Method for protecting data during a malware attack on a computing system

Abstract

A method for protecting data during a malware attack on a computing system. The method includes monitoring input and output (IO) operations on a storage medium in the computing system to identify potential malware attacks. The method also includes: when the IO operation is identified as a potential malware attack, activating a malware mode and moving the IO operation to a designated block area separate from other blocks in the storage medium. The method also includes restoring a flash translation layer (FTL) pointer for data affected by the identified IO operation and removing the FTL pointer for the IO operation that was moved to the designated block area. The method is used to more efficiently and effectively reduce the risk of ransomware by reversing the encryption of files.

Description

Technical Field

[0001] The present disclosure relates generally to the field of data security and, more particularly, to methods for protecting data during malware attacks on computing systems. Background Art

[0002] Ransomware is a prominent cyber threat to both individuals and organizations when it comes to data security. Ransomware is a type of malware that installs itself into a computing system and then maps files that appear to be important to the user. After that, the ransomware creates an encrypted copy of the target file and deletes the original file. Finally, the ransomware sends a ransom note that appears in the file in the same location or pops up on the user's screen. In addition, the ransom note also includes an explanation of the process of paying the ransom to access the original data. After paying the ransom, the user receives a key that enables the user to restore the original data. Therefore, such a ransomware attack results in significant financial losses in the form of ransom, downtime, and the effort required to restore the original data.

[0003] Currently, some attempts have been made to reduce the risk of ransomware, such as reducing the input and output rate or stopping the input and output during any suspicious activity. However, such attempts cannot completely reduce the risk of ransomware. In addition, the input and output rate of data becomes very slow, which is undesirable. In addition, attempts have been made to reduce the risk of ransomware by installing software on the user's device and / or by adding honeypot files to mark any process that attempts to encrypt files. However, such attempts are inefficient and cannot completely reduce the risk of ransomware. In addition, due to the complex operations required to restore the original data, these attempts take up a lot of time and resources, and still cannot completely restore the data. Therefore, there is a technical problem of how to reduce the risk of ransomware more efficiently and effectively.

[0004] Therefore, in light of the foregoing discussion, a need exists to overcome the above-described shortcomings associated with conventional methods of protecting data during malware attacks on computing systems. Summary of the invention

[0005] The present disclosure provides a system and method for protecting data during malware attacks in a computing system. The present disclosure provides a solution to the existing problem of how to reduce the risk of ransomware. The purpose of the present disclosure is to provide a solution that at least partially overcomes the problems encountered in the prior art and provides an improved computing system and an improved method for protecting data during malware attacks in a computing system, such as by utilizing a flash translation layer at write time to protect against ransomware.

[0006] One or more objects of the present disclosure are achieved by the solutions provided in the attached independent claims. Advantageous implementations of the present disclosure are further defined in the dependent claims.

[0007] In one aspect, the present disclosure provides a method for protecting data during a malware attack in a computing system. The method includes: monitoring input-output (IO) operations on a storage medium in the computing system to identify potential malware attacks; when the IO operations are identified as potential malware attacks, activating a malware mode and moving the IO operations to a designated block area separate from other blocks in the storage medium. The method also includes restoring a flash translation layer (FTL) pointer of data affected by the identified IO operations, and removing the FTL pointer of the IO operations that were moved to the designated block area.

[0008] The method is used to identify potential malware attacks, issue alerts, and protect data during malware attacks in a computing system, such as by activating a malware mode. In addition, the short duration activation of the malware mode prevents the computing system from slowing down, thereby improving the overall efficiency of the system.

[0009] In an implementation, the method further includes: suspending garbage collection for block reclamation when running in malware mode.

[0010] In this implementation, pausing garbage collection running in malware mode enables recovery of the original data.

[0011] In another implementation, the method further includes: saving a previous FTL pointer to data affected by the identified IO operation.

[0012] In such an implementation, the previous FTL pointer that stores the data affected by the identified IO operation is used to restore the previous data stored in the storage medium (ie, SSD) before encryption.

[0013] In another implementation, the method further includes: marking blocks written by IO operations in a designated block area to perform garbage collection for block recycling.

[0014] In such an implementation, garbage collection for block reclamation is used to reuse blocks for IO operations.

[0015] In another implementation, the method further includes: allocating a new designated block area in the storage medium while reclaiming the previous block.

[0016] In such an implementation, the allocation of new designated block areas in the storage medium is used for block reclamation so that these blocks can be reused by users again to store data.

[0017] In another implementation, IO operations are identified as potential malware attacks by monitoring write bandwidth and / or entropy of the storage medium.

[0018] In such an implementation, high bandwidth and high entropy raise alarms, including identification of potential malware attacks.

[0019] In another implementation, the method further includes notifying a user of a potential malware attack and returning to a normal mode when the identified IO operation is determined to be an operation initiated by the user.

[0020] In such an implementation, notifying the user about a potential malware attack provides the user with an opportunity to review the IO operation and further determine whether the IO operation is a potential malware attack or was initiated by the user.

[0021] In another aspect, a computing system includes a storage medium, an input output (I / O) interface, and a processor for monitoring input-output (IO) operations on a storage medium in the computing system to identify potential malware attacks. The processor is further configured to: activate a malware mode when an IO operation is identified as a potential malware attack, and move the IO operation to a designated block area separate from other blocks in the storage medium. In addition, the processor is configured to restore a flash translation layer (FTL) pointer of data affected by the identified IO operation, and remove the FTL pointer of the IO operation that was moved to the designated block area.

[0022] The computing system realizes all advantages and technical effects of the method described in the present disclosure.

[0023] It should be understood that all the above implementations can be combined. It must be noted that all devices, elements, circuits, units and devices described in this application can be implemented in software or hardware elements or any type of combination thereof. All steps performed by various entities described in this application and the described functions to be performed by various entities are intended to indicate that each entity is suitable for or used to perform corresponding steps and functions. Although in the description of the following specific embodiments, the specific functions or steps to be performed by external entities are not reflected in the description of the specific detailed elements of the entity performing the specific steps or functions, it should be clear to the technician that these methods and functions can be implemented by corresponding software or hardware elements or any type of combination thereof. It should be understood that the features of the present disclosure are easy to be combined in various combinations without departing from the scope of the present disclosure defined by the appended claims.

[0024] Other aspects, advantages, features and objects of the present disclosure will become apparent from the accompanying drawings and the following detailed description of illustrative implementations interpreted in conjunction with the appended claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] When read in conjunction with the accompanying drawings, the above summary of the invention and the detailed description of the following illustrative embodiments will be better understood. For the purpose of illustrating the present disclosure, an exemplary structure of the present disclosure is shown in the accompanying drawings. However, the present disclosure is not limited to the specific methods and means disclosed herein. In addition, it will be appreciated by those skilled in the art that the accompanying drawings are not drawn to scale. Where possible, identical elements are represented by identical numerals.

[0026] Embodiments of the present disclosure will now be described, by way of example only, with reference to the following drawings, in which:

[0027] Figure 1 is a flowchart of a method for protecting data during a malware attack on a computing system according to an embodiment of the present disclosure;

[0028] Figure 2 is a block diagram of a computing system according to an embodiment of the present disclosure;

[0029] Figure 3 is an exemplary diagram depicting a mapping operation in a storage medium utilizing a flash translation layer according to an embodiment of the present disclosure;

[0030] Figure 4 is an exemplary diagram depicting a mapping operation between a user document and a storage medium according to an embodiment of the present disclosure; and

[0031] Figure 5 is an exemplary diagram depicting different operations for recovering data according to an embodiment of the present disclosure.

[0032] In the drawings, underlined numbers are used to indicate the item in which the underlined number is located or an item adjacent to the underlined number. Non-underlined numbers are associated with items identified by the line connecting the non-underlined number to the items. When a number is not underlined and has an associated arrow, the non-underlined number is used to identify the general item to which the arrow points. DETAILED DESCRIPTION

[0033] The following detailed description describes embodiments of the present disclosure and ways in which these embodiments may be implemented. Although some modes of implementing the present disclosure have been disclosed, those skilled in the art will recognize that there may be other embodiments for implementing or practicing the present disclosure.

[0034] Figure 1 is a flow chart of a method for protecting data during a malware attack in a computing system according to an embodiment of the present disclosure. Figure 1 , a flow chart of a method 100 including steps 102 to 110 is shown.

[0035] Method 100 is used to protect data during a malware attack on a computing system. Malware corresponds to computer executable code designed to destroy data or prevent a user from accessing data, such as ransomware. Ransomware installs itself in a computing system and attempts to mirror files important to the user. In addition, method 100 utilizes a flash translation layer (FTL) to protect data during a malware attack and enables data recovery with minimal impact on normal input and output operations.

[0036] At step 102, method 100 includes monitoring input-output (IO) operations on a storage medium in a computing system to identify potential malware attacks. In an example, the storage medium may correspond to a solid-state drive (SSD). In addition, monitoring IO operations on the storage medium may help to issue an alert about a potential malware attack and further reduce the risk of a malware attack. In an implementation, the IO operation includes creating an encrypted copy of sensitive data in a storage medium. By monitoring the encrypted copy of sensitive data in the storage medium, method 100 can be used to identify potential malware attacks on sensitive data and notify a user of such encryption. In such an implementation, the IO operation is identified as a potential malware attack by monitoring the write bandwidth and / or entropy of the storage medium. In an example, a malware attack requires a high write bandwidth to encrypt a mapped file including sensitive data in a short duration. In such a case, the IO operation is identified as a potential malware attack by monitoring the write bandwidth (e.g., multiple write operations) of the storage medium. In another example, a malware attack requires high entropy to encrypt a mapped file including sensitive data in a short duration. In such a case, by monitoring the entropy of the storage medium (e.g., the number of bits required to transfer data), the IO operation is identified as a potential malware attack. In yet another example, a malware attack requires high bandwidth and high entropy to encrypt a mapped file including sensitive data in a short duration. In such a case, by monitoring the write bandwidth and entropy of the storage medium, the IO operation is identified as a potential malware attack. Therefore, high write bandwidth and / or high entropy can be used to issue an alert including the identification of a potential malware attack.

[0037] At step 104, the method 100 further includes: activating the malware mode when the IO operation is identified as a potential malware attack. In other words, the activation of the malware mode depends on the IO operation, such as a read operation or a write operation on the storage medium that is identified as a potential malware attack. In an implementation, the method 100 further includes: suspending garbage collection for block recycling when running in the malware mode. Typically, a garbage collector is used for garbage collection to manage physical locations covered by IO operations. Such garbage collection operations provide safe and balanced reuse of blocks at different physical locations.

[0038] In addition, at step 106, method 100 includes moving the IO operation to a designated block area separated from other blocks in the storage medium. In an example, a portion of the storage medium is allocated to an IO operation (e.g., data write) identified as a potential malware attack. Afterwards, the IO operation is moved to the designated block area, such as processing the IO operation identified as a potential malware attack separately. In an implementation, when the designated block area in the storage medium is full, the identified IO operation is terminated. In such an implementation, the identified IO operation is terminated to prevent overflow of the IO operation from being moved in the designated block area. In such an implementation, method 100 also includes: marking the block written by the IO operation in the designated block area for garbage collection for block recovery. In an example, a protocol command (e.g., an UNMAP command) is used for block recovery in a storage medium (e.g., an SSD). The designated block area for garbage collection for block recovery is used to maintain balance while using physical locations to reuse blocks marked as obsolete and cannot be used for IO operations. Therefore, garbage collection for block recovery can reuse these blocks for IO operations.

[0039] In an implementation, method 100 also includes: allocating a new designated block area in the storage medium while reclaiming the previous block. In other words, the previous block is reclaimed, and the IO operation identified as a potential malware attack is now allocated to a new designated block area in the storage medium to separate such IO operations from other blocks. In an implementation, method 100 also includes: notifying the user of the potential malware attack and returning to normal mode when the identified IO operation is determined to be an operation initiated by the user. In other words, notifying the potential malware attack gives the user an opportunity to view the identified IO operation. However, if the identified IO operation is determined to be an operation initiated by the user, the computing system returns to normal mode.

[0040] At step 108, the method further includes restoring a flash translation layer (FTL) pointer of data affected by the identified IO operation. The FTL pointer corresponds to a layer in a flash controller that is implemented to increase the life of a computing system, such as by reducing wear leveling, facilitating error correction, and removing physical locations prone to errors. In addition, the FTL pointer converts the logical location of data described by a storage protocol, such as a logical block addressing further identified by the application layer and a physical address in a storage medium. In an example, a protocol command is used to restore an FTL pointer, such as a previous pointer in the FTL pointer, to restore data affected by the identified IO operation. In an implementation, method 100 further includes: saving a previous FTL pointer of data affected by the identified IO operation. In other words, a malware attack encrypts a file as a new file and further deletes the original file. In addition, physical data on a storage medium (e.g., an SSD) is not overwritten. However, the physical data is written to a different location and the mapping in the FTL pointer is changed. Therefore, by saving the previous FTL pointer of the data affected by the identified IO operation, method 100 can be used to recover the previous data (e.g., data before encryption) from the storage medium (i.e., SSD). Thereafter, at step 110, method 100 also includes removing the FTL pointer of the IO operation moved to the specified block area. In other words, the FTL pointer of the IO operation moved to the specified block area is removed to prevent the mapping of the encrypted file. In addition, the previous FTL pointer of the IO operation is also saved to map the original file. Therefore, the computing system is enabled to recover the original file during a malware attack.

[0041] Method 100 is used to identify potential malware attacks, issue alerts, and protect data during malware attacks in a computing system, such as by activating malware mode. In addition, the short duration activation of malware mode prevents the computing system from slowing down, thereby improving the overall efficiency of the system.

[0042] Steps 102 to 110 are merely illustrative, and other alternatives may also be provided, wherein one or more steps are added, one or more steps are removed, or one or more steps are provided in a different order, without departing from the scope of the claims herein.

[0043] A computer-readable medium including instructions is provided, which, when executed by a computer, causes the computer to perform method 100. In an example, the instructions are implemented on a computer-readable medium, which includes, but is not limited to, an Electrically Erasable Programmable Read-Only Memory (EEPROM), a Random Access Memory (RAM), a Read Only Memory (ROM), a Hard Disk Drive (HDD), a flash memory, a Secure Digital (SD) card, a Solid-State Drive (SSD), a computer-readable storage medium, and / or a CPU cache memory. In an example, the instructions are generated by a computer program, which is implemented according to method 100 and is used to implement method 100 on a computer.

[0044] Figure 2 is a block diagram of a computing system according to an embodiment of the present disclosure. Figure 2 , a block diagram 200 of a computing system 202 is shown. The computing system 202 includes a storage medium 204, an input-output (I / O) interface 206, and a processor 208.

[0045] The computing system 202 may include suitable logic, circuitry, interfaces and / or code for protecting data from potential malware attacks. Examples of implementations of the computing system 202 may include, but are not limited to, a computer, a personal digital assistant, a portable computing device, or an electronic device.

[0046] The storage medium 204 is used to store data. In an implementation, the storage medium 204 is a solid-state drive (SSD) for providing high-speed data transmission. Examples of implementations of the storage medium 204 may include, but are not limited to, an electrically erasable programmable read-only memory (EEPROM), a dynamic random access memory (DRAM), a random access memory (RAM), a read-only memory (ROM), a hard disk drive (HDD), a flash memory, a secure digital (SD) card, and / or a CPU cache memory.

[0047] The I / O interface 206 may include hardware or software for establishing communication between the storage medium 204 and the processor 208 of the computing system 202. Examples of implementations of the I / O interface 206 may include, but are not limited to, a computer port, a network socket, a network interface controller (NIC), and any other I / O interface device, such as a keyboard, a mouse, a display, and the like.

[0048] The processor 208 is used to monitor IO operations and further activate the malware mode when the IO operations are identified as potential malware attacks. Examples of implementations of the processor 208 may include, but are not limited to, central data processing devices, microprocessors, microcontrollers, complex instruction set computing (CISC) processors, application-specific integrated circuits (ASIC) processors, reduced instruction set (RISC) processors, very long instruction word (VLIW) processors, state machines, and other processors or control circuits.

[0049] In operation, the processor 208 is used to monitor IO operations of the storage medium 204 in the computing system 202 to identify potential malware attacks. In an example, the storage medium 204 may correspond to a solid-state drive (SSD). In addition, monitoring the IO operations on the storage medium 204 helps to issue an alert about a potential malware attack and further reduce the risk of a malware attack. In addition, the processor 208 is used to: activate the malware mode when the IO operation is identified as a potential malware attack. In other words, the activation of the malware mode depends on the IO operation, such as a read operation or a write operation on the storage medium 204 that is identified as a potential malware attack.

[0050] The processor 208 is also used to move the IO operation to a designated block area that is separate from other blocks in the storage medium 204. In an example, a portion of the storage medium is allocated to IO operations (e.g., data writes) that are identified as potential malware attacks. Thereafter, the IO operation is moved to the designated block area, for example, the IO operation identified as a potential malware attack is processed separately.

[0051] The processor 208 is also used to restore the flash translation layer (FTL) pointer of the data affected by the identified IO operation. In the example, the protocol command is used to restore the FTL pointer, such as the previous pointer in the FTL pointer, to restore the data affected by the identified IO operation. Afterwards, the processor 208 is used to remove the FTL pointer of the IO operation and move the IO operation to the specified block area. In other words, the FTL pointer of the IO operation moved to the specified block area is removed to prevent the mapping of the encrypted file, and the original file is restored, such as by mapping the original file through the previously saved FTL pointer. Therefore, the computing system is enabled to restore the original file during a malware attack.

[0052] Figure 3 is an exemplary diagram depicting a mapping operation in a storage medium using a flash translation layer according to an embodiment of the present disclosure. Figure 3 , shows an exemplary representation of physical blocks of storage medium 204, and mapping of different storage addresses (e.g., X / Y), where X is a storage LU (logical unit) and Y is a storage LBA (logical block addressing). In operation 300A, a solid-state drive (SSD) physical block 302 (e.g., Figure 2 The initial condition of the storage medium 204 of FIG. 300B represents an application mapping of an X / Y storage address on a flash translation layer (FTL) to an SSD physical block 302, which includes data, such as "AAAAA". Thereafter, in operation 300B, the data is replaced with new data, such as "BBBBB" in the SSD physical block 302. The SSD physical block 302 including "AAAAA" is not overwritten. In addition, the mapping of the SSD physical block 302 is changed, but the previous SSD physical block including the data AAAAA is replaced by the computing system (i.e., Figure 2 Therefore, the computing system (i.e., computing system 202) maps SSD physical block 302 and further retains the previous SSD physical block so that computing system 202 can recover previous data during the identification of a potential malware attack, such as by mapping and restoring a flash translation layer (FTL) pointer.

[0053] Figure 4 is an exemplary diagram depicting a mapping operation between a user document and a storage medium according to an embodiment of the present disclosure. Figure 4, shows an exemplary representation of an exemplary diagram 400 depicting a mapping operation between a user document 404 and a storage medium 402. In an implementation, the file system includes a mapping between the user document 404 and physical blocks including data stored in the storage medium 402. In the example, the user document 404 includes physical blocks, such as 1 / 100, 1 / 5109, and 1 / 25004. In addition, the first two physical blocks 1 / 100 and 1 / 5109 are encrypted. In addition, the computing system (i.e., computing system 202) restores previous data (i.e., data before encryption). In the example, a solid-state drive (SSD) application programming interface (API) is used to restore the previous location of the data, so that the user document 404 can be restored to an unencrypted state. Therefore, the computing system (i.e., Figure 2 The computing system 202 is used to protect data from potential malware attacks by recovering the data.

[0054] Figure 5 is an exemplary diagram depicting different operations for recovering data according to an embodiment of the present disclosure. Figure 5 , an exemplary diagram 500 depicting different operations for recovering original data (i.e., data before malware attack) is shown. Initially, at operation 502A, all physical blocks of a storage medium (e.g., SSD blocks) are mapped outside a designated block area (i.e., suspicious block area), including pointers, such as FTL pointers in a flash translation layer (FTL). In addition, during IO operations, such as at operation 502B, IO operations identified as potential malware attacks that cause the storage medium (i.e., Figure 2 The storage medium 204 of the present invention reroutes new writes to the designated block area. For example, at operation 502C, the encrypted data is not written to the location where the original data is stored. However, the encrypted data is stored in the new storage address. In addition, malware attacks can delete files, which causes the file system to allow the storage medium (such as an SSD) to perform block recycling. In addition, in operation 502D, a potential malware attack is detected, and the user instructs the storage medium to be restored to a previous unencrypted state. Therefore, the FTL is traversed, and the previous FTL pointer is restored, such as removing the FTL pointers of addresses 1 / 100 and 1 / 5109 to the designated block area, and marking the encrypted block for garbage control. In addition, in operation 502E, a new designated block is allocated, such as a suspect block area (SBA), and the physical block can be reused again after the previous block is recycled.

[0055] Without departing from the scope of the present disclosure as defined by the appended claims, the embodiments of the present disclosure described above may be modified. Expressions such as "including / comprising", "incorporating", "having", "is / is" used to describe and claim the present disclosure are intended to be interpreted in a non-exclusive manner, i.e., allow for the presence of items, components or elements that are not explicitly described. References to the singular should also be interpreted as involving the plural. The word "exemplary" used herein means "as an example, instance or illustration". Any embodiment described as "exemplary" is not necessarily interpreted as being more preferred or more advantageous than other embodiments, or does not necessarily exclude the incorporation of features of other embodiments. The word "optionally" used herein means "provided in some embodiments and not provided in other embodiments". It should be understood that certain features of the present disclosure described in the context of different embodiments for the sake of clarity may also be provided in a single embodiment by combination. On the contrary, various features of the present disclosure described in the context of a single embodiment for the sake of clarity may also be provided individually or by any appropriate combination or as any other described embodiment of the present disclosure.

Claims

1. A method (100) for protecting data during a malware attack in a computing system (202), characterized in that: The method (100) comprises: monitoring input-output (IO) operations on a storage medium in the computing system (202) to identify potential malware attacks; Activate malware mode when an IO operation is identified as a potential malware attack; moving the IO operation to a designated block area separate from other blocks in the storage medium (204, 402); restoring a flash translation layer (FTL) pointer to data affected by the identified IO operation; and The FTL pointer of the IO operation moved to the designated block area is removed.

2. The method (100) according to claim 1, characterized in that: Also includes: When running in the malware mode, garbage collection for block reclamation is suspended.

3. The method (100) according to claim 1 or 2, characterized in that: When the designated block area in the storage medium (204, 402) is full, the identified IO operation is terminated.

4. The method (100) according to any one of the preceding claims, characterized in that Also includes: A previous FTL pointer to data affected by the identified IO operation is saved.

5. The method (100) according to any one of the preceding claims, characterized in that Also includes: The blocks written by the IO operation are marked in the designated block area to perform garbage collection for block recycling.

6. The method (100) according to claim 5, characterized in that: Also includes: New designated block areas are allocated in the storage medium (204, 402) while the previous blocks are being reclaimed.

7. The method (100) according to any one of the preceding claims, characterized in that By monitoring the write bandwidth and / or entropy of the storage medium (204, 402), IO operations are identified as potential malware attacks.

8. The method (100) according to any one of the preceding claims, characterized in that The IO operation includes creating an encrypted copy of the sensitive data in the storage medium (204, 402).

9. The method (100) according to claim 1, characterized in that: Also includes: A user is notified of the potential malware attack, and a normal mode is returned when the identified IO operation is determined to be an operation initiated by the user.

10. A computing system (202), characterized in that: include: Storage medium (204, 402); I / O interface (206); as well as A processor (208) configured to: monitoring input-output (IO) operations on the storage medium (204, 402) in the computing system (202) to identify potential malware attacks; Activate malware mode when an IO operation is identified as a potential malware attack; moving the IO operation to a designated block area separate from other blocks in the storage medium (204, 402); Recovering a flash translation layer (FTL) pointer to data affected by the identified IO operation; as well as The FTL pointer of the IO operation moved to the designated block area is removed.

11. The computing system (202) of claim 10, wherein: The storage medium (204, 402) is a solid state drive (SSD).

12. A computer-readable medium, characterized in that The computer-readable medium comprises instructions which, when executed by a computer, cause the computer to perform the steps of the method (100) according to any one of claims 1 to 9.

Images