Backup Integrity via Change Score and Application Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing backup methods fail to prevent corrupted files, such as those encrypted by ransomware, from overriding uncorrupted files in backup storage, leading to permanent data loss without recovery options.
Innovation Solution
A computer-implemented method that detects file changes, calculates a change score based on the difference between new and previous file versions and the applications that wrote to them, and applies a backup policy to prevent corrupted files from being backed up, including strict or lenient policies and time-to-live settings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If cloud services automatically synchronize files on a regular schedule, then backup frequency is improved, but corrupted files may replace uncorrupted backup files causing data loss
Solution Approach 1:
The system performs preliminary analysis of file changes and application behavior before allowing backup synchronization. By detecting ransomware characteristics and evaluating change scores in advance, the system prevents corrupted files from overwriting clean backups, thus maintaining backup integrity while enabling frequent synchronization.
Solution Approach 2:
The system implements feedback mechanisms by monitoring file changes, analyzing application behavior, and evaluating change scores to dynamically control backup synchronization. This feedback loop enables the system to identify and block corrupted files while allowing legitimate file updates, resolving the contradiction between frequent backup and backup integrity.
2Loss of time
If security software attempts to remove malware after infection, then response time is improved, but encrypted files may be impossible to decrypt leading to permanent loss
Solution Approach 1:
The system performs preliminary detection of ransomware characteristics and file encryption patterns before files are permanently corrupted. By identifying suspicious applications and evaluating change scores early in the infection process, the system can alert users and prevent backup of encrypted files, enabling timely response while preserving file recovery options through maintained clean backups.
3Reliability
If the system calculates change score and compares application lists for every file upload, then backup reliability is improved, but processing time and complexity increase
Solution Approach 1:
The system applies different levels of analysis to different files based on their characteristics and risk profiles. By focusing detailed change score calculation and application list comparison on high-risk files while using simpler validation for low-risk files, the system maintains high backup safety while reducing overall processing complexity and computational overhead.
Data Source
AI summary
A computer-implemented method for managing file backup may include (i) detecting, by a computing device, an attempt to upload a file to a backup storage, (ii) calculating a degree of difference between the file and a previous version of the file on the backup storage, (iii) comparing, by the computing device, a list of applications that have written to the file with a list of acceptable applications for the file, (iv) calculating, based on the degree of difference and the comparison of the list of applications, a change score for the file, and (v) applying, based on the change score, a backup policy to the attempt to upload the file. Various other methods, systems, and computer-readable media are also disclosed.