Centralized Backup Antivirus Scanning via Virtual Disk Mounting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-virus scanning systems fail to predict and prevent malicious attacks on backup data by only searching for known malware, lacking the ability to identify potential vulnerabilities and provide early diagnosis of infected data.
Innovation Solution
A method for anti-virus scanning at centralized storage that mounts backup slices as virtual disks, detects changes across multiple devices, evaluates these changes against behavioral rules, and executes remediation actions to prevent attacks, using a heuristic model with weights and thresholds to identify and address malicious behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If regular anti-virus scanning is performed to search for existing malware, then known threats can be detected, but the system cannot predict vulnerabilities or identify features of malicious programs before attacks are launched
Solution Approach 1:
The system performs preliminary analysis of backup data by mounting backup slices as virtual disks and analyzing file system structures, metadata, and data patterns before attacks occur. This preliminary action enables the system to identify suspicious changes and predict potential malware threats in advance, rather than waiting for known malware signatures to be detected during regular scans.
Solution Approach 2:
The system segments the analysis process into distinct phases: mounting backup slices as virtual disks, detecting changes between mounted virtual disks and previous backup slices, analyzing detected changes, and evaluating against behavioral rules. This segmentation allows each phase to be optimized independently and enables parallel processing of multiple backup slices simultaneously.
2Reliability
If comprehensive analysis of all backup data is performed to predict vulnerabilities, then early diagnosis of infected data can be achieved, but the computational resources and time required increase significantly
Solution Approach 1:
The system performs partial analysis by focusing on detected changes between backup slices rather than analyzing entire backup datasets. By mounting backup slices as virtual disks and comparing only the changed portions against behavioral rules, the system achieves effective vulnerability prediction with reduced computational overhead compared to comprehensive full-data analysis.
Solution Approach 2:
The system implements periodic analysis by analyzing backup data at scheduled intervals when backup slices are created and mounted. This periodic action allows the system to maintain up-to-date vulnerability predictions without continuous resource consumption, balancing security monitoring with system productivity by activating intensive analysis only when new backup data becomes available.
3Reliability
If behavioral rules are applied to evaluate changes across multiple devices, then malicious behavior can be identified, but the complexity of rule management and false positive rates increase
Solution Approach 1:
The system implements feedback mechanisms by evaluating detected changes against behavioral rules and using the results to refine future detections. When suspicious patterns are identified across multiple devices, the system feeds this information back into the analysis process, adjusting the evaluation of subsequent changes and improving detection accuracy over time while reducing false positives through learned patterns.
Data Source
AI summary
Disclosed herein are systems and method for anti-virus scanning of backup data at a centralized storage. In an exemplary aspect, a method may receive, at the centralized storage, a backup slice from each respective computing device in a plurality of computing devices, wherein the centralized storage comprises, for each respective computing device, a respective backup archive including a plurality of backup slices. The method may mount the received backup slice as a virtual disk. The method may detect, for the respective computing device, a change between the mounted virtual disk and any number of previous backup slices and may evaluate the change against behavioral rules to identify malicious behavior. In response to determining that the change exhibits malicious behavior, the method may execute a remediation action to prevent an attack on the plurality of computing devices or the centralized storage.