Backup File Hash Indexing for Rapid Malware Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for identifying malware in large data storage systems require extensive file scanning, which can take days, weeks, or even months, due to the large number of files involved, significantly delaying recovery from cybersecurity incidents.
Innovation Solution
Precomputing file hashes during backup and storing them in a database indexed by hash values, along with filesystem metadata, allows for rapid identification of malware locations by querying the database with malicious file hashes, reducing threat identification time to seconds or minutes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional file scanning methods are used to identify malware in large data storage systems, then comprehensive security checking is achieved, but the identification time extends to days, weeks, or even months
Solution Approach 1:
The patent precomputes and stores hash values for all files in the data storage system before malware detection is needed. This preliminary action creates a ready-to-query database of file hashes, allowing instantaneous malware identification by simply comparing the malicious file's hash against the pre-stored hashes, reducing detection time from months to seconds while maintaining comprehensive security coverage
Solution Approach 2:
The patent extracts the essential identifying feature (hash value) from each file and stores it separately in a database, rather than keeping the entire file content. This extraction allows the system to work with compact hash representations instead of large files, enabling rapid comparison and identification without handling the original file data during detection
2Reliability
If comprehensive file scanning is performed across billions of files, then all malware instances are detected, but the processing complexity and resource requirements increase significantly
Solution Approach 1:
The patent extracts only the essential identifying characteristic (hash value) from each file and stores it in a database, eliminating the need to handle large file contents during detection. This reduces the data volume from billions of files to billions of compact hash values, significantly simplifying the detection process while maintaining complete malware detection capability
Solution Approach 2:
The patent creates a simplified copy (hash representation) of each file's content that preserves the essential identifying features while occupying minimal storage space. This copy serves as a surrogate for the original file during detection operations, reducing computational complexity while maintaining detection accuracy
Data Source
AI summary
Methods, systems, and devices for data management are described. The method may include obtaining a first backup of a host data store in a host environment, the first backup containing a set of multiple files from the host data store, generating, for one or more files of the set, a respective hash value using content of a respective file of the one or more files, storing the respective hash value for the one or more files of the set of multiple files in a database in association with metadata for the respective file, where the database is indexed based on hash values, querying the database for a hash value generated based on content of a compromised file, and identifying, in response to querying, a latest backup of the host data store of the host environment that does not contain the hash value for the compromised file.