberately parses and executes attacker-controlled content. One successful exploit can threaten other files, credentials, and the control plane.

### Demand surges

Sandbox work costs much more than static checks. Small changes in file mix can exhaust capacity before submission volume changes.

### Repeated submissions and new threats

Identical bytes can need different verdicts after a threat update. Retries and shared results can also expose tenant data or overwrite newer evidence.

## Common mistakes

- Executes hostile files before establishing an isolation boundary
- Treats signature misses or quiet sandbox runs as proof of safety
- Calculates capacity from submission count but ignores sandbox duration
- Stores one permanent verdict per file hash
- Lets failed checks produce a no-threat-found verdict
- Acknowledges submissions before the service durably records the file and work

## The bar by level

- **Senior:** Calculates static and sandbox capacity. Defines verdict policy, resource limits, tenant isolation, and overload behavior. Handles duplicate jobs, durable acceptance, and versioned results.
- **Staff+:** Defines the threat model and limits the impact of host compromise. Connects detector thresholds to capacity and residual risk. Explains result validity after threat updates and protects tenant privacy. States guarantees during overload and partial failure. If the interviewer adds country restrictions, defines where files, replicas, and execution can reside.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=malware-detection


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.