Backup Generation With Slack Detection for Hidden Malicious Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection solutions fail to account for data stored in disk slacks, which are vulnerable to malicious data and not detected by conventional methods, posing a security risk.
Innovation Solution
Identify and generate slack metadata for disk slacks, providing this information to post-processing engines for cybersecurity and anomaly detection to ensure no nefarious data is stored in these areas.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional backup methods are used, then backup generation is simple and fast, but security against malicious data in disk slacks is compromised
Solution Approach 1:
The backup process is segmented into multiple stages: conventional backup generation, post-processing phase, and slack detection phase. The data protection agent separates the detection of slack spaces from the main backup workflow, allowing conventional backups to proceed while adding security checks in a dedicated post-processing stage that analyzes file system metadata to identify and secure malicious data in disk slacks.
Solution Approach 2:
The system performs preliminary identification of slack spaces before finalizing the backup process. By analyzing file system metadata and identifying unused disk sectors in advance, the system can prepare security measures and anomaly detection protocols before the actual backup is completed, ensuring that malicious data in slacks is detected and handled appropriately.
2Measurement precision
If disk slacks are monitored for security, then detection capability improves, but processing time increases
Solution Approach 1:
The system implements periodic action by performing slack space analysis in a post-processing phase rather than continuously during backup generation. The data protection agent conducts anomaly detection at specific intervals after backup completion, using scheduled tasks or triggers based on backup completion events, which maintains high detection precision while minimizing impact on overall backup processing time.
Solution Approach 2:
The system skips detailed slack analysis during the main backup process by using quick identification methods that rely on file system metadata. The data protection agent performs rapid initial scanning to identify potential slack spaces, then applies more thorough anomaly detection only to identified candidates, rushing through the majority of the disk while focusing detailed analysis on specific areas of concern.
Data Source
AI summary
Techniques described herein relate to a method for performing generating backups of host data. The method may include obtaining a backup request associated with an asset of the host; obtaining file system metadata associated with the asset from a file system metadata repository; identifying data in a disk of the host associated with the asset based the file system metadata; obtaining file size and cluster size associated with each file of a file system using the file system metadata; making a determination that the actual size and cluster size do not match for at least one file of files of a file system; identifying a difference between the actual size and the cluster size of the at least one file of files; identifying the difference as slacks; generating slack metadata associated with the slacks; and providing slack data and the slack metadata to post processing engines.