Backup Image Malware Cleanup via I/O Recording
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems face challenges in effectively cleaning malware from backup images, which can remain infected even after resolving the infection on production machines, leading to potential secondary infections and data loss.
Innovation Solution
A system and method for cleaning malware from backup images by isolating infected data storage systems, recording I/O operations, applying malware removal techniques, and generating a log of affected locations to selectively clean storage locations, allowing for efficient removal of malware without re-scanning each image.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If backup images are retained after malware removal from production machines, then data retention is improved, but the risk of secondary infection increases
Solution Approach 1:
The patent applies preliminary action by recording I/O operations during the malware removal process on the primary storage system before the backup system is exposed to the cleaned data. This allows the backup system to receive pre-cleaned data without needing to perform its own scanning, thus retaining the backup images while eliminating the malware threat beforehand.
Solution Approach 2:
The patent uses an intermediary mechanism (I/O recording and replication system) that sits between the primary storage system and backup storage system. This intermediary captures the malware removal operations and replicates them to the backup, effectively mediating the transfer of clean data without requiring the backup system to directly handle potentially infected images.
2Measurement precision
If backup images are scanned for malware, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The system performs malware detection and removal actions in advance on the primary storage system, recording the I/O operations during this process. The backup system then simply replicates these pre-determined clean states without performing its own time-consuming scans, thus achieving high detection accuracy without the time penalty.
Solution Approach 2:
Instead of scanning backup images independently, the system creates a copy of the malware removal operations (I/O records) from the primary system and applies them to the backup. This copying approach eliminates redundant scanning while ensuring the backup receives the same cleaned data, maintaining detection accuracy without additional processing time.
3Reliability
If all backup images are destroyed to ensure cleanliness, then reliability is improved, but data loss increases
Solution Approach 1:
The patent applies preliminary action by pre-cleaning the backup images through I/O recording of malware removal operations before any restoration occurs. This allows the system to maintain backup images with high reliability (cleanliness) while preserving all legitimate data, as the cleaning process selectively removes only malware rather than destroying entire images.
Solution Approach 2:
The patent converts the potential harm of having infected backups into a benefit by using the backup system to store and replicate the recorded I/O operations from the primary system's malware removal process. The backup images that would normally be harmful (potentially infected) become beneficial, serving as a verified clean source for restoration after the primary system is cleaned.
4Productivity
If I/O recording is applied to clean backup images, then cleaning efficiency is improved, but system complexity increases
Solution Approach 1:
The patent applies universality by designing the I/O recording system to serve multiple functions: it records normal I/O operations for backup purposes, records malware removal operations for cleaning purposes, and enables replication to multiple backup targets. This multi-functionality achieves high cleaning efficiency without proportionally increasing system complexity, as the same infrastructure serves multiple purposes.
Data Source
AI summary
Embodiments described herein perform cleanup of backup images of a storage system by applying a record of I/O operations recorded while performing anti-malware operations on the storage system. The recording of the I/O operations can be replayed to resolve malware infections in the backup images, snapshots, or replicas of the storage system without requiring a restore-cleanup cycle for each backup image.