Method and system for recovering from a malware attack

Abstract

A method of recovering from a malware attack, the method comprising steps executed by a computing circuitry, the steps comprising: receiving a plurality of data sets and at least one log, the data sets generated at respective points of a time period between generation of an earliest one and generation of a latest one of the data sets, the at least one log recording a plurality of operations performed on a computing device during the time period, determining an earliest sub-period of the attack within the time period, using the at least one log and according to a predefined criterion, and using at least one of the data sets preceding the determined sub-period, for recovering data of the computing device.

Description

[0001] METHOD AND SYSTEM FOR RECOVERING FROM A MALWARE ATTACK

[0002] FIELD AND BACKGROUND OF THE INVENTION

[0003] The present invention relates to computer malware attacks and, more particularly, but not exclusively to a method and a system for recovering from a malware attack.

[0004] Malicious software also referred to as Malware, is a term that refers to any software designed to infiltrate and / or damage a computing device (say a desktop computer, a laptop computer, a tablet computer, a server computer, etc.) without informed consent of the owner or operator of the computing device. Malware may include, but is not limited to: viruses, worms, trojan horses, spyware, and any other malicious and unwanted software, as known in the art.

[0005] For example, ransomware is malware that employs encryption to hold a victim’s information stored on a computing device attacked using the ransomware, at ransom. In the ransomware attack, the information is encrypted so that the owner or operator of the computing device cannot access files, databases, or applications on the computing device. A ransom is then demanded by the attacker.

[0006] Ransomware usually uses asymmetric encryption. Asymmetric encryption is cryptography that uses a pair of keys to encrypt and decrypt a file. The public-private pair of keys is uniquely generated by the attacker for the victim, with the private key to decrypt the files stored on the attacker’s server. The attacker makes the private key available to the victim only after the ransom is paid. Usually, without access to the private key, it is impossible to decrypt the files that are being held for ransom.

[0007] Many variations of ransomware exist. Often ransomware is distributed using email spam campaigns or through targeted attacks. Malware needs an attack vector to establish its presence on an endpoint. After presence is established, malware stays on the system until its task is accomplished.

[0008] After receipt by a computing device, ransomware drops and executes a malicious code on the infected computing device. The malicious code then searches and encrypts valuable files, such as Microsoft Word documents, images, databases, and so on. The ransomware may also exploit system and network vulnerabilities to spread to other computing devices and possibly across entire organizations.

[0009] Usually, once files are encrypted by the ransomware, the ransomware prompts the victim for a ransom to be paid, or they will be lost forever. If no data backup is available, the victim usually pays the ransom to recover the information held by the attacker using the ransomware.

[0010] Ransomware and other malware attacks have become a growing threat that generates huge damages to businesses and governmental organizations.

[0011] SUMMARY OF THE INVENTION

[0012] According to one aspect of the present invention, there is provided a method of recovering from a malware attack, the method comprising steps executed by a computing circuitry, the steps comprising: receiving a plurality of data sets and at least one log, the data sets generated at respective points of a time period between generation of an earliest one and generation of a latest one of the data sets, the at least one log recording a plurality of operations performed on a computing device during the time period, determining an earliest sub-period of the attack within the time period, using the at least one log and according to a predefined criterion, and using at least one of the data sets preceding the determined sub-period, for recovering data of the computing device.

[0013] According to a second aspect of the present invention, there is provided a system for recovering from a malware attack, the system comprising: a processing circuitry, and a memory in communication with the processing circuitry, the memory containing instructions that, when executed by the processing circuitry, cause the system to: receive a plurality of data sets and at least one log, the data sets generated at respective points of a time period between generation of an earliest one and generation of a latest one of the data sets, the at least one log recording a plurality of operations performed on a computing device during the time period, determine an earliest sub-period of the attack within the time period, using the at least one log and according to a predefined criterion, and use at least one of the data sets preceding the determined subperiod, for recovering data of the computing device.

[0014] According to a third aspect of the present invention, there is provided a computer program for recovering from a malware attack, the computer program comprising program instructions which, when executed by at least one processor, cause the at least one processor to: receive a plurality of data sets and at least one log, the first files generated at respective points of a time period between generation of an earliest one and generation of a latest one of the data sets, the at least one log recording a plurality of operations performed on a computing device during the time period, determine an earliest sub-period of the attack within the time period, using the at least one log and according to a predefined criterion, and use at least one of the data sets preceding the determined sub-period, for recovering data of the computing device.

[0015] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. The materials, methods, and examples provided herein are illustrative only and not intended to be limiting.

[0016] Implementation of the method and system of the present invention involves performing or completing certain selected tasks or steps manually, automatically, or a combination thereof. Moreover, according to actual instrumentation and equipment of preferred embodiments of the method and system of the present invention, several selected steps could be implemented by hardware or by software on any operating system of any firmware or a combination thereof.

[0017] For example, as hardware, selected steps of the invention could be implemented as a chip or a circuit. As software, selected steps of the invention could be implemented as a plurality of software instructions being executed by a computer using any suitable operating system. In any case, selected steps of the method and system of the invention could be described as being performed by a data processor, such as a computing platform for executing a plurality of instructions.

[0018] BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

[0019] The invention is herein described, by way of example only, with reference to the accompanying drawings. With specific reference now to the drawings in detail, it is stressed that the particulars shown are by way of example and for purposes of illustrative discussion of the preferred embodiments of the present invention only, and are presented in order to provide what is believed to be the most useful and readily understood description of the principles and conceptual aspects of the invention. The description taken with the drawings making apparent to those skilled in the art how the several forms of the invention may be embodied in practice. In the drawings:

[0020] Fig. 1A is a first simplified block diagram schematically illustrating an exemplary system for recovering from a malware attack, according to an exemplary embodiment of the present invention.

[0021] Fig. IB is a second simplified block diagram schematically illustrating an exemplary system for recovering from a malware attack, according to an exemplary embodiment of the present invention.

[0022] Fig- 2 is a flowchart schematically illustrating an exemplary method of recovering from a malware attack, according to an exemplary embodiment of the present invention.

[0023] Fig- 3 is a simplified block diagram schematically illustrating an exemplary implementation scenario of recovering from a malware attack, according to an exemplary embodiment of the present invention.

[0024] Fig- 4 is a simplified block diagram schematically illustrating an exemplary non- transitory computer readable medium having stored thereon, instructions of a computer program for causing a processing circuitry to perform a process of recovering from a malware attack, according to an exemplary embodiment of the present invention.

[0025] DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0026] The present embodiments comprise a method and a system for recovering from a malware attack.

[0027] Ransomware and other malware attacks have become a growing threat that generates huge damages to businesses and governmental organizations.

[0028] For example, ransomware is malware that employs encryption to hold a victim’s information stored on a computing device attacked using the ransomware, at ransom. In the ransomware attack, the information is encrypted so that the owner or operator of the computing device cannot access files, databases, or applications on the computing device. A ransom is then demanded, as described in further detail hereinabove.

[0029] Usually, once a victim’s files are encrypted by the ransomware, the ransomware prompts the victim for a ransom to be paid, or they will be lost forever. If no form of data recovery is available, the victim is usually left with one option only - namely, that of paying the ransom to recover the information held by the attacker using the ransomware.

[0030] Ransomware and other malware are designed to infect a computing device and remain undetected until the ransomware achieves its malicious objective, so that the victim becomes aware of the infection only after the ransomware prompts the victim for the ransom to be paid or the other malware inflicts the damage on the computing device.

[0031] The computing device may be included one or more server(s) - say a NAS (Network Attached Storage), a laptop computer, a desktop computer, an industrial computing device, etc., or any combination thereof, as described in further detail hereinbelow.

[0032] As a result, even when the victim implements a data recovery and backup method (say a one based on data sets such as the sets of tables and / or data files that represent snapshots of data stored on the computing device, say on snapshots that include data of the computing device’s directories, data, and / or entire file systems, etc., as known in the art), the victim does not know since when exactly has the malware infected the computing device.

[0033] Indeed, with currently implemented data recovery methods, the point at which the malware attack started is not easy to determine.

[0034] As a result, a selection of a data set (say a snapshot of a file system) to be used for recovering (say of a set of data that makes up one of the snapshots of a NAS) is usually very challenging and time consuming.

[0035] For example, recovering using a snapshot taken at a too early time before the computing device is inflicted with the malware, may result in unnecessary loss of important data, whereas, a snapshot taken after the computing device is inflicted with the malware, may include data that is already inflicted with the malware.

[0036] Potentially, with an exemplary method of the present invention, the point in time at which the malware attack starts, may be determined in a faster and more accurate manner.

[0037] As a result, the loss of important information due to a recovery made using a snapshot taken at a too early time before the infliction with the malware and / or the inclusion of data already inflicted with the malware due to the use of a snapshot taken after the computing device is already inflicted with the malware, is likely to be avoided. In an exemplary embodiment of the present invention, an exemplary method of recovering from a malware attack is carried out, by receiving two or more data sets and at least one log, as described in further detail hereinbelow.

[0038] Optionally, the data sets are snapshot data that represents the file system’s directories, data, and / or the entire file system at different times of data backup, and each one of the data sets is a collection of data that indicate a snapshot of data stored on the computing device (say of the file system) at the time of generation of the data set.

[0039] Each snapshot preserves the state and content of the data stored on the computing device (say the file system) at a specific point in time, as known in the art.

[0040] Optionally, the data sets are rather backup files that store data held on the computing device when the backup files are generated, images of the computing device’s disk, images of the computing device’s virtual disk, etc., or any combination thereof, as known in the art.

[0041] The data sets are generated at respective points of a time period between generation of an earliest one and generation of a latest one of the data sets, and the log records a plurality of operations performed on the computer, say on a file system of the computing device, during the time period.

[0042] Thus, in one example, one data set is a snapshot of data of the computing device’s file system (say a file system of a NAS device) at 12: 10 AM, a second data set is a snapshot of data of the computing device’s file system at 12:20 AM, a third data set is a snapshot of data of the computing device’s file system at 12:30, and so on and so forth.

[0043] Accordingly, in the example, the number of data sets may reach several hundreds and even thousands of data sets (say snapshots), which with hitherto used methods, would need to be searched in linearly, when trying to recover data damaged, deleted, or otherwise effected by malware.

[0044] The log holds operations performed on the computing device (say on the computing device’s file system) during the time period between the generation of an earliest one of the data sets and the generation of a latest one of the data sets.

[0045] In one example, the exemplary method uses a CDP (Continuous Data Protection) system, the above mentioned data sets hold the snapshot(s) of a file system of the computing device, and the above mentioned log is one or more of the CDP system’s logs or / or journals, say a file that records the operations made on the computing device (say on the computing device’s file system), as described in further detail hereinbelow.

[0046] Optionally, the log further holds operations performed on the computing device (say on the NAS device) after the generation of the latest one (or only one) of the data sets, operations performed on the computing device before the generation of the earliest one of the data sets, or both.

[0047] That is to say that optionally, the log holds operations performed on the computing device (say changes made to the file system of the NAS device) through a time period that is longer though from, though overlapping, the time period between generation of the earliest data set and the latest data set.

[0048] Next in the exemplary method, there is determined an earliest sub-period of the attack within the time period, thus estimating the attack start time, using the at least one log and according to a predefined criterion.

[0049] Optionally, in the method, the earliest sub-period of the attack is determined by carrying out a binary search for the sub-period on the log.

[0050] The sub-period corresponds to at least one of the operations performed on the computing device during the time period and recorded in the log, as described in further detail hereinbelow.

[0051] For example, in the above made example, instead of searching linearly through hundreds or thousands of files and / or snapshots of computing device file’s system, so as to determine the start time of the attack, there is carried out a binary search on the log (say the log that records the changes made to the file system of the NAS device), as described in further detail hereinbelow.

[0052] As known in art, a binary search is a search that attempts to find a target element (or a set of target elements) within a sorted group - say to find one or more operations amongst operations recorded in the log and arranged in an order of operation occurrence, by searching in a sequence of operations that spans one half (or nearly half) of the group (say log).

[0053] Optionally, the binary search rather searches only in a part (i.e. a subsequence) of the sequence of operations that spans the half (or nearly half) of the log, say a starting part of the sequence, say a starting part that has a size pre-selected by a programmer or operator, as described in further detail hereinbelow. The binary search continues, through a number of additional iterations. In each one of the iterations the search is narrowed by half (or near half), to a smaller sequence of the operations, and the search continues as above, until the target element(s) is (are) found, as described in further detail hereinbelow.

[0054] Then, data (say one or more files) of the computing device is recovered using at least one of the data sets that precede the determined sub-period, say the latest one of the data sets that precede the determined sub-period, as described in further detail hereinbelow.

[0055] Thus, in one example, every two minutes, there is generated a data set that makes up a snapshot of the data as stored on the computing device when the data set is generated. Further, in the example, a CDP system continuously records all operations performed on the computing device (say on the file system) in a log, as described in further detail hereinbelow.

[0056] In the example, after receiving a ransom request from a hacker who launches a ransomware attack, a user of the computing device initiates a file recovery operation by a system according to an exemplary embodiment of the present invention, as described in further detail hereinbelow.

[0057] In the example, the exemplary system carries out a binary search on the log of the CDP system, to determine the earliest sub-period of the attack within the time period between the at least one earliest one and at least one latest one of the data sets, using the at least one log and according to at least one predefined criterion, as described in further detail hereinbelow.

[0058] Optionally, the criterion is defined in advance of the recovery, say as a part of a set-up of the exemplary system by an operator of the exemplary system, or as a part of a computer code of the exemplary system, as encoded by a computer programmer.

[0059] Optionally, the criterion is based on known characteristics of the ransomware (or other malware) attack, say on the type of files effected by the operations recorded in the log, on the order in which files are affected by the malware, etc., as described in further detail hereinbelow.

[0060] Thus, in one example, the binary search detects the first sub-period in which a file traversal order characteristic of the malware appears.

[0061] In another example, the binary search detects the sub-period based on a deviation of the entropy of writes from expected entropy values, say from values that are a part of metadata generated on the log, as described in further detail hereinbelow. Optionally, the determination of the earliest sub-period of the attack is additionally or alternatively, based on metadata generated on data that accumulates in the log, say on the number of delete operations per each small unit of time (say minute) of the log, on the number of file name extension changes per the time unit, on the entropy of writes per the time unit, etc., as described in further detail hereinbelow.

[0062] The metadata may be generated in real time of the operations, retroactively (say when file recovery is requested by a user of the computing device), or partially in real time and partially retroactively, as described in further detail hereinbelow.

[0063] Optionally, the metadata is stored in a dedicated data structure, say in a relational database table, as described in further detail hereinbelow.

[0064] The principles and operation of a method and a system according to the present invention may be better understood with reference to the drawings and accompanying description.

[0065] Before explaining at least one embodiment of the invention in detail, it is to be understood that the invention is not limited in its application to the details of construction and the arrangement of the components set forth in the following description or illustrated in the drawings.

[0066] The invention is capable of other embodiments or of being practiced or carried out in various ways. Also, it is to be understood that the phraseology and terminology employed herein is for the purpose of description and should not be regarded as limiting.

[0067] Reference is now made to Fig. 1, which is a simplified block diagram schematically illustrating an exemplary system for recovering from a malware attack, according to an exemplary embodiment of the present invention.

[0068] A system 1000 for recovering from a malware attack, according to an exemplary embodiment of the present invention, may be implemented using electric circuits, computer software, computer hardware, etc., or any combination thereof.

[0069] Optionally, the system 1000 is implemented on a computer, say on a computer server, on a laptop computer, on a desktop computer, on a computer in control of certain machinery or other equipment, on another computer, etc., or any combination thereof, as described in further detail hereinabove. The computer may be a single computer, a group of computers in communication over a network, a computing circuitry that includes one or more electric circuits, a computer processor, a computer memory, etc., or any combination thereof, as described in further detail hereinbelow.

[0070] Optionally, the computer is actually one or more computers, say one or more server computers of an organization, one or more computers that provide a data backup and recovery service to one or more parties, etc., as described in further detail hereinbelow.

[0071] In a first example, the service is implemented on a computer (say a server computer) of a specific organization, say on a computer that is also used by the specific organization for the organization’s own data recovery needs, as described in further detail hereinbelow.

[0072] In a second example, the computer (say a server computer) is a computer that provides the service to two or more organizations, say to different companies, government agencies, etc., as described in further detail hereinbelow.

[0073] Optionally, the system 1000 includes one or more electric circuits, say a circuit that includes one or more computer processor(s) 101 and at least one computer memory 102, say one or more circuits of a computer or circuits of two or more computers.

[0074] The computer memory 102 may include, but is not limited to: a Micro SD (Secure Digital) Card, a CD-ROM, a USB-Memory, a Hard Disk Drive (HDD), a Solid State Drive (SSD), a computer’s ROM chip, an SRAM (Static Random Access Memory), a DRAM (Dynamic Random Access Memory) or other RAM (Random Access Memory) component, a cache memory component of a computer processor, etc., or any combination thereof, as known in the art.

[0075] The at least one computer memory 102 stores instructions that are executable by the at least one computer processor 101, other parts of the circuitry, or both, for causing the system 1000 to perform the steps of the exemplary method described in further detail and illustrated using Fig. 2 hereinbelow.

[0076] In one exemplary embodiment, the computer processor 101 is programmed to perform the instructions, and thereby to implement one or more additional parts (say modules) of the system 1000, say parts 111-113, as described in further detail hereinbelow. Optionally, one or more of the parts 111-113 is rather implemented as one or more electric circuits (say a logic circuit), or rather as combination of one or more electric circuits and the computer processor 101.

[0077] Each one of parts 111-113 may thus be implemented as software - say by programming the computer processor(s) 101 to execute at least a part of the exemplary method described in further detail hereinbelow, as hardware - say as one or more hardware part of the electric circuit(s) that execute(s) at least a part of the exemplary method, etc., or any combination thereof.

[0078] The system 1000 includes a data receiver 111.

[0079] The data receiver 111 receives two or more data sets and at least one log, as described in further detail hereinabove.

[0080] Optionally, the data sets are snapshots of a NAS device.

[0081] Each snapshot preserves the state and content of the data stored on the computing device (say the file system) at a specific point in time, as known in the art.

[0082] Optionally, the data sets are rather backup files that store data held on the computing device when the backup files are generated, images of the computing device’s disk, images of the computing device’s virtual disk, etc., or any combination thereof, as known in the art.

[0083] The data sets are generated at respective time points of a time period between generation of an earliest one and generation of a latest one of the data sets, for backing up information (say files and applications) that is stored on a computing device, as described in further detail hereinbelow.

[0084] In one example, the data sets are snapshots of a file system of the computing device (say the file system’s directories, data, and / or the entire file system) at different times of data backup, as described in further detail hereinbelow.

[0085] The computing device may include one or more server(s) - say a NAS (Network Attached Storage), a laptop computer, a desktop computer, an industrial computing device, etc., or any combination thereof, as described in further detail hereinbelow.

[0086] With reference made to Fig- IB, it is noted that optionally, the computing device is a NAS device 1200. The NAS device 1200 provides storage services to one or more servers (or other) computers 1201-1205 that are networked to the NAS device 1200, as known in the art.

[0087] Optionally, the NAS device 1200 further provides data recovery services that are based on snapshots, using system 1000 and according the exemplary method described in further detail hereinbelow and illustrated using Fig. 2.

[0088] Optionally, system 1000 is implemented on the NAS device itself 1200, as described in further detail hereinbelow.

[0089] Returning to Fig. 1A, it is noted that in one example, the computing device is one of several computers used by an organization that also operates the system 1000 on a server computer that implements a backup and recovery service based on the exemplary system 1000, which service is thus implemented internally by the organization.

[0090] In a second example, the system 1000 is operated by a party (say organization) that provides a backup and recovery service based on the exemplary system 1000 to two or more organizations, say in a Software-as-a-Service (SaaS) model, for computing devices that belong to different ones of the organizations.

[0091] Optionally, the log holds operation performed on the computing device during the time period between the generation of an earliest one of the data sets and the generation of a latest one of the data sets, as described in further detail hereinbelow.

[0092] In one example, the exemplary method uses (or is a part of) a CDP (Continuous Data Protection) system.

[0093] In the example, the received data sets make up snapshots of the computing device’s files system, and the above mentioned log is one or more of the CDP system’s logs or journals, say a file that records the operations performed on the computing device (say changes made to the computing device’s file system), as described in further detail hereinbelow.

[0094] Optionally, the log further records operations performed on the computing device after the generation of the latest one (or only one) of the data sets, operations performed on the computing device before the generation of the earliest one of the data sets, or both.

[0095] That is to say that optionally, the log records operations performed on computing device (say on the computing device’s file system) through a time period that is longer than, though overlapping to, the time period between generation of the earliest data set and the latest data set.

[0096] The system 1000 further includes a time period determiner 112, in communication with the data receiver 111.

[0097] The time period determiner 112 determines an earliest sub-period of the malware attack within the time period, using the one or more logs and according to a predefined criterion, thus estimating the time of start of the attack, as described in further detail hereinabove.

[0098] Optionally, the time period determiner 112 determines the earliest sub-period of the attack, by carrying out a binary search for the sub-period on the at least one log, and the subperiod corresponds to at least one of the operations performed on the computing device during the time period and recorded in the log, as described in further detail hereinbelow.

[0099] Thus, in one example, instead of searching linearly through (potentially) thousands of files and / or snapshots of the computing device’s file system, so as to determine the start time of the attack, there is carried out a binary search on the log, as described in further detail hereinabove.

[0100] The binary search aims at finding in the log, the first operation that is carried out by the malware (say ransomware), or the group that is a sequence of operations that includes the first operation carried out by the malware, as described in further detail hereinbelow.

[0101] Optionally, the data receiver 111 further receives data that is indicative of a time of occurrence of the malware attack (say a time of receipt of the ransom demand as indicated by user input that reports on occurrence of the attack using the received data), and the time period determiner’s 112 determining of the sub-period of the malware attack is further based on the time of occurrence of the malware attack that the data received (say from the user) is indicative of.

[0102] Thus, in one example, the time period determiner 112 carries out the binary search only on received logs that include operations performed on the computing device (say on the file system) before the time of the ransom demand as indicated by the data received from the user.

[0103] Optionally, the data receiver 111 rather receives data that is indicative of a time of occurrence of the malware attack, from another part of the system 1000, say from a part that identifies the suspicious activity (say a one the identifies a malware attempt to delete certain system files).

[0104] The system 1000 further includes a file recoverer 113, in communication with the time period determiner 112.

[0105] The file recoverer 113 recovers data (say at least one file) of the computing device, using at least one of the data sets that precede the determined sub-period, say using the latest one of the data sets that precede the sub-period determined by the time period determiner 112, as described in further detail hereinbelow.

[0106] Thus, in one example, every few minutes of hours (say every ten minutes), there is generated, say by a process that continuously runs on the computing device, a new data set, say a snapshot of the data as already stored on the computing device in the data set’s time of generation (say a snapshot of the computing device’s file system), as described in further detail hereinbelow.

[0107] Also the example, a CDP system continuously records all operations performed on the computing device in a log, as described in further detail hereinbelow.

[0108] In the example, after receiving a ransom request from a hacker who launches a ransomware attack, a user of the system 1000 initiates a file recovery operation by exemplary system 1000, as described in further detail hereinbelow.

[0109] In the example, the time period determiner 112 carries out a binary search on the log of the CDP system, so as to determine the earliest sub-period of the attack within the time period between the earliest one and latest one of the data sets, using the at least one log and according to at least one predefined criterion, as described in further detail hereinabove.

[0110] Optionally, the criterion is defined in advance of the recovery, say as a part of a set-up of the exemplary system 1000 by an operator of the exemplary system 1000, or as a part of a computer code of the exemplary system 1000, as created by a computer programmer.

[0111] Optionally, the criterion is based on one or more characteristics of the ransomware (or other malware) attack, as known in advance, say on the type of files effected by the operations recorded in the log, on the order in which files are affected by the malware, on names of folders created by the malware, etc., as described in further detail hereinbelow. Thus, in one example, one of criterion is that in the attack, files are modified in a file traversal order characteristic of a specific malware.

[0112] Thus, in one case, according to the criterion, the file traversal starts with files that have one specific type of file extension (say the .jpg file extension), continues with files that have a second specific type of file extension (say .gif), and then continues with files that have a third specific type of file extension (say .mp4).

[0113] Accordingly, in the first example, the binary search aims at finding the first sub-period in which such a file traversal order takes place, as described in further detail hereinbelow.

[0114] In a second example, the criterion is that in the attack, there are created file folders with a specific name or with a name that complies with a specific name convention, say folders with names that contain the ‘rsv2023’ character string followed by nine digits, folders with names that end with the ‘nzt2323’ character string, etc.

[0115] Accordingly, in the second example, the binary search aims at finding the first subperiod in which such file folder names appear in the log.

[0116] Optionally, the data receiver 111 further receives data that is indicative of a time of occurrence of the malware attack (say a time of receipt of the ransom demand as indicated by user input that reports on occurrence of the attack), , as described in further detail hereinabove.

[0117] Optionally, the period determiner 112's determining of the time is further based on the time of occurrence of the malware attack that the data received 210 from (say from the user) is indicative of, as described in further detail hereinabove.

[0118] Thus, in one example, the time period determiner 112 carries out the binary search only on received logs that include operations performed on the computing device before the time indicated by the data received from the user.

[0119] In one example, after the earliest sub-period is determined using the binary search, the file recoverer 113 recovers the file, using (a) specific one or more of the data sets - say the latest one of the snapshots that precede the determined sub-period, as described in further detail hereinbelow.

[0120] In the example, the file is recovered (together with other information stored on the computing device) by applying the operations recorded on the log after the specific data set’s time of generation, on the data (say the data of the file system) as recorded in the specific data set or that is pointed to by the specific data set, as known in the art.

[0121] In one example, the file recoverer 113 recovers the file (together with other information stored on the computing device) by applying the operations recorded on the log after the specific data set’s time of generation, on the data that is included to or that is point to by the specific data set, as known in the art.

[0122] Optionally, additionally or alternatively, the time period determiner 112 determines the earliest sub-period of the attack, based on metadata generated on data that accumulates in the least one log, as described in further detail hereinabove.

[0123] The generated metadata may include, but is not limited to: a number of delete operations per each small unit of time (say minute) of the log, a number of file name extension operations per the time unit, a number of files writes per the time unit, etc., as described in further detail hereinbelow.

[0124] Optionally, the system 1000 further includes a metadata generator, in communication with the data receiver 111, which metadata generator generates the metadata.

[0125] Optionally, the metadata generator further stores the metadata in one or more dedicated data structures, say in a relational database table, as described in further detail hereinbelow.

[0126] The metadata generator generates the metadata in real time of the operations, retroactively (say when file recovery is requested a user of the computing device, once in every couple of hours, etc.), or partially in real time and partially retroactively, as described in further detail hereinbelow.

[0127] Reference is now made to Fig- 2, which is a flowchart schematically illustrating an exemplary method of recovering from a malware attack, according to an exemplary embodiment of the present invention.

[0128] An exemplary method of recovering from a malware attack, according to an exemplary embodiment of the present invention, may be executed by one or more processor(s) of a computing circuitry, say on a computer circuitry of a computer, say of a server computer, of a desktop computer, or another computer, or any combination thereof, as described in further detail hereinabove. Optionally, the computer is actually one or more computers, say one or more server computers of an organization, one or more computers that provide a data backup and recovery service to one or more parties, etc., as described in further detail hereinabove.

[0129] In a first example, the service is implemented on a computer (say a server computer) of a specific organization, which computer is used by the specific organization for the organization’s own data recovery needs, as described in further detail hereinabove.

[0130] In a second example, the service is rather implemented on a computer (say server computer) that provides the service to two or more separate organizations, say to different companies, government agencies, etc.

[0131] Optionally, the service is implemented as a part of the services of a NAS device, say using system 1000, as described in further detail hereinabove.

[0132] The exemplary method includes steps that at least one computer processor of the computer is programmed to perform, as described in further detail hereinbelow.

[0133] In the method, there is received 210 at least two data sets and at least one log, say by the data receiver 111 of system 1000, as described in further detail hereinabove.

[0134] Optionally, the data sets are snapshots of the NAS device, as described in further detail hereinabove. Each snapshot preserves the state and content of the data stored on the computing device (say the NAS device’s file system) at a specific point in time, as known in the art.

[0135] Optionally, the data sets are rather backup files that store data held on the computing device when the backup files are generated, images of the computing device’s disk, images of the computing device’s virtual disk, etc., or any combination thereof, as known in the art.

[0136] The data sets are generated at respective time points of a time period between generation of an earliest one and generation of a latest one of the data sets, for backing up information (say files and applications) that is stored on a computing device, as described in further detail hereinabove.

[0137] In one example, each one of the data sets makes up a snapshot of data stored on the computing device (say of the file system), as described in further detail hereinabove.

[0138] Each snapshot preserves the state and content of the data stored on the computing device (say the file system) at a specific point in time, as described in further detail hereinabove. In one example, the computing device is one of several computers used by an organization that also operates the system 1000 on a server computer that implements a backup and recovery service based on the exemplary method, which service is thus implemented internally by the organization, as described in further detail hereinabove.

[0139] In a second example, the exemplary method is used by a party (say organization) that provides a backup and recovery service based on the exemplary method to two or more organizations, say in a Software-as-a-Service (SaaS) model, and say for computing devices that belong to different ones of the organizations.

[0140] Optionally, each one of the received 210 data sets makes up a snapshot of data as already stored on the computing device at a respective one of the time points. The respective time point is the time point of generation of the data set, and the log holds operation performed on the computing device (say on a file system of the computing device) during the time period between the generation of an earliest one of the data sets and the generation of a latest one of the data sets.

[0141] In one example, the exemplary method uses (or is a part of) a CDP (Continuous Data Protection) system. In the example, the data sets make up the snapshot(s) of the file system and the log is one or more of the CDP system’s logs or journals, say a file that records the operations made on the computing device (say changes made to the computing device’s file system), as described in further detail hereinabove.

[0142] Optionally, the log further records operations performed on the file system after the generation of the latest one (or only one) of the data sets (say snapshots), operations performed on the computing device before the generation of the earliest one of the data sets, or both.

[0143] That is to say that optionally, the log records operations performed on the computing device through a time period that is longer than, though overlapping to, the time period between generation of the earliest data set and the latest data set.

[0144] Next, there is determined 220 an earliest sub-period of the attack within the time period, using the at least one log and according to a predefined criterion, say by the time period determiner 112 of system 1000, thus estimating the attack start time, as described in further detail hereinabove. Optionally, the earliest sub-period of the attack is determined 220 by carrying out a binary search for the sub-period in the at least one log, and the sub-period corresponds to at least one of the operations performed on the computing device during the time period and recorded in the log, using one or more criterions, as described in further detail hereinbelow.

[0145] The binary search aims at finding in the log, the first operation that is carried out by the malware (say ransomware), or of a group that is a sequence of operations that includes the first operation carried out by the malware, as described in further detail hereinbelow.

[0146] Then, at least one file of the computing device is recovered 230 using at least one of the data sets (say snapshots) that precede the determined 220 sub-period, say the files of the latest one of the groups of the first files, , say by the file recoverer 113 of system 1000, as described in further detail hereinabove.

[0147] Thus, in one example, every few minutes (say every three minutes), a process that runs continuously on the computing device, generates a new data set that makes up a respective snapshot of the data already stored on the computing device when the data set is generated.

[0148] Also in the example, a CDP system that is installed on the computing device or that is in communication with the computing device continuously records all operations performed on the computing device (say on the computing device’s file system) in a log of the CDP system, as known in the art.

[0149] In the example, after receiving a ransom request from a hacker who launches a ransomware attack, a user of the computing device initiates a file recovery operation by system 1000, as described in further detail hereinabove.

[0150] In the example, there is carried out 220 a binary search in the log of the CDP system, to determine 220 the earliest sub-period of the attack within the time period between the earliest one and latest one of the received 210 data sets, using the at least one log and according to at least one predefined criterion, as described in further detail hereinabove.

[0151] Optionally, the criterion is defined in advance of the recovery, say as a part of a set-up of the exemplary system 1000 by an operator of the exemplary system 1000, or as a part of a computer code of the exemplary system 1000, as encoded by a computer programmer.

[0152] Optionally, the criterion is based on one or more known characteristics of the ransomware (or other malware) attack, say on the type of files effected by the operations recorded in the log, on the order in which files are being affected by the malware, on names of folders created by the malware, on entropy, etc., as described in further detail hereinabove.

[0153] Thus, in one example, one of criteria is that in the attack, files are modified in a file traversal order characteristic of a specific malware.

[0154] In one case, the file traversal starts with files that have one specific type of file extension (say the .jpg file extension), continues with files that have a second specific type of file extension (say . gif), and then continues with files that have a third specific type of file extension (say .mp4), as described in further detail hereinabove.

[0155] Accordingly, in the first example, the binary search aims at finding the first sub-period in which such a file traversal order is detected by the system 1000, as described in further detail hereinbelow.

[0156] In a second example, one of criteria is that in the attack, there are created file folders of a specific name or of a specific name convention, say folder names that contain the ‘rsv2023’ character string followed by nine digits, folder names that end with the ‘nzt2323’ character string, etc.

[0157] Accordingly, in the second example, the binary search aims at finding the first subperiod in which such a file folder names appears in the log.

[0158] In one example, after the earliest sub-period is determined 220 using the binary search, the file is recovered 230, using (a) specific one or more of the data sets, as described in further detail hereinabove.

[0159] In the example, the file is recovered 230 (say together with other information stored on the computing device) by applying the operations recorded on the log after the specific data set’s time of generation, on the data of the file system as recorded in the specific data set, as known in the art.

[0160] Optionally, the determination 220 of the earliest sub-period of the attack is additionally or alternatively, based on metadata generated on data that accumulates in the least one log, say by system 1000, as described in further detail hereinabove.

[0161] The generated metadata may include, but is not limited to: a number of delete operations per each small unit of time (say minute) of the log, a number of file name extension changes per the time unit, entropy of writes per the time unit, etc., as described in further detail hereinbelow.

[0162] The metadata may be generated in real time of the operations, retroactively (say when file recovery is requested a user of the computing device, once in every couple of hours, etc.), or partially in real time and partially retroactively, as described in further detail hereinbelow.

[0163] Optionally, the metadata is stored in one or more dedicated data structures, say in a relational database table, as described in further detail hereinbelow.

[0164] Optionally, the method further includes receiving 210 data that is indicative of a time of occurrence of the malware attack (say a time of receipt of the ransom demand as indicated by user input that reports on occurrence of the attack), say by the data receiver 111, as described in further detail hereinabove.

[0165] Optionally, the determining 220 of the sub-period of the attack is further based on the time of occurrence of the malware attack that the data received 210 from (say from the user) is indicative of.

[0166] Thus, in one example, the binary search is carried out only on received 210 logs that include operations performed on the computing device before the time of the attack as indicated by the data received 210 from the user.

[0167] Reference is now made to Fig. 3, which is a simplified block diagram schematically illustrating an exemplary implementation scenario of recovering from a malware attack, according to an exemplary embodiment of the present invention.

[0168] In one exemplary implementation scenario of recovering from a malware attack, using an exemplary method according to an exemplary embodiment of the present invention, through a period of time 310, a computing device’s three files 301 denoted A, B and C, are subject to legitimate operations.

[0169] Thus, for example, File A is subject to editing 381 and viewing 383 by authorized users in the first minute and second minute of the time period 310, respectively. Similarly, File B is subject to legitimate operations 384, 386, 387 in the second, third and fourth minute of the time period 310, respectively. Similarly, File C too is subject to legitimate operations 382, 385, in the first and second minute of the time period 310. However, in the exemplary scenario, the computing device is targeted by a ransomware attack.

[0170] In the exemplary scenario, the ransomware copies the files 301 to a specific folder created by the ransomware, encrypts the copies of the files 301, and then, deletes the original files from their original file locations.

[0171] Specifically, the specific ransomware used by malicious parties in the exemplary scenario, carries out the copy operations, file by file, in an alphabetical file name order. Thus, the ransomware copies 391 File A in the fifth minute of the time period 310, copies 392 File B in the seventh minute of the time period 310, and copies 383 File C in the ninth minute of the time period 310.

[0172] However, only after all files 301 are copied to the folder created by the ransomware, encrypted and deleted from their original location, does the ransomware inform a user of the computing device about the attack and make the ransom demand.

[0173] Optionally, malicious activity of the ransomware is detected automatically, say by system 1000, say in the middle of the attack, as described in further detail hereinabove.

[0174] In the exemplary scenario, after the files 301 are encrypted by the ransomware and deleted from their original file locations, the ransomware prompts the user of the computing device for a ransom to be paid.

[0175] If no form of data recovery is available, the user is usually left with no other choice but that of paying the ransom to recover the information held by the malicious parties using the ransomware or losing the information by the malicious parties.

[0176] However, in the exemplary scenario, the computing device is installed with a system that every one minute, generates a dataset that makes up a snapshot of data stored on the computing device (say of the computing device’s files system) at the point in time at which the respective one of the data sets is generated, as described in further detail hereinabove.

[0177] Thus, in the exemplary scenario, a snapshot of the computing device’s file system in the second minute of the time period 310 is preserved in a data set denoted W and a snapshot of the computing device’s file system in the fourth minute of the time period 310 is preserved in a data set denoted X. Further in the exemplary scenario, a snapshot of the computing device’s files system in the sixth minute of the time period 310 is preserved in a data set denoted Y, and a snapshot of the computing device’s file system in the eighth minute of the time period 310 is preserved in a data set denoted Z.

[0178] Still, similarly to other malware, the ransomware of the exemplary scenario is designed to infect a computing device and remain undetected until the ransomware achieves its malicious objective, so that the user becomes aware of the infection only after the ransomware prompts her for the ransom to be paid.

[0179] As a result, even though the snapshots are preserved using the data sets W, X, Y and Z 311, in order to be avoid a loss of information, the time of start of the malware attack needs to be estimated.

[0180] Indeed, for example, recovering using a snapshot taken at a too early time before the computing device is inflicted with the malware, may result in a loss of important data, whereas, a snapshot taken after the computing device is inflicted with the malware, may include data that is already inflicted with the malware.

[0181] Accordingly, in the exemplary scenario, after a ransom demand is received from the malicious parties behind the ransomware attack, there is carried out a binary search in the log, for determining the time sub-period that the malware attack started in, based on a criterion predefined by a user or operator, as described in further detail hereinabove.

[0182] As known in art, a binary search is a search that attempts to find a target element (or a set of target elements) within a sorted group - say to find one or more operations amongst operations recorded in a log and arranged in an order of operation occurrence, by searching in a sequence of operations that spans one half (or nearly half) of the log.

[0183] Optionally, the binary search rather searches only in a part (i.e. a subsequence) of the sequence of operations that spans the half (or nearly half) of the log, say a starting part of the sequence, which starting part has a size pre-selected by a programmer or operator of system 1000, as described in further detail hereinabove.

[0184] The binary search continues, through a number of additional iterations. In each one of the iterations the search is narrowed by half (or near half), to a smaller sequence of the operations, and the search continues by searching through a respective subsequence in each iteration, until the target element(s) is (are) found, as described in further detail hereinabove. In the exemplary scenario, the criterion is based one or more known characteristics of the specific ransomware, say on the name of the folder that the ransomware copies the files 301 to, the file extensions of the file copies as saved in folder that the files 301 are copied to, etc., as described in further detail hereinabove.

[0185] Thus, in one example, it is known in advance that a specific malware works by copying 391-393 files of a computer inflicted with the specific malware to a folder called ‘copytr box’ and that the specific malware stores copies of files in that ‘copytr box’ folder, with a file extension: ‘.cpy’.

[0186] In the example, the log includes ten operations, of which operations, seven operations 381-387 are legitimate operations carried out by authorized users and / or applications run on the client device, and three operations are the copy operations 391-393 performed by the ransomware.

[0187] Accordingly, the binary search starts by scanning the CDP log’s first two minutes, since five of the operations (i.e. operations 381-385) are performed by the end of the log’s second minute, whereas five of the operations (i.e. operations 386-387 and 391-193) are performed after the log’s second minute.

[0188] Since none of the operations 381-385 that are recorded in the log’s first two minutes, comply with the predefined criterion of the example (i.e. involve copying files of the computer inflicted with the ransomware to a folder called ‘copytr box’ or a storing of copies of files in the ‘copytr box’ folder, with a ‘.cpy’. file extension), no traces of the attack are found in the first two minutes of the log.

[0189] Since the median one 391 of the remaining operations (i.e. operations 386-387 and 391- 393) is performed in the fifth minute of the log, the binary search continuous in minutes 3-5 of the log that records operations 386-387 and 391, and finds operation 391 that is a copy operation that complies with the predefined criterion, say since it involves a copying of File A into the ‘copytr box’ folder.

[0190] Accordingly, a trace of the attack is found in the 3-5 minutes part of the log.

[0191] Then, the binary search continuous to minutes 3-4 part of the log that records two operations 386-387. Since none of the two operations 386-387 that are recorded in 3-4 minutes part of the log, comply with the predefined criterion of the example, no traces of the attack are found in the 3-4 minutes part of the log.

[0192] As a result, the binary search finds that the ransomware attack’s first operation is operation 391, and thus, the sub-period of the ransomware attack is determined to start at the time of operation 391.

[0193] Accordingly, data set (say snapshot) X 311 that is the latest one of data sets W-Z 311 that precede the determined sub-period, is used for recovering the files 301 of the computing device.

[0194] In the exemplary scenario, the files 301 are recovered by applying the legitimate operations recorded in the log after generation of data set X 311 to the data (say file system data) recorded in (or pointed to by) data set 311 in the operations’ original order of execution, and copying the result of that applying to the disk of the computing device, as known in the art.

[0195] Optionally, the determination of the earliest sub-period of the attack is additionally or alternatively, based on metadata generated on data that accumulates in the log, say on the number of delete operations per each small unit of time (say minute) of the log, on the number of file name extension operations per the time unit, on the entropy of writes per the time unit, etc., as described in further detail hereinabove.

[0196] The metadata may be generated in real time of the operations, retroactively (say when file recovery is requested by a user of the computing device), or partially in real time and partially retroactively, as described in further detail hereinabove.

[0197] Reference is now made to Fig. 4, which is a simplified block diagram schematically illustrating an exemplary non-transitory computer readable medium having stored thereon, instructions of a computer program for causing a processing circuitry to perform a process of recovering from a malware attack, according to an exemplary embodiment of the present invention.

[0198] According to an exemplary embodiment of the present invention, there is provided a non-transitory computer readable medium 4000, such as a CD-ROM, a USB-Memory, a Hard Disk Drive (HDD), a Solid State Drive (SSD), etc. The computer readable medium 4000 stores a computer program for causing a processing circuitry (say of the computer that system 1000 is implemented on) to perform the steps of the exemplary method of recovering from a malware attack, as described in further detail hereinabove.

[0199] The computer may actually include one or more computers, as described in further detail hereinabove. The steps may thus be performed on one or more computer processor(s) of a processing circuitry of the computer(s), as described in further detail hereinabove.

[0200] Accordingly, the computer readable medium 4000 stores computer executable instructions of a computer program for performing steps of the exemplary method of remote access computer security on a computer, as described in further detail hereinabove and as illustrated using Fig. 2.

[0201] The computer program includes computer executable instructions that implement the exemplary method’s step of receiving 410 at least two data sets (say snapshots) and at least one log, as described in further detail hereinabove.

[0202] The data sets are generated at respective time points of a time period between generation of an earliest one and generation of a latest one of the data sets, for backing up data (say files and applications) that is stored on a computing device, as described in further detail hereinabove.

[0203] Optionally, there are received 410 both the data sets and the log that holds operation performed on the computing device (say on the NAS device) during the time period between the generation of (an) earliest one of the data sets (say snapshots) and the generation of a latest one of the data sets, as described in further detail hereinabove.

[0204] In one example, the above mentioned log is a log of a CDP system, say a log that records the operations performed on the computing device (say NAS device), say the changes made the NAS device’s file system, as described in further detail hereinabove.

[0205] Optionally, the log further records operations performed on the computing device (say the file system) after the generation of the latest one (of the data sets (say snapshots), operations performed on the computing device before the generation of the earliest one of the data sets, or both, as described in further detail hereinabove. That is to say that optionally, the log records operations performed on the computing device through a time period that is longer than, though overlapping to, the time period between generation of the earliest one of the data sets and the latest one of the data sets.

[0206] The computer executable instructions further include a step of determining 420 an earliest sub-period of the attack within the time period, using the received 410 at least one log and according to a predefined criterion, as described in further detail hereinabove.

[0207] Optionally, the computer executable instructions determine 420 the sub-period by carrying out a binary search for the sub-period in the at least one received 410 log, and the subperiod corresponds to at least one of the operations performed on the computing device during the time period and recorded in the log, as described in further detail hereinabove.

[0208] Optionally, the computer executable instructions of the computer program further include instructions for receiving 410 data that is indicative of a time of occurrence of the malware attack (say a time of receipt of the ransom demand as indicated by user input that reports on occurrence of the attack), as described in further detail hereinabove.

[0209] Optionally, the sub-period’s determining 420 is further based on the time of occurrence of the malware attack that the data received 410 (say from the user) is indicative of, as described in further detail hereinabove.

[0210] Thus, in one example, the binary search is carried out only on received 410 logs that include operations performed on the computing device (say on the computing device’s file system) before the time indicated by the data that is indicative of the attack and that is received 410 from the user, as described in further detail hereinabove.

[0211] The computer executable instructions further include a step of recovering 430 data (say at least one file) of the computing device, using at least one of the data sets that precede the determined 420 sub-period, as described in further detail hereinabove.

[0212] Optionally, additionally or alternatively, the computer executable instructions determine 420 the earliest sub-period of the attack, based on metadata generated on data that accumulates in the received 410 at least one log, as described in further detail hereinabove.

[0213] The generated metadata may include, but is not limited to: a number of delete operations per each small unit of time (say minute) of the log, a number of file name extension operations per the time unit, entropy of writes per the time unit, etc., as described in further detail hereinabove.

[0214] Optionally, additionally or alternatively, the computer executable instructions include a step of generating the metadata in real time of the operations, retroactively (say when file recovery is requested a user of the computing device, once in every couple of hours, etc.), or partially in real time and partially retroactively, as described in further detail hereinabove.

[0215] Optionally, additionally or alternatively, the computer executable instructions further include a step of storing the metadata in one or more dedicated data structures, say in a relational database table, as described in further detail hereinbelow.

[0216] It is expected that during the life of this patent many relevant devices and systems will be developed and the scope of the terms herein, particularly of the terms “Computer”, “Computer Server”, “Tablet”, “Laptop”, “Network”, “File”, “CDP (Continuous Data Protection) system”, “Software as a Service (SaaS)”, “CD-ROM”, “USB Memory”, “Hard Disk Drive (HDD)”, “Solid State Drive (SSD)”, and “Database”, is intended to include all such new technologies a priori.

[0217] It is appreciated that certain features of the invention, which are, for clarity, described in the context of separate embodiments, may also be provided in combination in a single embodiment. Conversely, various features of the invention, which are, for brevity, described in the context of a single embodiment, may also be provided separately or in any suitable sub combination.

[0218] Although the invention has been described in conjunction with specific embodiments thereof, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art. Accordingly, it is intended to embrace all such alternatives, modifications and variations that fall within the spirit and broad scope of the appended claims.

[0219] All publications, patents and patent applications mentioned in this specification are herein incorporated in their entirety by reference into the specification, to the same extent as if each individual publication, patent or patent application was specifically and individually indicated to be incorporated herein by reference. In addition, citation or identification of any reference in this application shall not be construed as an admission that such reference is available as prior art to the present invention.

Claims

CLAIMS1. A method of recovering from a malware attack, the method comprising steps executed by a computing circuitry, the steps comprising: receiving a plurality of data sets and at least one log, the data sets generated at respective points of a time period between generation of an earliest one and generation of a latest one of the data sets, the at least one log recording a plurality of operations performed on a computing device during the time period; determining an earliest sub-period of the attack within the time period, using the at least one log and according to a predefined criterion; and using at least one of the data sets preceding the determined sub-period, for recovering data of the computing device.

2. The method of claim 1, further comprising carrying out a binary search for the sub-period in the at least one log, for said determining, the sub-period corresponding to at least one of the operations performed on the computing device during the time period and recorded in the log.

3. The method of claim 1, wherein said determining of the sub-period of the attack comprises carrying out a binary search for the sub-period in the at least one log, for said determining, the sub-period corresponding to an operation performed on the computing device during the time period and recorded in the log.

4. The method of claim 1, wherein said determining of the sub-period of the attack comprises using metadata on the operations recorded in the at least one log.

5. The method of claim 1, further comprising generating metadata on the operations recorded in the at least one log, and using the generated metadata for said determining of the sub-period of the malware attack.

6. The method of claim 1, further comprising receiving data indicative of a time of occurrence of the malware attack, and selecting the sub-period based on the time of occurrence of the malware attack that the received data is indicative of.

7. The method of claim 1, wherein the malware attack is a ransomware attack.

8. The method of claim 1, wherein each one of the data sets makes up a snapshot of data stored on the computing device at a time of generation of the data set.

9. A system for recovering from a malware attack, the system comprising: a processing circuitry; and a memory in communication with said processing circuitry, the memory containing instructions that, when executed by the processing circuitry, cause the system to: receive a plurality of data sets and at least one log, the data sets generated at respective points of a time period between generation of an earliest one and generation of a latest one of the data sets, the at least one log recording a plurality of operations performed on a computing device during the time period; determine an earliest sub-period of the attack within the time period, using the at least one log and according to a predefined criterion; and use at least one of the data sets preceding the determined sub-period, for recovering data of the computing device.

10. The system of claim 9, wherein the memory further contains instructions that, when executed by the processing circuitry, cause the system to carry out a binary search for the subperiod in the at least one log, for determining the sub-period, the sub-period corresponding to at least one of the operations performed on the computing device during the time period and recorded in the log.

11. The system of claim 9, wherein the memory further contains instructions that, when executed by the processing circuitry, cause the system to carrying out a binary search for the sub-period in the at least one log, for determining the sub-period, the sub-period corresponding to an operation performed on the computing device during the time period and recorded in the log.

12. The system of claim 9, wherein the memory further contains instructions that, when executed by the processing circuitry, cause the system to use metadata on the operations recorded in the at least one log, for determining the sub-period.

13. The system of claim 9, wherein the memory further contains instructions that, when executed by the processing circuitry, cause the system to generate metadata on the operationsrecorded in the at least one log, and use the generated metadata for determining the subperiod of the attack.

14. The system of claim 9, wherein the memory further contains instructions that, when executed by the processing circuitry, cause the system to receive data indicative of a time of occurrence of the malware attack, and select the sub-period based on the time of occurrence of the malware attack that the received data is indicative of.

15. A computer program for recovering from a malware attack, the computer program comprising program instructions which, when executed by at least one processor, cause the at least one processor to: receive a plurality of data sets and at least one log, the data sets generated at respective points of a time period between generation of an earliest one and generation of a latest one of the data sets, the at least one log recording a plurality of operations performed on a computing device during the time period; determine an earliest sub-period of the attack within the time period, using the at least one log and according to a predefined criterion; and use at least one of the data sets preceding the determined sub-period, for recovering data of the computing device.

16. The computer program of claim 15, wherein when executed by the at least one processor, said program instructions further cause the at least one processor to carry out a binary search for the sub-period in the at least one log, for determining the sub-period, the sub-period corresponding to at least one of the operations performed on the computing device during the time period and recorded in the log.

17. The computer program of claim 15, wherein when executed by the at least one processor, said program instructions further cause the at least one processor to carrying out a binary search for the sub-period in the at least one log, for determining the sub-period, the sub-period corresponding to an operation performed on the computing device during the time period and recorded in the log.

18. The computer program of claim 15, wherein when executed by the at least one processor, said program instructions further cause the at least one processor to use metadata on the operations recorded in the at least one log, for determining the sub-period.

19. The computer program of claim 15, wherein when executed by the at least one processor, said program instructions further cause the at least one processor to generate metadata on the operations recorded in the at least one log, and use the generated metadata for determining the sub-period of the attack.

20. The computer program of claim 15, wherein when executed by the at least one processor, said program instructions further cause the at least one processor to receive data indicative of a time of occurrence of the malware attack, and select the time period based on the time of occurrence of the malware attack that the received data is indicative of.

Images