Backup File Restoration Using Timestamp Synchronization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing endpoint detection and response (EDR) solutions face challenges in efficiently performing rollback operations, as they are often time-consuming and resource-intensive, and may not accurately distinguish between clean and affected files.
Innovation Solution
The method involves synchronizing time between a backup server and a computing device using a time server, blocking attempts by malicious processes to alter file timestamps, and performing a restoration by comparing file modification timestamps with the incident time of the malicious process, thereby efficiently restoring clean files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If backup scanning is enabled to ensure clean files are restored, then reliability of restoration is improved, but time consumption and resource usage increase significantly
Solution Approach 1:
The system performs preliminary time synchronization between backup server and computing device before the actual backup process. This preliminary action establishes a trusted time reference that enables later efficient filtering of clean files based on timestamps, avoiding the need to scan all files during restoration.
Solution Approach 2:
The restoration process is segmented into two groups: files with modification timestamps before the incident time (restored without scanning) and files with timestamps at or after incident time (scanned for malware). This segmentation allows the system to restore clean files efficiently while still scanning potentially infected files.
2Reliability
If backup scanning is performed to detect malicious files, then restoration safety is improved, but resource consumption increases
Solution Approach 1:
Different restoration strategies are applied to different files based on their modification timestamps. Files modified before the incident time receive simple timestamp-based restoration (low resource usage), while files modified at or after incident time undergo malware scanning (high resource usage). This local differentiation optimizes resource allocation.
3Productivity
If simple timestamp comparison is used for rollback, then restoration speed is improved, but accuracy in identifying clean files deteriorates due to timestamp manipulation by malware
Solution Approach 1:
The system preemptively blocks malicious processes from modifying file timestamps during the backup process. This preliminary anti-action prevents the timestamp manipulation attack before it can occur, ensuring that timestamps remain reliable indicators of file modification time throughout the backup and restoration process.
Solution Approach 2:
A trusted time server acts as an intermediary to provide authoritative time information. The backup server synchronizes with this time server to establish accurate incident timestamps, which serve as a reliable reference point for distinguishing clean files from infected files during restoration.
4Measurement precision
If time synchronization is implemented to prevent timestamp manipulation, then timestamp reliability is improved, but system complexity increases
Solution Approach 1:
The backup server automatically synchronizes its time with a trusted time server and uses this synchronized time to establish incident timestamps. The system then uses these timestamps to automatically determine which files need scanning and which can be restored directly, eliminating the need for manual intervention or complex decision-making logic.
Data Source
AI summary
Disclosed herein are systems and method for restoring files from a backup, the method including: retrieving a time indicator from a time server associated with a backup server; synchronizing time between the backup server and a computing device performing a backup, based on the time indicator; performing the backup of files from the computing device to the backup server, wherein a malicious process modifies at least one file being backed up at an incident time during the backup and performs an attempt to change a time of the computing device such that a modification timestamp of the at least one file precedes the incident time; blocking the attempt to change the time of the computing device; subsequent to completing the backup, detecting the malicious process infecting the computing device; and performing a restoration of the backup on the computing device.