Protection controller and method operating in a computer system

Abstract

A protection controller is provided for operation in a computer system that includes a process, an operating system, and at least one memory disk. The protection controller is further configured to receive a memory disk request for a file, determine that the memory disk request is a write request indicating a modification to the file, and in response, generate a backup copy of the file prior to the modification. Further, the protection controller is configured to determine that the process includes ransomware and, in response, recover the file based on the backup copy, thereby providing lossless ransomware protection for the computer system and improving overall data security.

Description

TECHNICAL FIELD

[0001] The present invention relates generally to the field of data security, and more specifically, to a protection controller and method for operating in a computer system comprising a process, an operating system and at least one memory disk. BACKGROUND

[0002] When referring to data security, malware (such as ransomware, crypto-mining programs, spyware, botnets, trojans, worms, etc.) is the most dominant cyber threat to individuals and organizations. Generally, malware refers to software designed to harm a computer system, for example, by corrupting data stored in the computer system or limiting user access to data stored in the computer system. As a result, such malware attacks can cause severe monetary loss, data loss or system failure.

[0003] Currently, certain attempts have been made to reduce the risk of malware attacks, for example, by using periodic backups, antivirus software, etc. However, such attempts fail for many reasons, for example, due to data accumulation and data loss occurring between certain time intervals during periodic backups of data or non-instantaneous malware detection. Due to these reasons, conventional malware detection techniques fail to effectively reduce the risk of malware attacks, which can cause significant monetary loss and severe data loss. Therefore, there is a technical problem of how to efficiently and accurately eliminate the adverse effects of malware to improve the overall data security of a computer system, thereby protecting the computer system from malware attacks.

[0004] Therefore, according to the above discussion, there is a need to overcome the above-mentioned drawbacks associated with conventional methods of protecting a computer system from malware attacks. SUMMARY

[0005] The present invention provides a protection controller and method for operating in a computer system comprising a process, an operating system and at least one memory disk. The present invention provides a solution to the existing problem of how to efficiently and accurately eliminate the adverse effects of malware to improve the overall data security of a computer system, thereby protecting the computer system from malware attacks. It is an object of the present invention to provide a solution that at least partially overcomes problems encountered in the prior art and, for example, by providing lossless resource-optimized ransomware protection, to provide an improved protection controller and an improved method for operating in a computer system comprising a process, an operating system and at least one memory disk.

[0006] One or more objects of the present invention are achieved by the solutions provided in the appended independent claims. Advantageous implementations of the present invention are further defined in the dependent claims.

[0007] In one aspect, the present invention provides a protection controller for running in a computer system comprising a process, an operating system, and at least one memory disk. The protection controller is configured to: receive a memory disk request for a file; determine that the memory disk request is a write request indicative of a modification to the file, and in response, generate a backup copy of the file prior to the modification; determine that the process comprises ransomware, and in response, restore the file based on the backup copy.

[0008] The protection controller of the computer system is configured to: generate a backup copy of a file prior to any modification whenever the protection controller receives a memory disk request indicative of a write request. The backup copy of the file is further configured to: restore an original copy of the file to eliminate adverse effects of ransomware whenever ransomware is detected during execution of the process. In addition, the protection controller is configured to monitor behavior of the process, the operating system, and the memory disk requests to provide overall data protection. Furthermore, the protection controller is configured to detect ransomware in the process, for example, through a ransomware detection scheme. For example, if malware is detected after ten (10) writes (2% of the disk is occupied), in this case, the protection controller is configured to restore files adversely affected by the malware. In addition, the protection controller is configured to terminate the process, for example, when malware is detected, when the process times out, or when the process is deemed benign. Thereafter, the protection controller is configured to: delete the backup copy of the file after the process is terminated to improve and reduce resource utilization, for example, by reducing memory utilization (i.e., by the least number of write files and write bytes). Furthermore, the protection controller is configured to provide file-level and block-level protection, for example, by backing up an entire file or by backing up modified blocks of the memory disk to provide a write-time backup and ransomware detection mechanism. Thus, the protection controller is configured to provide lossless ransomware protection to the computer system and improve overall data security.

[0009] In one implementation, the protection controller is further configured to monitor the process that receives the memory disk request.

[0010] The monitoring of the process is configured to determine a nature of the process, for example, a malicious process or a non-malicious process.

[0011] In another implementation, the protection controller is further configured to: restore the file by replacing modified blocks in the modified file with corresponding blocks in the backup copy.

[0012] In this implementation, the restoration of the file by replacing modified blocks in the modified file with corresponding blocks in the backup copy can eliminate adverse effects of a ransomware attack.

[0013] In another implementation, the protection controller is further configured to generate the backup copy of the file from the modified block.

[0014] Advantageously, generating a backup copy of a file can be used to recover the file, for example by replacing the modified file with the backup copy to eliminate the impact of ransomware.

[0015] In another implementation, the protection controller is further configured to determine that the process comprises ransomware, and in response, delete the backup copy.

[0016] Deleting a backup copy of a file reduces the utilization of resources (e.g. resources used to store the backup copy) and improves overall data security.

[0017] In another aspect, the application provides a method for a protection controller configured to operate in a computer system comprising a process, an operating system and at least one memory disk. The method comprises receiving a memory disk request for a file, determining that the memory disk request is a write request indicative of a modification of the file, and in response, generating a backup copy of the file prior to the modification, determining that the process comprises ransomware, and in response, recovering the file based on the backup copy.

[0018] The method achieves all the advantages and technical effects of the protection controller of the application.

[0019] It should be understood that all the above implementations can be combined.

[0020] It should be noted that all the devices, elements, circuits, units and modules described in the present application can be implemented by software or hardware elements or any type of combination thereof. All the steps performed by the various entities described in the present application and the functions described as being performed by the various entities are intended to mean that the respective entity is adapted to or programmed to perform the respective steps and functions. Even if, in the following description of specific embodiments, a specific function or step performed by an external entity is not reflected in the description of a specific detailed element of that entity that performs that specific step or function, it should be clear for a skilled person that these methods and functions can be implemented in respective hardware or software elements, or any type of combination thereof. It should be understood that the features of the present application are susceptible to combinations that were not specifically presented in the above for reasons of clarity and non-ambiguity.

[0021] Additional aspects, advantages, features and objects of the present application will become apparent to those skilled from the detailed description of illustrative implementations, from the drawings and from the appended claims. BRIEF DESCRIPTION OF DRAWINGS

[0022] The foregoing summary, as well as the following detailed description of illustrative embodiments of the application, can be better understood when read in conjunction with the accompanying drawings. For the purpose of illustrating the application, exemplary constructions of the application are shown in the drawings. However, the application is not limited to the specific methods and instrumentalities disclosed herein. In addition, one skilled in the art will understand that the drawings are not drawn to scale. Where possible, the same elements have been given the same numerals throughout the various figures.

[0023] Embodiments of the application will now be described, by way of example only, with reference to the accompanying drawings in which:

[0024] Figure 1 is a block diagram of a protection controller for running in a computer system provided by embodiments of the application;

[0025] Figure 2 is a flow diagram of a method for a protection controller provided by embodiments of the application;

[0026] Figure 3 is an exemplary diagram depicting the architecture of a computer system provided by embodiments of the application;

[0027] Figure 4 is an exemplary diagram depicting monitoring by a virtual machine monitor provided by embodiments of the application;

[0028] Figure 5 is an exemplary diagram depicting execution of a memory disk request for a file provided by embodiments of the application;

[0029] Figure 6 is an exemplary diagram depicting process execution order provided by another embodiment of the application.

[0030] In the drawings, underlined numerals are used to denote items that are numbered throughout the several figures. Un-underlined numerals are used to denote items that are not numbered throughout the several figures. When a numeral is un-underlined and followed by a comma, the un-underlined numeral refers to each of the items identified by that un-underlined numeral that precedes the comma. When a numeral is un-underlined and followed by a comma, the un-underlined numeral is used to identify the general class of the item to which the arrow associated with the un-underlined numeral points. DETAILED DESCRIPTION

[0031] The following detailed description illustrates embodiments of the application and can be implemented in a manner. Although a number of modes for carrying out the application have been disclosed, those skilled in the art will recognize that there are other embodiments that can be used to carry out or practice the application.

[0032] Figure 1 is a block diagram of a protection controller for running in a computer system provided by embodiments of the application. Reference is made to Figure 1FIG. 1 shows a block diagram 100 of a protection controller 102 for running in a computer system 104. In addition, the computer system 104 also includes an operating system 106 and at least one memory disk 108.

[0033] The protection controller 102 is for running in the computer system 104. Examples of the protection controller 102 can include, but are not limited to, a microcontroller, a microprocessor, a central processing unit (CPU), a complex instruction set computing (CISC) processor, an application-specific integrated circuit (ASIC) processor, a reduced instruction set (RISC) processor, a very long instruction word (VLIW) processor, a data processing unit, and other processors or control circuits. In addition, examples of the computer system 104 can include, but are not limited to, a user device, such as a computer, a personal digital assistant, a portable computing device, or an electronic device.

[0034] The at least one memory disk 108 is for storing files. Examples of the at least one memory disk 108 can include, but are not limited to, a hard disk drive (HDD), a solid-state drive (SSD), a hybrid hard drive (HHD), a floppy disk, a USB flash drive, a memory stick, an SD card (secure digital card), a microSD card, a compact flash (CF) card, and the like.

[0035] In operation, the protection controller 102 is for running in the computer system 104, which includes processes, the operating system 106, and the at least one memory disk 108. In one implementation, the protection controller 102 is a standalone entity. In another implementation, the protection controller 102 is part of the at least one memory disk 108. In yet another implementation, the protection controller 102 is part of a network entity of the computer system 104. In another implementation, the protection controller 102 is part of a client controller. In one implementation, the computer system 104 is a virtual machine system. In another implementation, the computer system 104 is a physical machine system, without affecting the scope of the present application. In addition, the protection controller 102 of the computer system 104 supports efficient resource utilization.

[0036] The protection controller 102 is configured to receive a memory disk request for a file. In other words, the protection controller 102 is configured to receive a memory disk request that includes a request to perform an action on a file, such as a write request or a read request, the file being stored in the at least one memory disk 108. In one implementation, the protection controller 102 is configured to receive a memory disk request for a file stored in the at least one memory disk 108, such as by running and receiving events related to the memory disk request on the computer system 104. According to one embodiment, the protection controller 102 is further configured to receive a memory disk request for a file by performing file activity monitoring with operating system services. Performing file activity monitoring with operating system services improves the overall data security of the computer system 104. In one implementation, the protection controller 102 is further configured to monitor a process that receives the memory disk request. In other words, monitoring the process that receives the memory disk request is configured to determine the type of the memory disk request, such as a write request or a read request, and to determine the nature of the process, such as a malicious process or a non-malicious process. In another implementation, the protection controller 102 is further configured to monitor the operating system 106 that receives the memory disk request. In other words, the operating system 106 that receives the memory disk request is monitored through operating system services to protect the computer system 104 from ransomware attacks. In yet another implementation, the protection controller 102 is further configured to monitor the at least one memory disk 108 that receives the memory disk request. Monitoring the at least one memory disk 108 that receives the memory disk request is configured to ensure that the corresponding memory disk request in the at least one memory disk 108 is not subject to a ransomware attack. Thus, monitoring the operating system 106 that receives the memory disk request improves the overall data security of the computer system 104.

[0037] The protection controller 102 is further configured to determine that the memory disk request is a write request that indicates a modification to the file and, in response, generate a backup copy of the file prior to the modification. In one implementation, if the memory disk request is a write request that indicates a modification to the file, then in this case the protection controller 102 is configured to generate a backup copy of the file prior to the modification of the file. However, if the memory disk request is not a write request that indicates a modification to the file, then in this case the protection controller 102 is not configured to generate a backup copy of the file. Thus, if the file is adversely affected by ransomware, then a backup copy of the file is generated prior to the modification of the file to recover the file. According to one embodiment, the protection controller 102 is further configured to generate a backup copy that is composed of modified blocks. In one example, the protection controller 102 is configured to generate a backup copy by backing up only the modified blocks. Thus, the protection controller 102 is configured to support block-level protection. However, the protection controller 102 is configured to support file-level protection without affecting the scope of the present application, such as by generating a backup copy of the entire file prior to the modification of the file.

[0038] Further, the protection controller 102 is configured to determine that the process includes ransomware and, in response, restore the file based on the backup copy. First, the protection controller 102 is configured to receive an in-memory disk request for the file. Thereafter, the protection controller 102 is configured to determine whether the in-memory disk request is a write request indicative of a file modification. In such a case, the protection controller 102 is configured to generate a backup copy of the file prior to processing the file. Thereafter, the protection controller 102 is configured to determine that the process includes ransomware. Further, if the process includes ransomware, in such a case, the protection controller 102 is configured to restore the file based on the backup copy. In one implementation, the protection controller 102 is further configured to restore the file by replacing the modified file with the backup copy. For example, if the backup copy of the file prior to the file modification is generated by file-level protection (e.g., by backing up the entire file), in such a case, the protection controller 102 is configured to restore the file by replacing the modified file with the backup copy of the file. Similarly, in another implementation, the protection controller 102 is further configured to restore the file by replacing the modified blocks in the modified file with corresponding blocks in the backup copy. For example, the protection controller 102 is configured to generate the backup copy of the file by backing up the modified blocks, e.g., by providing block-level backup protection. In such a case, the protection controller 102 is configured to replace the modified blocks in the modified file with corresponding blocks in the backup copy. Thus, the protection controller 102 is configured to restore the file after the file modification to eliminate the adverse effects of the ransomware attack. Thus, the protection controller 102 improves the data security of the computer system 104.

[0039] According to one embodiment, the protection controller 102 is further configured to determine that the process does not include ransomware by receiving an indication that the process does not include ransomware. The protection controller 102 is configured to determine whether the process includes ransomware, for example, by receiving an indication. For example, the protection controller 102 receives an indication that the process includes ransomware. Thereafter, the file is recovered, for example, by replacing the modified file with a backup copy of the file. Similarly, the protection controller 102 receives another indication that the process does not include ransomware. Accordingly, the indication received by the protection controller 102 is used to determine whether the process includes ransomware. According to another embodiment, the protection controller 102 is further configured to determine that the process does not include ransomware and, in response, delete the backup copy. In other words, if the process does not include ransomware, then in this case, the backup copy of the file that was generated for recovering the file is deleted. In one implementation, the protection controller 102 is configured to determine that the process does not include ransomware by other controllers, for example, by receiving a notification from other controllers (i.e., other than the protection controller 102). Accordingly, deleting the backup copy improves utilization of resources (e.g., resources used to store the backup copy) and improves overall data security. According to one embodiment, the protection controller 102 is further configured to determine that the process has been terminated and, in response, delete the backup copy. The process is terminated when the corresponding memory disk request is executed and does not need to be further executed. For example, if the memory disk request on the file is a write request, then in this case, the protection controller 102 is configured to delete the backup copy of the file that was generated prior to the modification (i.e., prior to the execution of the write request). According to one embodiment, the protection controller 102 is further configured to determine that a timeout has occurred and, in response, delete the backup copy. Accordingly, the space used to store the backup copy of the file is further used to store other data.

[0040] The protection controller 102 of the computer system 104 is configured to generate a backup of the file prior to any modification so that the file can be recovered in the future if the corresponding file is affected by ransomware. Further, the protection controller 102 is configured to delete the backup copy of the file after the process is executed to improve and reduce resource utilization, for example, by reducing utilization of memory used to store the backup copy. Accordingly, the protection controller 102 is configured to provide lossless ransomware protection to the computer system 104 and improve overall data security of the computer system 104.

[0041] Figure 2 is a flowchart of a method for a protection controller provided by an embodiment of the present invention. Referring to Figure 2 , a flowchart of a method 200 for use in a protection controller 102 is shown, the protection controller 102 being configured to determine whether a process includes ransomware and, in response, generate a backup copy of a file. Figure 1running in a computer system 104, the computer system 104 including a process, an operating system 106, and at least one memory disk 108. The method 200 includes steps 202-210.

[0042] In operation, the method 200 includes receiving a memory disk request for a file, for example at step 202. In other words, the protection controller 102 is configured to receive a memory disk request, the memory disk request including a request to perform an action on a file, for example a write request or a read request, the file stored in a memory disk in the at least one memory disk 108. Further, at step 204, the method 200 includes determining that the memory disk request is a write request indicating a modification to the file. In one implementation, the protection controller 102 is configured to receive a memory disk request for a file stored in the at least one memory disk 108, for example by running on the computer system 104 and receiving an event related to the memory disk request. Further, at step 206, the method 200 includes generating a backup copy of the file prior to the modification after determining that the memory disk request is a write request. In one implementation, if the memory disk request is a write request indicating a modification to the file, in which case the protection controller 102 is configured to generate a backup copy of the file prior to the modification of the file. However, if the memory disk request is not a write request indicating a modification to the file, in which case the protection controller 102 is not configured to generate a backup copy of the file. Thus, if the file is adversely affected by a ransomware, a backup copy of the file is generated prior to the modification of the file to recover the file. Further, at step 208, the method 200 also includes determining that the process includes a ransomware and, in response, for example at step 210, recovering the file based on the backup copy. First, the protection controller 102 is configured to receive a memory disk request for a file. Thereafter, the protection controller 102 is configured to determine whether the memory disk request is a write request indicating a modification to the file. In this case, the protection controller 102 is configured to generate a backup copy of the file prior to processing the file. Thereafter, the protection controller 102 is configured to determine that the process includes a ransomware. Further, if the process includes a ransomware, in which case the protection controller 102 is configured to recover the file based on the backup copy. Thus, even if the file is modified, the file can be recovered to eliminate the adverse effects of a ransomware attack. Thus, data security of the computer system 104 is improved.

[0043] The method 200 is configured to generate a backup of a file prior to any modification so that if the corresponding file is affected by a ransomware, the file can be recovered in the future. Further, the method 200 is configured to delete the backup copy of the file after the process is executed to improve and reduce resource utilization, for example by reducing the utilization of memory for storing the backup copy. Thus, the method 200 provides lossless ransomware protection for the computer system 104 and improves overall data security of the computer system 104.

[0044] Steps 202-210 are merely illustrative, and other alternatives can be provided where one or more steps are added, one or more steps are removed, or one or more steps are provided in a different sequence without departing from the scope of the claims herein.

[0045] A computer program product including instructions, which when executed by a computer, cause the computer to perform the method 200 is provided. In an example, the instructions are implemented on a computer-readable medium including, but not limited to, an electrically erasable programmable read-only memory (EEPROM), a random access memory (RAM), a read-only memory (ROM), a hard disk drive (HDD), a flash memory, a secure digital (SD) card, a solid-state drive (SSD), a computer-readable storage medium, and / or a CPU cache. In one example, the instructions are generated by a computer program that is implemented according to the method 200 and used to implement the method 200 in a virtual machine.

[0046] Figure 3 is an exemplary diagram illustrating an architecture of a computer system provided by an embodiment of the present disclosure. In conjunction with Figure 1 , elements of Figure 3 are described. Referring to Figure 3 , an exemplary diagram 300 illustrating an architecture of a computer system 104 in a virtual machine is shown.

[0047] In one implementation scenario, a data center 302 includes a host 304 that further includes a host operating system 306, a shared memory 324, and a virtual machine 308 (or a computer system 104 of Figure 1 ) to provide lossless ransomware protection. The virtual machine 308 includes a process 310, a guest operating system 312 (or a computer system 104 of Figure 1the file stored in the virtual machine memory 314. Further, the virtual machine 308 is configured to determine that the memory disk request is a write request indicative of a modification to the file, and in response, generate a backup copy of the file prior to the modification, which can be accessed by the backup manager 320. Further, the operating system service is configured to perform file activity monitoring, for example, by the file activity monitor 322. Further, a process comprising ransomware is determined, for example, by the ransomware detection 318. Thereafter, a ransomware alert is sent to the virtual machine 308 for the corresponding process comprising ransomware. Further, the file can be recovered even after the process 310 comprising malware modifies the file, for example, by replacing the modified copy of the file with the backup copy of the file by the backup manager 320 to eliminate the adverse effects of a ransomware attack. Thus, lossless ransomware protection is achieved, for example, by the zero ransomware protection agent 326 providing lossless ransomware protection to the virtual machine 308, and improving overall data security.

[0048] Figure 4 is an exemplary diagram depicting monitoring by a virtual machine monitor. In conjunction with Figure 1 and Figure 3 elements of Figure 4 are described. Referring to Figure 4 , a diagram 400 depicting monitoring by a virtual machine monitor, for example, by a virtual machine monitor method, is shown.

[0049] In an exemplary scenario, the zero ransomware protection agent 326 is configured to receive a memory disk request for a file, and if the memory disk request is a write request, further generate a backup copy of the file prior to the file modification. Further, the ransomware detection 318 is configured to determine that a process comprises ransomware, and in response, recover the file based on the backup copy processed by the backup manager 320, and further delete the backup copy generated prior to the file modification requested by the process 310. Further, the zero ransomware protection agent 326 is configured to determine whether a process, for example, the process 310, times out, for example, by the backup manager 320, and then, in such a case, the zero ransomware protection agent 326 is configured to terminate the process 310. Thus, the zero ransomware protection agent 326 comprises the file activity monitor 322, the ransomware detection 318, and the backup manager 320, configured to generate a backup copy of a file for which a write request is received, in order to recover a file modified by a process, for example, the process 310 comprising malware. Thus, the zero ransomware protection agent 326 is configured to eliminate the adverse effects of ransomware, and improve overall data security of the host 304, i.e., the computer system 104.

[0050] Figure 5is an exemplary diagram provided by an embodiment of the present invention describing an example of performing an in-memory disk request for a file. In conjunction with Figure 1 , Figure 3 and Figure 4 elements of Figure 5 are described. Referring to Figure 5 , a diagram 500 of a flow of performing an in-memory disk request for a file is shown. Diagram 500 describes operations from 514 to 532. Also shown is a client operating system 502 and a ransomware protection agent 504, which includes a file activity monitor 506 and a backup manager 508 for performing the operations shown in diagram 500. Diagram 500 describes a process 510 executing within client operating system 502 to write to a file. Further, a notification is sent to file activity monitor 506, which notifies backup manager 508 to backup the file to allow file modification.

[0051] At operation 514, client operating system 502 is to receive process 510 indicating a write request (i.e., an in-memory disk request) indicating file modification. Further, at operation 516, client operating system 502 is to send a notification to file activity monitor 506 indicating the in-memory disk request of the write request. At operation 518, file activity monitor 506 is to create a copy of the write request notification and send to backup manager 508. Further, at operation 520, backup manager 508 is to obtain data of the original file, and further, client operating system 502 is to send the data of the original file to backup manager 508, for example at operation 522. Thereafter, at operation 524, backup manager 508 is to store the data of the original file in ransomware protection agent 504, and create a copy of the data of the original file at file activity monitor 506, for example at operation 526. Thereafter, at operation 528, file activity monitor 506 is to send feedback of the notification to client operating system 502, and perform the write request, for example at operation 530. Finally, process 510 is completed by client operating system, for example at operation 532. Thus, a backup of the file is created prior to file modification, in order to restore the file in the future in the event the file is affected by ransomware under any circumstances.

[0052] Figure 6 is an exemplary diagram provided by another embodiment of the present invention describing a sequence of process execution. In conjunction with Figure 1 , Figure 3 , Figure 4 and Figure 5 elements of Figure 6 are described. Referring to Figure 6 , a diagram 600 of a flow of performing an in-memory disk request for a file is shown. Diagram 600 describes operations from 604 to 626. Figure 5The client operating system 502 and ( Figure 5 The non-destructive ransomware protection agent 504 is used to perform the operations shown in Figure 600. The non-destructive ransomware protection agent 504 includes ( Figure 5 File Activity Monitor 506 and ( Figure 5 Backup manager 508. Figure 500 illustrates the recovery of a file after modification by process 510, for example, via a backup copy of the file, process 510 including malware detected by ransomware detector 602.

[0053] At operation 606, backup manager 508 writes the data of the original file to lossless backup storage 512 and detects whether a process (e.g., process 510) contains malware, or whether a timeout occurs during the execution of process 510, for example, at operation 608. Furthermore, at operation 610, ransomware detector 602 detects that process 510 contains malware. Subsequently, at operation 612, backup manager 508 retrieves the data of the original file from lossless backup storage 512. Subsequently, at operation 614, the data of the original file is sent to backup manager 508. Furthermore, backup manager 508 sends the data of the original file to guest operating system 502, for example, at operation 616. Subsequently, after ransomware detector 602 detects malware, for example, at operation 618, process 510 is terminated, for example, at operation 620. Furthermore, at operation 622, ransomware detector 602 detects that a process has timed out. Then, in this case, backup manager 508 deletes backups created before the process 510 made the modification (e.g., at operation 624), and further deletes the timeouts (e.g., at operation 626). Thus, files modified by process 510, which includes malware, are recovered by creating backup copies, and subsequently, the backup copies are deleted to reduce resource utilization and improve the overall data security of computer system 104.

[0054] Modifications can be made to the embodiments of the application described above without departing from the scope of the application as defined in the appended claims. Expressions such as "including", "containing", "comprising", "having", "including", "involved in", "characterized by", "comprised of", and the like are used as the plain meaning of these terms: that is, meaning "including but not limited to". References to singular shall also be taken to include the plural unless in the context it is clear that they mean the singular. The word "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any implementation described as "exemplary" is not necessarily to be construed as preferred or advantageous over other implementations. The word "may" is used herein to mean "can" and "shall". The word "optionally" is used herein to mean "may or can not" and "some embodiments provide and some do not provide". It will be appreciated that certain features of the application described in the context of separate embodiments can also be provided in combination in a single embodiment. Conversely, various features of the application, which are, for brevity, described in the context of a single embodiment, can also be provided separately or in any suitable combination.

Claims

1. A protection controller (102), characterized in that, For operation in a computer system (104), the computer system (104) including processes, an operating system (106) and at least one memory disk (108), wherein the protection controller (102) is further configured to: Receive requests for files on a memory disk; Determine that the memory disk request is a write request indicating modification of the file, and respond accordingly. A backup copy of the file is generated before the modification is made; The process was determined to include ransomware, and in response, The file is restored based on the backup copy.

2. The protection controller (102) according to claim 1, characterized in that, The protection controller (102) is also used to monitor the process that receives the request from the memory disk.

3. The protection controller (102) according to claim 1, characterized in that, The protection controller (102) is also used to monitor the operating system that receives the request from the memory disk.

4. The protection controller (102) according to claim 1, characterized in that, The protection controller (102) is also used to monitor the at least one memory disk (108) that receives the request from the memory disk.

5. The protection controller (102) according to any one of the preceding claims, characterized in that, The protection controller (102) is also configured to receive the memory disk request for the file by utilizing operating system services to perform file activity monitoring.

6. The protection controller (102) according to any one of the preceding claims, characterized in that, The protection controller (102) is also used to restore the file by replacing the modified file with the backup copy.

7. The protection controller (102) according to any one of the preceding claims, characterized in that, The protection controller (102) is also configured to restore the file by replacing the modified block in the modified file with the corresponding block in the backup copy.

8. The protection controller (102) according to claim 7, characterized in that, The protection controller (102) is also used to generate the backup copy consisting of the modified blocks.

9. The protection controller (102) according to any one of the preceding claims, characterized in that, The protection controller (102) is also configured to determine that the process has been terminated and, in response, delete the backup copy.

10. The protection controller (102) according to any one of the preceding claims, characterized in that, The protection controller (102) is also configured to determine that the process does not include ransomware, and in response, delete the backup copy.

11. The protection controller (102) according to claim 10, characterized in that, The protection controller (102) is also configured to determine that the process does not contain ransomware by receiving an indication that the process does not contain ransomware.

12. The protection controller (102) according to any one of the preceding claims, characterized in that, The protection controller (102) is also configured to determine that a timeout has occurred and, in response, delete the backup copy.

13. The protection controller (102) according to any one of the preceding claims, characterized in that, The computer system (104) is a virtual machine system.

14. A method (200) for protecting a controller (102), characterized in that, The protection controller (102) is configured to run in a computer system (104), the computer system (104) including processes, an operating system (106), and at least one memory disk (108), wherein the method (200) includes: Receive requests for files on a memory disk; Determine that the memory disk request is a write request indicating modification of the file, and respond accordingly. A backup copy of the file is generated before the modification is made; The process was determined to include ransomware, and in response, The file is restored based on the backup copy.

15. A computer program product, characterized in that, Includes program instructions for performing the method (200) according to claim 14 when executed by one or more processors in a virtual machine system.

Images