Design Chrome Malware Detection
Safe Browsing — URL reputation, download scanning, and real-time updates to billions of clients.
Interview tip Hash prefix matching (privacy), bloom filters on client, backend full hash verify, update propagation via component updates.
① Functional requirements
- Check URL before navigation
- Scan downloaded files
- Warn or block dangerous sites
- Push updated threat lists to browsers
- Report new threats from crawlers and users
- Privacy-preserving hash checks
② Non-functional requirements
- Check adds < 5ms client-side
- List updates every 30 min
- False positive rate extremely low
- Scale to 4B Chrome installs
③ Back-of-the-envelope scale
Assumptions
- 500M malicious URLs
- 4B clients poll updates
- Prefix bloom ~1MB client cache
④ High-level architecture
Safe Browsing
Chrome client bloom
Prefix hash API
Threat intel DB
Crawler + reports
⑤ Data flow & execution path
URL check
Hash URL prefix→Local bloom→Maybe → full hash API→Block or allow
No full URL leaked — prefix + hash
Download scan sandbox
⑥ API & interfaces
| Endpoint / flow | Purpose | Notes |
|---|---|---|
| GET /hash/{prefix} | Full hash lookup | privacy API |
| POST /reports | User report URL | rate limited |
⑦ Data model & storage
Domain-specific entities sharded by user_id or geographic key.
| Store | What | Why |
|---|---|---|
| Distributed store | Primary data | Sharded for scale |
| Kafka / Pub/Sub | Event log | Async pipelines |
| Object store | Media / blobs | GCS-style durability |
⑧ Deep dive — core components
Privacy-preserving lookup
Client sends 4-byte hash prefix; server returns full-hash matches only for that prefix bucket.
List distribution
Component updater pushes bloom filter deltas — same model as feature flags at scale.
⑨ Trade-offs & alternatives
| Decision | Option A | Option B | Pick when |
|---|---|---|---|
| Client filter | Bloom | Full list | Bloom tiny; rare false positive full check |
| Block vs warn | Hard block malware | Warn phishing | Policy per threat class |
⑩ 45-minute interview script
- 0–5 min: Requirements + Google-scale assumptions
- 5–12 min: Back-of-envelope QPS and storage
- 12–22 min: Architecture diagram
- 22–35 min: Deep dive on hot path
- 35–42 min: Failure modes and trade-offs
⑪ Likely follow-up questions
| Question | Short answer |
|---|---|
| How roll out globally? | Regional cells + gradual feature rollout |
⑫ Revision checklist
- Prefix hash privacy
- Bloom on client
- Update mechanism
- Sandbox downloads
- False positive handling