Backup File Isolation from Malware Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file backup systems are vulnerable to malware attacks, such as ransomware, which can encrypt files before backup, leading to data loss and false positives in detection, and existing anti-malware solutions struggle to differentiate between legitimate and malicious software actions.
Innovation Solution
A method and system that analyze files for malware suspicion by isolating potentially encrypted files, suspending backup rotations, and utilizing multi-device communication to verify infections, thereby preventing data loss and improving detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If files are backed up to a storage system, then data loss is prevented, but the backup files become vulnerable to malware manipulation such as ransomware encryption
Solution Approach 1:
The storage system is segmented into multiple isolated storage locations, including a primary backup location and a isolated quarantine location. Files are routed to different locations based on their security status, with suspicious files being isolated from the main backup storage to prevent malware propagation while maintaining backup functionality for clean files.
Solution Approach 2:
A file analysis component acts as an intermediary between file upload and backup storage. This intermediary analyzes files for malware indicators before allowing them into the backup system, and can move suspicious files to a quarantine zone, thereby mediating the security risk without preventing the backup function itself.
2Reliability
If anti-malware programs are used to detect malware, then protection is provided, but false positives occur and new malware can evade detection
Solution Approach 1:
The system performs preliminary analysis of files before they are fully processed or backed up, checking for malware indicators in advance. Suspicious files are identified and isolated before they can cause harm or be mistakenly processed as legitimate files, preventing both actual malware propagation and reducing false positives through pre-screening.
Solution Approach 2:
Files undergo preliminary scanning and analysis upon upload, before being integrated into the backup system. This preliminary action includes checking file characteristics, signatures, and behavior patterns to identify potential malware, allowing the system to take preventive measures before the files are fully accessible.
3Productivity
If files are continuously backed up without verification, then backup completeness is maintained, but malware can spread across all backup files
Solution Approach 1:
The system extracts and isolates suspicious files from the main backup stream by moving them to a separate quarantine location. This extraction prevents potentially infected files from spreading to other backup files while maintaining the backup process for clean files, thus removing the harmful element without stopping the overall backup function.
Solution Approach 2:
The file analysis component provides feedback about file security status to the backup process. Based on this feedback, the system dynamically adjusts file routing decisions, isolating suspicious files while allowing clean files to proceed with normal backup operations, thereby maintaining productivity while preventing malware spread.
Data Source
AI summary
A method for safeguarding a stored file from malware. In one embodiment, the method includes at least one computer processor receiving, to a storage system, a first file from a first computing device. The method further includes analyzing the received first file to determine whether the received first file is suspected of encryption by malware. The method further includes responding to determining that the received first file is suspected of encryption by malware, initiating one or more actions, including suspending replacement of an instance of the first file backed up to the storage system with the received first file. The method further includes storing the received first file to a portion of the storage system designated for file isolation.