Backup Cleanliness Tagging Using Cyber-Attack Alert Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing backup mechanisms struggle to quickly identify clean backups, leading to potential data loss during cyber-attacks as they rely on time-consuming full scans of backups, often using older backups that have not yet been verified as clean.
Innovation Solution
Implement near-real-time analytics on data access patterns to tag backups as clean or corrupted, using a clean backup identification engine that logs alerts and tags backups based on access patterns, reducing the need for full scans and enabling quicker identification of clean backups.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full scans of backups are performed to verify cleanliness, then reliability of backup verification is improved, but time required for backup verification increases
Solution Approach 1:
The system performs preliminary monitoring of data access patterns during the backup creation process itself, rather than waiting until after the backup is complete. By continuously analyzing access patterns during backup generation and immediately tagging backups as clean or corrupted based on detected patterns, the system eliminates the need for time-consuming post-backup full scans while maintaining reliable verification through real-time pattern detection
2Reliability
If older backups are used for restoration, then availability of verified clean backups is improved, but data loss increases
Solution Approach 1:
The system implements continuous feedback by monitoring data access patterns in real-time and immediately tagging backups with cleanliness status. This feedback mechanism allows the system to identify the most recent clean backup without relying on older verified backups, enabling restoration from newer backups that contain more current data while minimizing data loss
Solution Approach 2:
By performing preliminary pattern monitoring during backup creation and immediately tagging backups, the system makes clean backup status known in advance, allowing selection of the most recent clean backup for restoration rather than forcing use of older backups
3Reliability
If periodic backup schedules are implemented, then data protection is improved, but ability to quickly identify clean backups worsens
Solution Approach 1:
The system transitions from periodic backup verification to continuous pattern monitoring that operates throughout the entire backup creation process and beyond. By continuously analyzing data access patterns in real-time rather than periodically scanning completed backups, the system maintains constant awareness of backup cleanliness status, enabling immediate identification of clean backups as they are created
Data Source
AI summary
Mechanisms are provided for identifying clean backups of a monitored computing system. A backup of a state of a computing system is generated. In response, these operations are performed: alert data associated with the monitored computing system is retrieved, where alert data is stored in response to patterns of data accesses indicating a possible cyber-attack on the computing system; a classification engine executes a classification operation on the alert data to determine if it indicates that the state of the monitored computing system was the target of a cyber-attack within a predetermined period of time prior to a time the backup was generated; if so, a first tag is generated for the backup indicating the backup to be corrupted; if not, a second tag for the backup is generated indicating the backup to be clean; and the first or second tag is stored in association with the backup.