Backup Archive Slice Scanning for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current virus and malware detection methods in backup archives require full scanning of large archives, which is time-consuming and resource-intensive, especially when archives are stored in the cloud, and do not allow for scanning at arbitrary time points or repair of infected data.
Innovation Solution
The method involves scanning specific slices of a backup archive by comparing blocks to identify modified files, removing infected files to generate a 'cured' slice, and marking subsequent slices as unsuitable for recovery, allowing for efficient detection and isolation of malware without scanning the entire archive.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full scanning of large archives is performed, then malware detection completeness is improved, but scanning time and computational resources are excessively consumed
Solution Approach 1:
The backup archive is divided into multiple slices, each representing a point-in-time image of user data. The scanning system segments the archive into these slices and scans only the most recent slice and slices containing modified blocks, rather than scanning the entire archive. This segmentation allows the system to maintain malware detection completeness while significantly reducing scanning time and computational resource consumption.
2Reliability
If full scanning of large archives is performed, then malware detection completeness is improved, but computational resources are excessively consumed
Solution Approach 1:
The system extracts only the necessary slices for scanning based on block modification tracking. By identifying which slices contain modified blocks since the last scan, the system extracts only those specific slices for malware scanning, leaving the rest of the archive untouched. This extraction approach maintains detection completeness for relevant data while dramatically reducing computational resource consumption.
3Quantity of substance
If archives are stored in cloud storage, then storage scalability is improved, but access speed is significantly reduced
Solution Approach 1:
The system performs preliminary actions by tracking block modifications and identifying which slices contain changed data before initiating a full scan. This preliminary tracking allows the system to access only the necessary slices from cloud storage, rather than retrieving and scanning the entire archive. This approach maintains storage scalability in the cloud while improving access speed by minimizing data transfer requirements.
4Reliability
If conventional scanning methods are used, then malware detection is performed, but arbitrary time points in archives cannot be scanned
Solution Approach 1:
The system implements dynamic slice mounting capabilities that allow arbitrary time points in the archive to be accessed and scanned. By mounting specific slices corresponding to different point-in-time images and tracking block modifications between slices, the system can dynamically scan any time point in the archive history. This dynamic approach provides both malware detection reliability and scanning flexibility, allowing users to scan arbitrary time points as needed.
Data Source
AI summary
Disclosed herein are systems and method for inspecting archived slices for malware. In one exemplary aspect, the method comprises identifying a first slice in a plurality of slices in a backup archive, wherein the first slice is an image of user data at a first time. The method comprises scanning the first slice of the plurality of slices in the backup archive and detecting at least one infected file in the first slice. The method comprises identifying a block of the first slice that corresponds to the at least one infected file. The method comprises mounting, to a disk, a second slice of the plurality of slices. The method comprises tracking the block and determining that the at least one infected file exists on the second slice and removing the infected file from the second slice by generating a respective cured slice of the second slice.