Data recovery method and related apparatus

Abstract

This application discloses a data recovery method and related apparatus, belonging to the field of information security technology. The method includes: in response to a first process running in a computer device being identified as a suspicious process, determining target time information; based on the target time information, determining target backup data from multiple backup data sets; and based on the target backup data, restoring the data stored in the target storage space to a state unaffected by the first process. This application can accurately pinpoint the time point when data may begin to be damaged based on the target time information, and can also ensure that the data subsequently restored based on the target backup data is unaffected by the first process. In other words, even if the data stored in the target storage space is damaged after the first process runs, this application can still use the target backup data to restore the data in the target storage space to a state unaffected by the first process, thereby protecting the integrity and availability of the data.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a data recovery method and related apparatus. Background Technology

[0002] Malicious programs are computer code or software that are installed and run on a user's computer or other terminal without explicit notification or permission, and engage in activities that infringe upon the user's legitimate rights, such as stealing, encrypting, altering, and deleting data, and monitoring the user. Examples include computer viruses, ransomware, backdoor programs, keyloggers, password thieves, Word and Excel macro viruses, boot sector viruses, script viruses, Trojans, criminal software, spyware, and adware, among others.

[0003] Taking ransomware as an example, once a computer device is infected, the ransomware can interfere with the device's functionality. This can be done by blocking data input devices, corrupting data, restricting access to interface components, and so on. In addition, it will generate ransom notes in prominent locations such as the desktop, requiring the infected user to pay a large ransom to obtain the decryption key and restore normal use of the computer system and data files. In most cases, even paying a large ransom may not guarantee data recovery. Therefore, it is evident that these malicious processes pose a significant threat to user data. Consequently, a data recovery method is urgently needed to reduce the losses caused by malicious programs and protect user data. Summary of the Invention

[0004] This application provides a data recovery method, apparatus, device, storage medium, and computer program, which can reduce losses caused by malicious programs and protect user data. The technical solution is as follows:

[0005] In a first aspect, a data recovery method is provided, applied to a computer device, the method comprising:

[0006] In response to the first process running in the computer device being identified as a suspicious process, target time information is determined, which describes the time when the first process begins running in the computer device. Based on the target time information, target backup data is determined from multiple backup data sets, each of which is obtained by backing up data stored in a target storage space in the computer device at a backup time, and the multiple backup data sets correspond one-to-one with the multiple backup times. Based on the target backup data, the data stored in the target storage space is restored to a state unaffected by the first process.

[0007] System security monitoring is achieved by monitoring whether a suspicious process is running on a first computer device. If the first process is determined to be suspicious, target backup data can be identified from multiple backup data sets based on target time information, and then data stored in the target storage space can be recovered based on the target backup data. Since the target time information characterizes the moment the first process started running on the computer device, the point in time when the data might have begun to be corrupted can be accurately located. In this case, based on the target time information, backup data that started running before the suspicious process (i.e., the target backup data) can be selected from multiple backup data sets to ensure that the data subsequently recovered based on the target backup data is unaffected by the first process. In other words, even if the data stored in the target storage space is corrupted after the first process runs, this application can use the target backup data to restore the data in the target storage space to a state unaffected by the first process, thereby protecting the integrity and availability of the data.

[0008] In one possible implementation, the target time information is determined from the correspondence between process identifiers and time information, based on the process identifier of the first process. The computer device stores a correspondence between process identifiers and time information, where the time information indicates the moment when a process with the corresponding process identifier begins running on the computer device. In this case, the computer device can determine the time information corresponding to the process identifier of the first process from the correspondence between process identifiers and time information, thus obtaining the target time information.

[0009] In one possible implementation, whenever a process is started in a computer device, the computer device obtains the time when the process started running in the computer device and stores the process identifier and time information accordingly.

[0010] It should be noted that a suspicious process refers to a process on a computer device that is not a trusted process. In one possible implementation, the computer device stores a second whitelist, which records at least one trusted program. In this case, if the program corresponding to the first process is not a program recorded in the second whitelist, then the first process is determined to be a suspicious process; if the program corresponding to the first process is a program recorded in the second whitelist, then the first process is determined not to be a suspicious process.

[0011] In one possible implementation, the computer device stores a first whitelist containing at least one trusted program. In this case, the computer device can generate a mapping between process identifiers and time information based on the first whitelist. For any newly started fourth process on the computer device, if the program corresponding to the fourth process is not recorded in the first whitelist, then the process identifier and time information of the fourth process are recorded. If the program corresponding to the fourth process is recorded in the first whitelist, then the process identifier and time information of the fourth process are not recorded.

[0012] Since trusted programs (i.e. programs in the whitelist) are generally considered safe, no additional monitoring is required. Therefore, this application can record only the process information of programs that are not in the first whitelist. In this way, while monitoring the processes, it avoids unnecessary monitoring of a large number of known safe programs by computer devices, thereby saving computing and storage resources and effectively improving the performance and response speed of computer devices.

[0013] In one possible implementation, before determining the target time information, the computer device can also send suspicious event information to the security server, which is used to indicate that the first process is a suspicious process; and receive a data recovery instruction sent by the security server, which instructs the computer device to recover the data in the target storage space. The data recovery instruction is triggered by the security server when it confirms that the first process is a malicious process.

[0014] This application enables a second confirmation of whether a first process is truly malicious, through a security server, when the first process is determined to be a suspicious process. In other words, by introducing a 'second confirmation' mechanism, this application ensures that data recovery measures are only executed after sufficient analysis and confirmation of a malicious process. This helps to avoid unnecessary data recovery operations caused by incorrect initial judgment and reduces misjudgments.

[0015] In one possible implementation, the computer device runs a second process for backing up data. Before determining the target time information, the computer device can also, based on backup parameters, invoke the second process to back up the data stored in the target storage space, obtaining the backup data corresponding to the target backup time. The target backup time is one of multiple backup times, and the backup parameters are used to guide the second process in backing up the data stored in the target storage space.

[0016] In one possible implementation, the backup parameters include first source location information and first target location information. The first source location information indicates the storage location of the target storage space on the computer device, and the first target location information indicates the storage location of the backup storage space. The backup storage space is used to store the backup data corresponding to the target backup time.

[0017] It should be noted that the target storage space mentioned above can be the storage space corresponding to any target folder on the computer device. In this case, the storage location of the target storage space on the computer device can be the index path of the target folder. Similarly, the backup storage space mentioned above can be the storage space corresponding to any backup folder on the computer device. In this case, the storage location of the backup storage space on the computer device can be the index path of the backup folder.

[0018] In one possible implementation, the target backup time is any backup time other than the first one among multiple backup times. The backup parameters also include indication information for the baseline data, which is the data stored in the target storage space at any of the multiple backup times prior to the target backup time. In this case, based on the indication information of the baseline data, a second process is invoked to determine the incremental backup data corresponding to the target backup time. The incremental backup data is the data that differs between the data stored in the target storage space at the target backup time and the baseline data. The second process stores the incremental backup data corresponding to the target backup time into the backup storage space to obtain the backup data corresponding to the target backup time. The backup storage space is used to store the backup data corresponding to the target backup time.

[0019] In one possible implementation, the second process is the process corresponding to the remote synchronization rsync program.

[0020] The target backup data is determined from multiple backup data. The backup time of the target backup data is the shortest interval between the backup time and the time when the first process starts running on the computer device, and it is located before the time when the first process starts running on the computer device.

[0021] In addition to determining the backup data corresponding to the backup time that is closest to the start time of the first process in the computer device among multiple backup times as the target backup data, the backup data corresponding to any backup time that is before the start time of the first process in the computer device among multiple backup times can also be determined as the target backup data.

[0022] In one possible implementation, the aforementioned backup data is stored locally on the computer device or on another device on the same network as the computer device.

[0023] It should be noted that "multiple backup data stored locally on a computer device" means that multiple backup data are stored on the local storage medium of the computer device. This local storage medium includes internal storage media and / or external storage media. The external storage media can be accessed via an I / O interface. External storage media can be a hard disk drive (HDD) or a solid-state drive (SSD). "Multiple backup data stored on another device on the same network as the computer device" means that multiple backup data are stored on the storage medium of another device, which can communicate with the computer device described in this application via network protocols.

[0024] In one possible implementation, the computer device runs a third process for data recovery. In this case, the computer device, based on the target backup data and recovery parameters, calls the third process to restore the data stored in the target storage space to a state unaffected by the first process. The recovery parameters are used to guide the third process in restoring the data stored in the target storage space.

[0025] In one possible implementation, the recovery parameters include second source location information and second target location information, where the second source location information indicates the location where the target backup data is stored and the second target location information indicates the location of the target storage space.

[0026] In one possible implementation, based on the target backup data and recovery parameters, a third process is invoked to determine the data stored in the target storage space at the backup time corresponding to the target backup data; the third process then copies the data stored in the target storage space at the backup time to the target storage space.

[0027] In one possible implementation, the third process is always the process corresponding to the remote synchronization rsync program. It is understood that the second and third processes can be the same process or different processes; this application does not impose any restrictions on this.

[0028] In one possible implementation, before restoring the data stored in the target storage space to a state unaffected by the first process, based on the target backup data, the computer device can also stop the operation of a fourth process, which is the process currently occupying the target storage space.

[0029] In one possible implementation, before stopping the fourth process, the computer device can also obtain attribute information of the target backup data. This attribute information indicates whether the target backup data is backup data corresponding to the database service. If the target backup data is backup data corresponding to the database service, then the step of stopping the fourth process is executed. If the target backup data is backup data corresponding to the database service, then the data stored in the target storage space is directly restored to a state unaffected by the first process based on the target backup data.

[0030] When the target backup data is determined to be the backup data corresponding to the database service, this application can stop the operation of the fourth process to avoid the database continuously modifying the data in the target storage space during the data recovery process, thereby reducing errors and uncertainties in the data recovery process.

[0031] Secondly, a data recovery apparatus is provided, which has the function of implementing the data recovery method described in the first aspect. The data recovery apparatus includes at least one module for implementing the data recovery method provided in the first aspect.

[0032] Thirdly, a computer device is provided, comprising a processor and a memory, the memory being used to store a computer program for performing the data recovery method provided in the first aspect. The processor is configured to execute the computer program stored in the memory to implement the data recovery method described in the first aspect.

[0033] Optionally, the computer device may further include a communication bus for establishing a connection between the processor and the memory.

[0034] Fourthly, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when the computer program is run on a computer or processor, the computer or processor performs the steps of the data recovery method described in the first aspect.

[0035] Fifthly, a computer program product is provided, comprising computer instructions that, when executed on a computer or processor, cause the computer to perform the steps of the data recovery method described in the first aspect. Alternatively, a computer program is provided that, when executed on a computer or processor, causes the computer or processor to perform the steps of the data recovery method described in the first aspect.

[0036] The technical effects achieved by the second, third, fourth, and fifth aspects mentioned above are similar to those achieved by the corresponding technical means in the first aspect, and will not be repeated here. Attached Figure Description

[0037] Figure 1 This is a schematic diagram of an implementation environment provided in an embodiment of this application;

[0038] Figure 2 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application;

[0039] Figure 3This is a flowchart of a data recovery method provided in an embodiment of this application;

[0040] Figure 4 This is a schematic diagram of a network backup provided in an embodiment of this application;

[0041] Figure 5 This is a flowchart of a data recovery method provided in an embodiment of this application;

[0042] Figure 6 This is a functional diagram of an EDR software provided in an embodiment of this application;

[0043] Figure 7 This is a schematic diagram of the structure of a data recovery device provided in an embodiment of this application. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0045] To facilitate understanding, before providing a detailed explanation of the data recovery method provided in the embodiments of this application, the terms, application scenarios, and implementation environments involved in the embodiments of this application will be introduced first.

[0046] First, the terms used in the embodiments of this application will be introduced.

[0047] Endpoint Detection and Response (EDR): EDR is an endpoint security solution. By deploying specific security software on computer devices, the software monitors and logs various activities and behaviors on the devices in real time, including file operations, network communications, process startup and shutdown, etc. It uses data analysis and context-based information detection to discover anomalies and malicious activities, and records data about malicious activities, enabling security teams to investigate and respond to incidents. Endpoints can be employee PCs or laptops, servers, cloud systems, mobile devices, or IoT devices, etc. EDR solutions typically provide threat search, detection, analysis, and response capabilities.

[0048] Processes and Programs: Programs are static, processes are dynamic. A program is binary code stored on some medium, while a process corresponds to the execution of a program. A process is one execution of a program, and a process always corresponds to at least one specific program. One program can correspond to multiple processes, and the same program can run on different data sets, thus forming several different processes. Several processes can execute the same program code concurrently, while the same process can execute several programs sequentially.

[0049] Remote synchronization (rsync) software: rsync is an application software under Unix that can synchronize and update files and directories on two computers, and appropriately utilize differential encoding to reduce data transfer volume. A key feature of rsync is incremental file backup. For example, at time T1, rsync performs a full backup, copying all the data from / mnt / a.txt to / backup / T1 / a.txt; at time T2, rsync performs an incremental backup, / mnt / a.txt remains unchanged, and / backup / T2 / a.txt is a hard link to / backup / T1 / a.txt, meaning they share the same inode number; at time T3, rsync performs another incremental backup, / mnt / a.txt has been modified to / mnt / a'.txt, and the delta-transfer algorithm is executed with / mnt / a'.txt and / backup / T2 / a.txt as input, outputting / backup / T3 / a'.txt, at which point the inode has changed.

[0050] The application scenarios involved in the embodiments of this application will be introduced next.

[0051] Malicious programs are computer code or software that are installed and run on a user's computer or other terminal without explicit notification or permission, and engage in activities that infringe upon the user's legitimate rights, such as stealing, encrypting, altering, and deleting data, and monitoring the user. Examples include computer viruses, ransomware, backdoor programs, keyloggers, password thieves, Word and Excel macro viruses, boot sector viruses, script viruses, Trojans, criminal software, spyware, and adware, among others.

[0052] Taking ransomware as an example, once a computer device is infected, the ransomware can interfere with the device's functionality. This can be done by blocking data input devices, corrupting data, restricting access to interface components, and so on. In addition, it will generate a ransom note in a prominent location such as the desktop, requiring the infected user to pay a large ransom to obtain the decryption key and restore normal use of the computer system and data files. In most cases, even paying a large ransom may not guarantee data recovery. Therefore, it is evident that these malicious processes pose a significant threat to user data.

[0053] The relevant technology intercepts requests to modify file parameters of a target file, backs up the file parameters, and further analyzes the process issuing the modification request to determine if it belongs to ransomware. If it is determined to be ransomware, the process is stopped, and the file parameters of the target file are restored based on the backed-up parameters.

[0054] However, the above technique only backs up file parameters after a modification request has been triggered. If the ransomware has already successfully modified the file parameters before the backup, the technique cannot effectively recover them. Furthermore, this technique can only recover file parameters modified by the ransomware; it cannot protect data within the file if the ransomware has affected it.

[0055] Based on this, embodiments of this application provide a data recovery method that monitors system security by monitoring whether a suspicious process is running on a first computer device. If the first process is determined to be suspicious, target backup data can be identified from multiple backup data sets based on target time information, and then the data stored in the target storage space can be recovered based on the target backup data. Since the target time information characterizes the moment the first process begins running on the computer device, the point in time when the data may have begun to be corrupted can be accurately located based on the target time information. In this case, based on the target time information, backup data that started running before the suspicious process began (i.e., the target backup data) can be selected from multiple backup data sets to ensure that the data subsequently recovered based on the target backup data is unaffected by the first process. In other words, even if the data stored in the target storage space is damaged after the first process runs, embodiments of this application can use the target backup data to restore the data in the target storage space to a state unaffected by the first process, thereby protecting the integrity and availability of the data.

[0056] The execution subject of the data recovery method provided in this application is a computer device. In some embodiments, the computer device includes a processor. In this case, the execution subject of the data recovery method provided in this application can be the processor in the computer device or the security software running in the computer device. This application does not limit this.

[0057] Finally, the implementation environment involved in the embodiments of this application will be described.

[0058] Please refer to Figure 1 , Figure 1 This is a schematic diagram of an implementation environment provided in an embodiment of this application. The implementation environment includes a computer device 01, and in some embodiments, it further includes a security server 02. Optionally, the computer device 01 and the security server 02 are connected via a data communication network, which includes an access device or a routing and forwarding device.

[0059] Computer device 01 responds to the fact that the first process running in the computer device is a suspicious process by determining target time information, which describes the time when the first process started running in the computer device; based on the target time information, it determines target backup data from multiple backup data, each of the multiple backup data is obtained by backing up the data stored in the target storage space in the computer device at a backup time, and the multiple backup data correspond one-to-one with the multiple backup times; based on the target backup data, it restores the data stored in the target storage space to a state unaffected by the first process.

[0060] In some embodiments, before determining the target time information, computer device 01 can send suspicious event information to security server 02, which indicates that the first process is a suspicious process; security server 02 can receive the suspicious event information sent by computer device 01. If security server 02 confirms that the first process is a malicious process, it sends a data recovery instruction to computer device 01, which instructs computer device 01 to recover data from the target storage space. Computer device 01 receives the data recovery instruction sent by security server 02.

[0061] In some embodiments, computer device 01 includes, but is not limited to, a server, host, personal computer, mobile phone, or workstation, and the aforementioned security software may be EDR software, etc. When computer device 01 is a server, the server includes, but is not limited to, an application server or a web server. Application servers include, but are not limited to, game servers, video application servers, file servers, search engine servers, instant messaging servers, etc. Web servers are also called World Wide Web (WWW) servers or website servers.

[0062] In one possible implementation, computer device 01 can be a terminal device with a Linux operating system installed.

[0063] In one possible implementation, the security server 104 can be a server accessible via a network, such as a security server in a public cloud or a security server in a private cloud. In some embodiments, the security server 104 is a cloud security server, which can be a server cluster or a distributed system composed of multiple physical servers, etc., and this application embodiment does not limit this.

[0064] Those skilled in the art should understand that the above-described computer devices and security servers are merely examples. Other existing or future computer devices and security servers that are applicable to the embodiments of this application should also be included within the scope of protection of the embodiments of this application, and are hereby incorporated by reference.

[0065] It should be noted that the application scenarios and implementation environments described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the emergence of new application scenarios and the evolution of technologies and equipment, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0066] Please refer to Figure 2 , Figure 2 This is a schematic diagram of the structure of a computer device according to an embodiment of this application. The computer device may be... Figure 1 The computer device 101 shown is included. The computer device includes at least one processor 201, a communication bus 202, a memory 203, and at least one communication interface 204.

[0067] The processor 201 can be a general-purpose central processing unit (CPU), a network processor (NP), a microprocessor, or one or more integrated circuits for implementing the solutions of this application, such as an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The aforementioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0068] The communication bus 202 is used to transmit information between the aforementioned components. The communication bus 202 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, it is represented by only one thick line in the figure, but this does not indicate that there is only one bus or one type of bus.

[0069] The memory 203 may be a read-only memory (ROM), a random access memory (RAM), an electrically erasable programmable read-only memory (EEPROM), an optical disc (including a compact disc read-only memory (CD-ROM), a compressed optical disc, a laser disc, a digital versatile optical disc, a Blu-ray disc, etc.), a magnetic disk storage medium, or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but not limited thereto. The memory 203 may exist independently and be connected to the processor 201 via the communication bus 202. The memory 203 may also be integrated with the processor 201.

[0070] Communication interface 204 uses any transceiver-like device for communicating with other devices or communication networks. Communication interface 204 includes a wired communication interface and may also include a wireless communication interface. The wired communication interface may be, for example, an Ethernet interface. The Ethernet interface may be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface may be a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof.

[0071] In a specific implementation, as one example, the processor 201 may include one or more CPUs, such as... Figure 2 CPU0 and CPU1 are shown in the diagram.

[0072] In a specific implementation, as one example, a computer device may include multiple processors, such as... Figure 2 The processors 201 and 205 are shown. Each of these processors may be a single-core processor or a multi-core processor. Here, "processor" may refer to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).

[0073] In a specific implementation, as one embodiment, the computer device may further include an output device 206 and an input device 207. The output device 206 communicates with the processor 201 and can display information in various ways. For example, the output device 206 may be a liquid crystal display (LCD), a light-emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc. The input device 207 communicates with the processor 201 and can receive user input in various ways. For example, the input device 207 may be a mouse, keyboard, touchscreen device, or sensing device, etc.

[0074] In some embodiments, memory 203 is used to store program code 210 for executing the scheme of this application, and processor 201 can execute the program code 210 stored in memory 203. The program code 210 may include one or more software modules, and the computer device can implement the following by using processor 201 and the program code 210 in memory 203. Figure 3 The data recovery method provided in the example.

[0075] Figure 3 This is a flowchart illustrating a data recovery method provided in an embodiment of this application, which is applied to a computer device. Please refer to... Figure 3 The method includes the following steps.

[0076] Step 301: In response to the fact that the first process running in the computer device is a suspicious process, determine the target time information, which describes the time when the first process started running in the computer device.

[0077] In some embodiments, the operating system of the computer device is the Linux operating system.

[0078] In one possible implementation, the target time information is determined from the correspondence between process identifiers and time information, based on the process identifier of the first process. For example, the computer device stores a correspondence between process identifiers and time information, where the time information indicates the moment when a process with the corresponding process identifier begins running in the computer device; in this case, the computer device can determine the time information corresponding to the process identifier of the first process from the correspondence between process identifiers and time information, thus obtaining the target time information.

[0079] In some embodiments, each time a process is started in a computer device, the computer device obtains the time when the process started running in the computer device and stores the process identifier and time information accordingly. Optionally, the process identifier can be a universally unique identifier (UUID) for the process.

[0080] In some embodiments, the computer device can record process startup information, which carries a correspondence between process identifiers and time information. For example, the database format for process startup information is shown in Table 1 below.

[0081] Table 1

[0082] Serial Number Fields type default value illustrate 1 uuid CHAR(38) NOT NULL process UUID 2 parent CHAR(38) NULL The UUID of the parent process of the process 3 path VARCHAR(4096) NULL process index path 4 cmd VARCHAR(4096) NULL Command line arguments used when starting a process 5 startTime CHAR(13) NULL The moment when a process begins to run on a computer device

[0083] In one possible implementation, a suspicious process refers to a process in a computer device that is not a trusted process. In some embodiments, the computer device stores a first whitelist containing at least one trusted program. In this case, the computer device can generate a mapping between process identifiers and time information based on the first whitelist. For example, for any newly started fourth process in the computer device, if the program corresponding to the fourth process is not a program recorded in the first whitelist, then the process identifier and time information of the fourth process are recorded accordingly. If the program corresponding to the fourth process is a program recorded in the first whitelist, then the process identifier and time information of the fourth process are not recorded.

[0084] Since trusted programs (i.e. programs in the whitelist) are generally considered safe, no additional monitoring is required. Therefore, this application embodiment can record only the process information of programs that are not in the first whitelist. In this way, while monitoring the processes, it is possible to avoid unnecessary monitoring of a large number of known safe programs by computer devices, thereby saving computing and storage resources and effectively improving the performance and response speed of computer devices.

[0085] Optionally, the programs recorded in the first whitelist are pre-configured by technical personnel. Alternatively, in some embodiments, the first whitelist can be built through self-learning, for example, by inputting parameters such as the application's digital signature, signature validity period, and application vendor into a trusted program identification model to determine whether the application is a trusted program. If the application is determined to be a trusted program, it is recorded in the first whitelist.

[0086] Optionally, in some embodiments, before determining the target time information, the computer device also sends suspicious event information to the security server, the suspicious event information being used to indicate that the first process is a suspicious process; and receives a data recovery instruction sent by the security server, the data recovery instruction instructing the computer device to recover data in the target storage space, the data recovery instruction being triggered by the security server upon confirming that the first process is a malicious process.

[0087] This application embodiment can, when a first process is determined to be a suspicious process, use a security server to perform a second confirmation that the first process is indeed a malicious process. In other words, this application embodiment introduces a 'second confirmation' mechanism to ensure that data recovery measures are only executed after sufficient analysis and confirmation of a malicious process. This helps to avoid unnecessary data recovery operations caused by incorrect initial judgment and reduces misjudgments.

[0088] In some embodiments, computer devices can communicate with secure servers via SSL (Secure Sockets Layer) and Google Remote Procedure Call (gRPC).

[0089] In some embodiments, the suspicious event information carries the process identifier of the first process, the process identifier of the parent process of the first process, and target time information. In other embodiments, the suspicious event information also carries a threat number to indicate the suspicious category of the first process, which includes ransomware, etc. For example, the threat number could be TN1001 to indicate that the first process is involved in a ransomware event. In other embodiments, the suspicious event information also carries behavioral context information of the first process.

[0090] The security server can receive suspicious event information sent by computer devices, and if the security server confirms that the first process is a malicious process, it sends a data recovery command to the computer device.

[0091] In some embodiments, after receiving information about a suspicious event, the security server may display the suspicious event on a web page.

[0092] In one possible implementation, technicians can determine whether the first process is malicious based on suspicious events displayed on the web page. If the first process is determined to be malicious, a confirmation button is triggered to indicate that the first process is malicious, and then the security server can send data recovery instructions to the computer device.

[0093] In some embodiments, the data recovery instruction may also carry the process identifier of the first process.

[0094] For example, the data recovery command is as follows:

[0095] "id":"cabf5e35-d5a7-41ea-a1ca-b97f918f28bb", / / Task ID

[0096] "operation": "Recover", / / Data recovery command (rollback command)

[0097] "parameters":{

[0098] "processUuids": [ / / UUIDs that threaten the first process]

[0099] "{780ED220-AFFA-66FF-0000-001016962A14}"]

[0100] "quarantine":true / / Whether to quarantine encrypted files, select true or false

[0101] In some embodiments, the computer device may also directly determine the target time information and execute steps 302 and 303 if it determines that the first process is a suspicious process.

[0102] In some embodiments, the computer device runs a second process for backing up data. Before determining the target time information, the computer device can also, based on backup parameters, invoke the second process to back up the data stored in the target storage space, obtaining backup data corresponding to the target backup time. The target backup time is one of multiple backup times, and the backup parameters are used to guide the second process to back up the data stored in the target storage space.

[0103] In one possible implementation, the backup parameters include first source location information and first target location information. The first source location information indicates the storage location of the target storage space on the computer device, and the first target location information indicates the storage location of the backup storage space. The backup storage space is used to store the backup data corresponding to the target backup time.

[0104] It should be noted that the target storage space mentioned above can be the storage space corresponding to any target folder on the computer device. In this case, the storage location of the target storage space on the computer device can be the index path of the target folder. Similarly, the backup storage space mentioned above can be the storage space corresponding to any backup folder on the computer device. In this case, the storage location of the backup storage space on the computer device can be the index path of the backup folder.

[0105] In some embodiments, the target backup time is a backup time other than the first backup time among multiple backup times. The backup parameters also include indication information of the baseline data, which is the data stored in the target storage space at any time before the target backup time among the multiple backup times. In this case, based on the indication information of the baseline data, a second process is invoked to determine the incremental backup data corresponding to the target backup time. The incremental backup data is the data that differs between the data stored in the target storage space at the target backup time and the baseline data. The second process stores the incremental backup data corresponding to the target backup time into the backup storage space to obtain the backup data corresponding to the target backup time. The backup storage space is used to store the backup data corresponding to the target backup time.

[0106] In one possible implementation, the computer device is able to periodically back up data in the target storage space. The backup cycle is predetermined and can be adjusted according to different needs under different circumstances.

[0107] In some embodiments, the second process is the process corresponding to the remote sync (rsync) program. Optionally, the rsync program can perform incremental backups using the delta-transfer algorithm.

[0108] Optionally, in the case where the execution entity is EDR software deployed in a computer device, the EDR software performs the first backup upon startup, and subsequent backups are performed periodically. Of course, the timing of the first backup can also be preset, and this embodiment does not limit this. It is understood that each backup can be a full backup, that is, all data in the target storage space is copied and stored at each backup time to obtain multiple backups. Alternatively, the first backup can be a full backup, and subsequent backups can be incremental backups; this embodiment does not limit this.

[0109] For example, a computer device invokes the process corresponding to the rsync program to back up the data stored in the target storage space using a backup statement, which carries backup parameters. When the target backup time is the first of multiple backup times, the computer device can invoke the process corresponding to the rsync program to back up the data stored in the target storage space using backup statement 1. Backup statement 1 is: rsync -D --numeric-ids --links --hard-links --one-file-system --itemize-changes --times --recursive --perms --owner --group --stats --human-readable --exclude={'*.t The command `mp','*.txt'}--log-file' / 1.log” / var / lib / mysql'' / backup / T1 / var / lib / mysql'` specifies the backup storage location. Here, ' / var / lib / mysql' is the first source location information, indicating the target storage space's location (also known as the index path) on the computer device: ' / var / lib / mysql'. ' / backup / T1 / var / lib / mysql' is the first destination location information, indicating the backup storage space's location (also known as the index path): ' / backup / T1 / var / lib / mysql'.

[0110] When the target backup time is the second of multiple backup times, the computer device can use backup statement 2 to call the process corresponding to the rsync program to back up the data stored in the target storage space. Backup statement 2 is: rsync -D --numeric-ids --links --hard-links --one-file-system --itemize-changes --times --recursive --perms --owner --group --stats --human-readable --exclude={'*.tmp','*.txt'} --log-file' / 2.log' --link-dest=' / bac The statement `kup / T1" / var / lib / mysql'' / backup / T2 / var / lib / mysql'` specifies the backup location. Here, ` / var / lib / mysql` is the first source location information, indicating the target storage space's location (also known as the index path) on the computer device as ` / var / lib / mysql`. ` / backup / T2 / var / lib / mysql` is the first destination location information, indicating the backup storage space's location (also known as the index path) as ` / backup / T2 / var / lib / mysql`. `link-dest=' / backup / T1'` indicates the base data, specifying the data in the folder corresponding to the index path ` / backup / T1` as the base data. For the definitions of other parameters in backup statements 1 and 2, please refer to Table 2 below; further explanation is not provided here.

[0111] Table 2

[0112]

[0113]

[0114] In some embodiments, the computer device may determine whether the first process is a suspicious process before determining the target time information in response to the first process running in the computer device being a suspicious process.

[0115] In one possible implementation, the computer device stores a second whitelist containing at least one trusted program. In this case, if the program corresponding to the first process is not a program recorded in the second whitelist, the first process is determined to be a suspicious process; if the program corresponding to the first process is a program recorded in the second whitelist, the first process is determined not to be a suspicious process.

[0116] It should be noted that the programs recorded in the second whitelist can be pre-configured by technical personnel. In some embodiments, the second whitelist can also be established through self-learning. For example, parameters such as the application's digital signature, the validity period of the signature, and the application's vendor can be input into the trusted program identification model to determine whether the application is a trusted program. If the application is determined to be a trusted program, it is recorded in the second whitelist.

[0117] It should be noted that the second whitelist and the first whitelist may be the same or different, and this application embodiment does not limit this.

[0118] In some embodiments, if the first process is determined to be a suspicious process, the computer device may also terminate the operation of the first process to protect the data in the computer device from harm.

[0119] Step 302: Based on the target time information, determine the target backup data from multiple backup data. Each backup data is obtained by backing up the data stored in the target storage space of the computer device at a backup time. The multiple backup data correspond one-to-one with the multiple backup times.

[0120] The target backup data is determined from multiple backup data. The backup time of the target backup data is the shortest interval between the backup time and the time when the first process starts running on the computer device, and it is located before the time when the first process starts running on the computer device.

[0121] In addition to determining the backup data corresponding to the backup time that is closest to the start time of the first process in the computer device among multiple backup times as the target backup data, the backup data corresponding to any backup time that is before the start time of the first process in the computer device among multiple backup times can also be determined as the target backup data.

[0122] In some embodiments, the aforementioned multiple backup data are stored locally on the computer device or on another device on the network where the computer device is located.

[0123] It should be noted that storing multiple backup data locally on a computer device means that the multiple backup data are stored in the local storage medium of the computer device. This local storage medium includes internal storage and / or external storage, and the external storage medium can be a storage medium accessed via an I / O interface. For example, the external storage medium can be a hard disk drive (HDD) or a solid-state drive (SSD). Storing multiple backup data on another device on the same network as the computer device means that the multiple backup data are stored in the storage medium of another device, which can communicate with the computer device in this embodiment via a network protocol.

[0124] For example, please refer to Figure 4 , Figure 4 This is a schematic diagram illustrating a network backup method provided in an embodiment of this application. The computer device in this embodiment of the application is... Figure 4 In this setup, host 1 includes disk 1. Before backing up data in the target storage space, the disk of host 2 can be shared with host 1 via block device sharing, such as SAN / iSCSI, so that host 1 can use disk 2 as if it were a local disk. In this case, the target storage space can be part or all of the storage space in disk 1, and multiple backup data can be stored on disk 2. Thus, each backup operation will back up the data in the target storage space to disk 2 of host 2, thereby achieving network-storage linkage.

[0125] Step 303: Based on the target backup data, restore the data stored in the target storage space to a state unaffected by the first process.

[0126] In some embodiments, the computer device runs a third process for data recovery. In this case, the computer device, based on the target backup data and recovery parameters, invokes the third process to restore the data stored in the target storage space to a state unaffected by the first process. The recovery parameters are used to guide the third process in restoring the data stored in the target storage space.

[0127] In one possible implementation, the recovery parameters include second source location information and second target location information, where the second source location information indicates the location where the target backup data is stored and the second target location information indicates the location of the target storage space.

[0128] It should be noted that the target storage space mentioned above can be the storage space corresponding to any target folder on the computer device. In this case, the storage location of the target storage space on the computer device can be the index path of the target folder. The location where the target backup data is stored can be any folder on the computer device. In this case, the location where the target backup data is stored refers to the index path of the folder where the target backup data is stored.

[0129] In some embodiments, based on the target backup data and recovery parameters, a third process is invoked to determine the data stored in the target storage space at the backup time corresponding to the target backup data; the data stored in the target storage space at the backup time is copied to the target storage space by the third process.

[0130] In some embodiments, the third process is the process corresponding to the remote synchronization rsync program. It is understood that the second process and the third process can be the same process or different processes, and this application embodiment does not limit this.

[0131] For example, a computer device can use a recovery statement to call the process corresponding to the rsync program to restore the data stored in the target storage space to a state unaffected by the first process. The recovery statement carries recovery parameters. In some embodiments, the recovery statement can be `rsync -D --numeric-ids --links --hard-links --one-file-system --itemize-changes --times --recursive --perms --owner --group --stats --human-readable ' / backup / 123000 / var / lib / mysql / '`. Here, `' / backup / 123000 / var / lib / mysql / '` is the second source location information, indicating the index path of the folder containing the target backup data as `' / backup / 123000 / var / lib / mysql / '`. `' / var / lib / mysql / '` is the second destination location information, indicating the location (also known as the index path) of the target folder corresponding to the target storage space as `' / var / lib / mysql / '`. For the definitions of other parameters in this recovery statement, please refer to Table 2 above; they will not be elaborated upon here.

[0132] In some embodiments, before a third process is invoked based on the target backup data and recovery parameters to restore the data stored in the target storage space to a state unaffected by the first process, the computer device may also delete the data stored in the target storage space.

[0133] For example, a computer device can use the `rm` command to delete data stored in a target storage space. For instance, if the target storage space corresponds to the folder indicated by the index path ` / var / lib / mysql / `, then the command `rm -rf / var / lib / mysql / ` can be used to delete the data stored in the target storage space.

[0134] In some embodiments, before restoring the data stored in the target storage space to a state unaffected by the first process based on the target backup data, the computer device may also stop the operation of a fourth process, which is the process currently occupying the target storage space.

[0135] In one possible implementation, the computer device can determine the process currently occupying the target storage space, obtain a fourth process, and then stop the execution of the fourth process. It is understood that since the number of processes currently occupying the target storage space can be one or more, the number of the fourth processes can also be one or more.

[0136] For example, the process identifier of the process currently occupying the target storage space can be determined to obtain the process identifier of the fourth process. Based on the process identifier of the fourth process, the service (i.e., the application) corresponding to the fourth process and the status of the service can be determined. If the status of the service corresponding to the fourth process is running, the running of the service corresponding to the fourth process can be stopped to stop the running of the fourth process. The status of the service includes running and stopping.

[0137] In some embodiments, before stopping the fourth process, the computer device can also obtain attribute information of the target backup data, which indicates whether the target backup data is backup data corresponding to the database service. If the target backup data is backup data corresponding to the database service, then the step of stopping the fourth process is executed. If the target backup data is backup data corresponding to the database service, then the data stored in the target storage space is directly restored to a state unaffected by the first process based on the target backup data.

[0138] In this embodiment, if the target backup data is determined to be backup data corresponding to a database service, the execution of the fourth process (i.e., the execution of the program corresponding to the database service) can be stopped. This prevents the database from continuously modifying the data in the target storage space during data recovery, reducing errors and uncertainties in the data recovery process. Furthermore, if the attribute information indicates that the target backup data is not backup data corresponding to a database service, then the target backup data is likely backup data from a regular folder; therefore, subsequent recovery actions can be performed directly.

[0139] It is understandable that the above attribute information is set in advance by technicians for the corresponding backup data based on the actual situation.

[0140] In some embodiments, the process identifier of the fourth process can be a process identifier (pid) or a UUID, and this application embodiment does not limit this.

[0141] For example, the lsof command can be used to determine the process currently occupying the target storage space. For instance, the command lsof+D / var / lib / mysql / can be used to determine the process currently occupying the / var / lib / mysql / folder, and the storage space corresponding to the / var / lib / mysql / folder is the target storage space.

[0142] For example, you can use systemctl status <pid>The command `systemctl status 130734` identifies the service corresponding to the fourth process. For example, if the fourth process's identifier is 130734, the command `systemctl status 130734` can be used to identify the service corresponding to the process with identifier 130734. For example, after issuing the `systemctl status 130734` command, the computer device can return the following result:

[0143] mariadb.service-MariaDB 10.3.34database server

[0144] Loaded:loaded( / lib / systemd / system / mariadb.service; enabled; vendorpreset:enabled)

[0145] Active:active(running)since Thu 2024-10-17 11:49:40 CST; 3 days ago

[0146] Docs:man:mysqld(8)

[0147] https: / / xxxxx.com / kb / en / library / systemd /

[0148] Main PID: 130734 (mysqld)

[0149] Status:"Taking your SQL requests now...

[0150] Tasks: 30 (limit: 18482)

[0151] Memory: 83.2M

[0152] CGroup: / system.slice / mariadb.service

[0153] i30734 / usr / sbin / mysqld

[0154] The `mariadb.service` indicates that this is the MariaDB database service, and `MariaDB 10.3.34` indicates that this is MariaDB version 10.3.34. `loaded( / lib / systemd / system / mariadb.service; enabled; vendor preset: enabled)` indicates that the MariaDB service is loaded and enabled by the system, and the vendor preset is also enabled. `active(running)since Thu 2024-10-17 11:49:40 CST; 3 days ago` means that the MariaDB service has been running since 11:49:40 AM (China Standard Time) on October 17, 2024, and has been running for 3 days. Docs:man:mysqld(8)https: / / xxxxx.com / kb / en / library / systemd / refers to providing two document links: one is the man page man:mysqld(8), and the other is the official MariaDB knowledge base page https: / / mariadb.com / kb / en / library / systemd / . Main PID:130734(mysqld), indicating that the main process ID of MariaDB is 130734 and the process name is mysqld. Status:"Taking your SQL requests now...", this is the current status information of the MariaDB service, indicating that it is accepting SQL requests. Tasks:30(limit:18482), indicating that the MariaDB service currently has 30 tasks running, and the system limit for the number of tasks is 18482. Memory:83.2M, indicating that the MariaDB service is currently using 83.2MB of memory. CGroup: / system.slice / mariadb.service, indicating the control group path of the MariaDB service.

[0155] In some embodiments, the service corresponding to the fourth process mentioned above can be stopped using the command `systemctl stop mariadb.service`.

[0156] In one possible implementation, if the target storage space is the storage space corresponding to the database service, then after restoring the data stored in the target storage space to a state unaffected by the first process based on the target backup data, the program corresponding to the database service can be restarted.

[0157] Since the computer stopped the program corresponding to the database service before data recovery when the target storage space was the storage space corresponding to the database service, the program corresponding to the database service can be restarted after data recovery so that the database can continue to run.

[0158] In some embodiments, the database service is typically set to start automatically on boot. In this case, the program corresponding to the database service can be restarted by restarting the computer.

[0159] The data recovery method provided in the embodiments of this application will be described again below.

[0160] Please refer to Figure 5 , Figure 5 The flowchart illustrates a data recovery method provided in this application embodiment. The administrator sets the time for the first backup. In this case, the EDR software deployed on the computer device performs a full backup for the first backup, and subsequent periodic backups are incremental backups. Responding to a suspicious process running on the computer device, the EDR software sends suspicious event information to the security server. If the security server confirms that the first process is malicious, it sends a data recovery command to the computer device. The EDR software receives the data recovery command and, based on the target time information, determines the target backup data from multiple backup data sets. Based on the target backup data, it restores the data stored in the target storage space to a state unaffected by the first process. After the recovery is complete, the result is reported to the security server.

[0161] Finally, the data recovery method provided in the embodiments of this application will be explained again in conjunction with the functions of EDR software.

[0162] Please refer to Figure 6 , Figure 6 This is a functional diagram of EDR software provided in an embodiment of this application. The EDR software deployed in a computer device can back up data in the data area (i.e., the area where the data to be backed up is located) of the computer device by calling rsync software, thereby obtaining backup data. The data area includes data corresponding to the database service and ordinary files. If the first process is determined to be a suspicious process, suspicious event information is reported to the security server. It can also receive data recovery instructions issued by the security server, and then, based on target time information, determine the target backup data from multiple backup data sets. Based on the target backup data, the data stored in the target storage space is restored to a state unaffected by the first process.

[0163] System security monitoring is achieved by monitoring whether a suspicious process is running on the first computer device. If the first process is determined to be suspicious, target backup data can be identified from multiple backup data sets based on target time information, and then the data stored in the target storage space can be restored based on the target backup data. Since the target time information characterizes the moment the first process started running on the computer device, the point in time when the data might have begun to be corrupted can be accurately located based on the target time information. In this case, based on the target time information, backup data that started running before the suspicious process (i.e., the target backup data) can be selected from multiple backup data sets to ensure that the data subsequently restored based on the target backup data is unaffected by the first process. In other words, even if the data stored in the target storage space is damaged after the first process runs, this embodiment of the application can use the target backup data to restore the data in the target storage space to a state unaffected by the first process, thereby protecting the integrity and availability of the data.

[0164] Figure 7 This is a schematic diagram of a data recovery device provided in an embodiment of this application. The data recovery device can be implemented as part or all of the aforementioned computer equipment by means of software, hardware, or a combination of both. See also... Figure 7 The device includes: a first determining module 701, a second determining module 702, and a recovery module 703.

[0165] The first determination module 701 is used to determine target time information in response to the first process running in the computer device being identified as a suspicious process. The target time information describes the time when the first process started running in the computer device. For detailed implementation details, please refer to the corresponding content in the above embodiments, which will not be repeated here.

[0166] The second determining module 702 is used to determine the target backup data from multiple backup data based on the target time information. Each backup data is obtained by backing up the data stored in the target storage space of the computer device at a backup time, and the multiple backup data correspond one-to-one with the multiple backup times. For detailed implementation process, please refer to the corresponding content in the above embodiments, which will not be repeated here.

[0167] The recovery module 703 is used to restore the data stored in the target storage space to a state unaffected by the first process, based on the target backup data. For detailed implementation details, please refer to the corresponding content in the above embodiments; they will not be repeated here.

[0168] In one possible implementation, the computer device runs a second process for backing up the data;

[0169] The device also includes:

[0170] The backup module is used to call a second process to back up the data stored in the target storage space based on backup parameters, and obtain the backup data corresponding to the target backup time. The target backup time is one of multiple backup times, and the backup parameters are used to guide the second process to back up the data stored in the target storage space.

[0171] In one possible implementation, the backup parameters include first source location information and first target location information. The first source location information indicates the storage location of the target storage space on the computer device, and the first target location information indicates the storage location of the backup storage space. The backup storage space is used to store the backup data corresponding to the target backup time.

[0172] In one possible implementation, the target backup time is a backup time other than the first one among multiple backup times, and the backup parameters also include indication information of the reference data, which is the data stored in the target storage space at any time before the target backup time among multiple backup times.

[0173] The backup module is specifically used for:

[0174] Based on the indication information of the baseline data, the second process is invoked to determine the incremental backup data corresponding to the target backup time. The incremental backup data is the data that differs between the data stored in the target storage space and the baseline data at the target backup time.

[0175] The second process stores the incremental backup data corresponding to the target backup time into the backup storage space, thus obtaining the backup data corresponding to the target backup time. The backup storage space is used to store the backup data corresponding to the target backup time.

[0176] In one possible implementation, the first determining module is specifically used for:

[0177] Based on the process identifier of the first process, the target time information is determined from the correspondence between the process identifier and the time information.

[0178] In one possible implementation, the first determining module is specifically used for:

[0179] Send suspicious event information to the security server. The suspicious event information is used to indicate that the first process is a suspicious process.

[0180] The system receives a data recovery command from the security server. The data recovery command instructs the computer device to recover data from the target storage space. The data recovery command is triggered by the security server when it confirms that the first process is a malicious process.

[0181] In one possible implementation, the second determining module is specifically used for:

[0182] The target backup data is determined from multiple backup data. The backup time of the target backup data is the shortest interval between the backup time and the time when the first process starts running on the computer device, and it is located before the time when the first process starts running on the computer device.

[0183] In one possible implementation, the computer device runs a third process for data recovery;

[0184] The recovery module is specifically used for:

[0185] Based on the target backup data and recovery parameters, a third process is invoked to restore the data stored in the target storage space to a state unaffected by the first process. The recovery parameters are used to guide the third process in restoring the data stored in the target storage space.

[0186] In one possible implementation, the recovery parameters include second source location information and second target location information, where the second source location information indicates the location where the target backup data is stored and the second target location information indicates the location of the target storage space.

[0187] In one possible implementation, the recovery module is specifically used for:

[0188] Based on the target backup data and recovery parameters, a third process is invoked to determine the data stored in the target storage space at the backup time corresponding to the target backup data.

[0189] The third process copies the data stored in the target storage space at the time of the target backup to the target storage space.

[0190] In one possible implementation, both the second and third processes are processes corresponding to the remote synchronization rsync program.

[0191] In one possible implementation, the recovery module is specifically used for:

[0192] Stop the execution of the fourth process, which is currently occupying the target storage space.

[0193] In one possible implementation, the fourth process is the process that supports the operation of the database service.

[0194] In one possible implementation, multiple backup data are stored locally on the computer device or on another device on the same network as the computer device.

[0195] In one possible implementation, the operating system of the computer device is the Linux operating system.

[0196] In this embodiment, system security is monitored by checking whether a suspicious process is running on the first computer device. If the first process is determined to be suspicious, target backup data can be identified from multiple backup data sets based on target time information. Then, data stored in the target storage space can be restored based on the target backup data. Since the target time information characterizes the moment the first process begins running on the computer device, the point in time when the data may have begun to be corrupted can be accurately located. In this case, based on the target time information, backup data that started running before the suspicious process (i.e., the target backup data) can be selected from multiple backup data sets to ensure that the data subsequently restored based on the target backup data is unaffected by the first process. In other words, even if the data stored in the target storage space is damaged after the first process runs, this embodiment can use the target backup data to restore the data in the target storage space to a state unaffected by the first process, thereby protecting the integrity and availability of the data.

[0197] It should be noted that the data recovery device provided in the above embodiments is only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the data recovery device and the data recovery method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0198] This application also provides a computer-readable storage medium storing instructions that, when executed on a computer or processor, cause the computer or processor to perform the steps of the data recovery method described in the above embodiments.

[0199] This application also provides a computer program product containing instructions that, when executed on a computer or processor, cause the computer or processor to perform the steps of the data recovery method described in the above embodiments. Alternatively, a computer program is provided that, when executed on a computer or processor, causes the computer or processor to perform the steps of the data recovery method described in the above embodiments.

[0200] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer, or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., digital versatile disc (DVD)), or a semiconductor medium (e.g., solid state disk (SSD)). It is worth noting that the computer-readable storage medium mentioned in the embodiments of this application can be a non-volatile storage medium; in other words, it can be a non-transient storage medium.

[0201] It should be understood that "multiple" as mentioned herein refers to two or more. In the description of the embodiments of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B; "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. In addition, in order to clearly describe the technical solutions of the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish identical or similar items with substantially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and the terms "first" and "second" are not necessarily different.

[0202] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in the embodiments of this application are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the target time information and multiple backup data involved in the embodiments of this application were obtained with full authorization.

[0203] The above descriptions are embodiments provided in this application and are not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.< / pid>

Claims

1. A data recovery method, characterized in that, Applied to a computer device, the method includes: In response to the fact that a first process running in the computer device is a suspicious process, target time information is determined, which describes the time when the first process started running in the computer device; Based on the target time information, target backup data is determined from multiple backup data. Each of the multiple backup data is obtained by backing up the data stored in the target storage space of the computer device at a backup time. The multiple backup data correspond one-to-one with the multiple backup times. Based on the target backup data, the data stored in the target storage space is restored to a state unaffected by the first process.

2. The method as described in claim 1, characterized in that, The computer device runs a second process, which is used to back up data; Before determining the target time information, the method further includes: Based on the backup parameters, the second process is invoked to back up the data stored in the target storage space, and the backup data corresponding to the target backup time is obtained. The target backup time is one of the multiple backup times. The backup parameters are used to guide the second process to back up the data stored in the target storage space.

3. The method as described in claim 2, characterized in that, The backup parameters include first source location information and first target location information. The first source location information indicates the storage location of the target storage space on the computer device, and the first target location information indicates the storage location of the backup storage space. The backup storage space is used to store the backup data corresponding to the target backup time.

4. The method as described in claim 2 or 3, characterized in that, The target backup time is any backup time other than the first one among the plurality of backup times. The backup parameters also include indication information of the reference data, which is the data stored in the target storage space at any one of the plurality of backup times that is before the target backup time. The step of invoking the second process to back up the data stored in the target storage space based on backup parameters, and obtaining the backup data corresponding to the target backup time, includes: Based on the indication information of the baseline data, the second process is invoked to determine the incremental backup data corresponding to the target backup time. The incremental backup data is the data that differs between the data stored in the target storage space at the target backup time and the baseline data. The incremental backup data corresponding to the target backup time is stored in the backup storage space through the second process to obtain the backup data corresponding to the target backup time. The backup storage space is used to store the backup data corresponding to the target backup time.

5. The method according to any one of claims 1-4, wherein determining the target time information includes: Based on the process identifier of the first process, the target time information is determined from the correspondence between the process identifier and the time information.

6. The method according to any one of claims 1-5, characterized in that, Before determining the target time information, the method further includes: Send suspicious event information to the security server, wherein the suspicious event information is used to indicate that the first process is a suspicious process; The system receives a data recovery instruction sent by the security server. The data recovery instruction instructs the computer device to recover data from the target storage space. The data recovery instruction is triggered by the security server when it confirms that the first process is a malicious process.

7. The method according to any one of claims 1-6, characterized in that, The step of determining the target backup data from multiple backup data based on the target time information includes: The target backup data is determined from the plurality of backup data, wherein the interval between the backup time of the target backup data and the time when the first process starts running in the computer device is the smallest, and is located before the time when the first process starts running in the computer device.

8. The method according to any one of claims 1-7, characterized in that, The computer device runs a third process, which is used to recover data; The step of restoring the data stored in the target storage space to a state unaffected by the first process based on the target backup data includes: Based on the target backup data and recovery parameters, the third process is invoked to restore the data stored in the target storage space to a state unaffected by the first process. The recovery parameters are used to guide the third process to restore the data stored in the target storage space.

9. The method as described in claim 8, characterized in that, The recovery parameters include second source location information and second target location information. The second source location information indicates the location where the target backup data is stored, and the second target location information indicates the location of the target storage space.

10. The method as described in claim 8 or 9, characterized in that, The step of invoking the third process based on the target backup data and recovery parameters to restore the data stored in the target storage space to a state unaffected by the first process includes: Based on the target backup data and the recovery parameters, the third process is invoked to determine the data stored in the target storage space at the backup time corresponding to the target backup data; The third process copies the data stored in the target storage space at the target backup time to the target storage space.

11. The method according to any one of claims 2-4 and 8-10, characterized in that, The second process and the third process are both processes corresponding to the remote synchronization rsync program.

12. The method according to any one of claims 1-11, characterized in that, Before restoring the data stored in the target storage space to a state unaffected by the first process based on the target backup data, the method further includes: Stop the execution of the fourth process, which is the process currently occupying the target storage space.

13. The method as described in claim 12, characterized in that, The fourth process is the process that supports the operation of the database service.

14. The method according to any one of claims 1-13, characterized in that, The multiple backup data are stored locally on the computer device or on another device on the network where the computer device is located.

15. The method according to any one of claims 1-14, characterized in that, The operating system of the computer device is Linux.

16. A data recovery device, characterized in that, Applied to computer equipment, the device includes: A first determining module is configured to determine target time information in response to a first process running in the computer device being a suspicious process, the target time information being used to describe the time when the first process started running in the computer device; The second determining module is used to determine target backup data from multiple backup data based on the target time information. Each backup data is obtained by backing up the data stored in the target storage space of the computer device at a backup time. The multiple backup data correspond one-to-one with the multiple backup times. The recovery module is used to restore the data stored in the target storage space to a state unaffected by the first process, based on the target backup data.

17. A computer device, characterized in that, The computer device includes a memory and a processor; The memory is used to store computer programs; The processor is configured to execute the computer program to implement the steps of the method according to any one of claims 1 to 15.

18. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed on a computer or processor, causes the computer or processor to perform the method as described in any one of claims 1 to 15.

19. A computer program product, characterized in that, The computer program product includes computer instructions that, when executed by a computer or processor, cause the steps of the method as described in any one of claims 1 to 15 to be performed.

Images