Fortified Backup Anomaly Detection Using Volatile-Memory Execution Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing backup systems fail to detect and prevent malicious software from being included in backups, leading to potential infection of destination systems during restoration.
Innovation Solution
Capture and analyze current execution information from volatile memory during backups using machine learning models to identify anomalies indicative of malicious software, and adjust backup workflows accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If backup is performed without anomaly detection, then backup speed and simplicity are improved, but security reliability deteriorates due to inclusion of malicious software
Solution Approach 1:
The system performs anomaly detection before the backup process completes by capturing execution information during the backup operation. This preliminary detection action allows the system to identify malicious software inclusion attempts before the backup is finalized, enabling prevention while maintaining backup efficiency.
Solution Approach 2:
The system introduces an intermediary anomaly detection mechanism between the backup source system and destination system. This intermediary layer captures execution information, analyzes it for anomalies, and controls the backup transfer process, thereby preventing malicious software from reaching the destination system without significantly impacting backup speed.
2Reliability
If anomaly detection is added to backup process, then security reliability is improved, but device complexity increases
Solution Approach 1:
The backup agent performs multiple functions: it captures execution information, analyzes anomalies, and controls backup operations. By making the backup agent multi-functional, the system avoids adding separate complex detection components, thereby improving security reliability while minimizing the increase in device complexity.
Solution Approach 2:
The backup agent uses its existing resources and capabilities to perform anomaly detection. It captures execution information from the source system during backup and analyzes it using integrated anomaly detection algorithms, allowing the system to self-protect without requiring external complex detection infrastructure.
3Measurement precision
If execution information is captured during backup, then detection precision is improved, but loss of time increases due to additional analysis
Solution Approach 1:
The system captures execution information at specific periodic intervals during the backup process rather than continuously. This periodic sampling approach maintains detection precision by capturing sufficient anomaly indicators while minimizing the time overhead associated with information collection and analysis.
Data Source
AI summary
An indication to perform a backup of data stored in a persistent storage associated with a source system is received. In response to the indication to perform the backup, current execution information at least in part maintained in a volatile memory is captured. The captured current execution information is caused to be stored with backup data from the backup of the data stored in the persistent storage.