Backup Anomaly Detection Using Volatile Memory Execution Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing backup systems are unable to effectively detect and prevent the inclusion of malicious software, leading to potential infection of destination systems during data restoration, as conventional anti-virus methods require databases of known malware and are inefficient against unknown threats.
Innovation Solution
A backup agent or storage system captures and analyzes current execution information from volatile memory at multiple points in time, using machine learning models to identify anomalies and exploitations by malicious software, allowing for real-time detection and prevention of infected backups.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-virus methods with databases of known malware are used, then detection of known malware is achieved, but detection of unknown threats is ineffective and efficiency is low
Solution Approach 1:
The patent transforms malware detection from signature-based matching to behavior-based analysis by changing the detection parameters from static file signatures to dynamic execution characteristics. The system monitors process creation, network connections, and system registry changes to identify malicious behavior patterns, enabling detection of unknown threats without relying on predefined databases.
Solution Approach 2:
The patent replaces the mechanical database-matching approach with a machine learning-based behavioral analysis system. Instead of mechanically comparing files against known malware signatures, the system uses algorithms to analyze execution patterns and predict malicious intent, significantly improving adaptability to novel threats.
2Reliability
If backup processes include malware scanning, then security is improved, but backup time and productivity are reduced
Solution Approach 1:
The patent performs malware behavior analysis during the backup process itself rather than as a separate pre-backup scanning step. By monitoring execution information and capturing behavioral patterns concurrently with data backup, the system achieves security verification without adding significant time overhead to the backup operation.
Solution Approach 2:
The system maintains continuous monitoring of execution information throughout the backup process, allowing security validation to occur in parallel with data transfer. This continuous analysis approach eliminates the need for sequential scanning operations that would interrupt or delay the backup workflow.
3Measurement precision
If execution information is captured and analyzed in real-time, then malware detection accuracy is improved, but system resource consumption increases
Solution Approach 1:
The patent makes the execution information capture mechanism serve multiple functions simultaneously: it collects data for backup operations, gathers behavioral patterns for malware detection, and provides system state information for recovery purposes. This multi-functionality reduces redundant resource consumption while maintaining high detection accuracy.
Solution Approach 2:
The system uses the source system's own execution information and process data for malware detection analysis, eliminating the need for separate scanning tools or external analysis systems. The backup agent leverages existing system telemetry and logging mechanisms to perform self-diagnosis and security verification.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An indication to perform a backup of data stored in a persistent storage associated with a source system is received. In response to the indication to perform the backup, current execution information at least in part maintained in a volatile memory is captured. The captured current execution information is analyzed to determine one or more exploitations by malicious software of the source system. The captured current execution information may be caused to be stored with backup data from the backup of the data stored in the persistent storage.