Backup Agent Anomaly Detection for Malware-Safe Restore Points
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing backup technologies fail to detect malicious software during the backup of a source system, allowing it to infect a destination system upon restoration.
Innovation Solution
Implementing a backup agent or storage system that captures and analyzes current execution information, including process tables and network status, to detect anomalies indicative of malicious software, using machine learning models to prevent its inclusion in backups.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional backup technology is used to back up source system data, then backup efficiency is maintained, but malicious software is not detected and can infect the destination system upon restoration
Solution Approach 1:
The system performs preliminary anomaly detection on the source system before creating the backup. The backup agent captures execution information and analyzes it for signs of malicious software prior to the backup operation, preventing infected data from being backed up in the first place.
Solution Approach 2:
A backup agent is introduced as an intermediary component between the source system and storage system. This agent captures execution information, analyzes it for anomalies, and controls whether data proceeds to backup based on the analysis results, adding a security layer without fundamentally changing the backup architecture.
2Measurement precision
If execution information is captured and analyzed during backup to detect malicious software, then detection accuracy improves, but processing time increases
Solution Approach 1:
The system analyzes execution information partially rather than comprehensively. It focuses on capturing and analyzing only the most critical execution metrics and anomaly indicators necessary for detecting malicious software, rather than performing exhaustive analysis of all system processes.
Solution Approach 2:
Execution information is captured and analyzed in advance during the backup process rather than after completion. This allows the system to identify and flag potential threats before they impact the final backup outcome, reducing rework and overall time loss.
3Reliability
If anomaly detection is performed on the source system before backup, then malicious software is prevented from being backed up, but the backup process becomes more complex
Solution Approach 1:
The backup agent is designed to perform multiple functions: capturing execution information, analyzing it for anomalies, and controlling the backup process. This multi-functionality consolidates what could be separate complex systems into a single integrated component, managing complexity while maintaining reliability.
Solution Approach 2:
The backup agent autonomously performs anomaly detection and makes decisions about whether to proceed with backup without requiring external intervention. This self-service capability simplifies the overall process by eliminating the need for separate manual detection and approval steps.
Data Source
AI summary
An indication to perform a backup of data stored in a persistent storage associated with a source system is received. In response to the indication to perform the backup, current execution information at least in part maintained in a volatile memory is captured. The captured current execution information is caused to be stored with backup data from the backup of the data stored in the persistent storage