Backup Slice Control for Malware Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data recovery systems fail to accurately identify and restore valid backups from malware attacks, particularly in large organizations where frequent data changes and high volumes of backups complicate the process, and existing solutions lack the ability to determine the time of data corruption, leading to uncertain data validity and completeness.
Innovation Solution
A method that uses an archive connection driver to create a virtual storage medium for antivirus scanning, detects malware, and marks invalid data blocks, ensuring only changed files are scanned, with a block map to track changes and restore data from valid backup slices, and if necessary, from a system image or distribution, to maintain data validity and completeness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus scanning is performed on all backup data, then malware detection capability is improved, but scanning time and computational resources increase significantly
Solution Approach 1:
The backup data is divided into multiple slices, with only changed files scanned by antivirus engines while unchanged files are excluded from scanning. This segmentation approach maintains comprehensive malware detection for modified data while significantly reducing the total scanning volume and time required.
Solution Approach 2:
Instead of scanning all backup data, the system performs partial scanning only on changed files identified through block map comparison. This partial action approach maintains adequate malware detection capability for modified data while reducing overall scanning time and computational resources.
2Reliability
If all backup files are scanned for malware, then data security is improved, but the complexity of the scanning system increases
Solution Approach 1:
The scanning system is segmented into multiple components: block map generation module, changed file identification module, and antivirus scanning module. This segmentation reduces system complexity by dividing the scanning task into manageable stages while maintaining comprehensive data security through systematic processing of backup slices.
Solution Approach 2:
A block map serves as an intermediary data structure that tracks changes between backup slices without requiring full scanning of all files. This intermediary mechanism simplifies the scanning system by providing a efficient way to identify only the files that need antivirus inspection, reducing overall system complexity.
3Loss of information
If the latest backup is restored, then data completeness is improved, but the risk of restoring malware-infected data increases
Solution Approach 1:
The system performs preliminary antivirus scanning on changed files in backup slices before restoration occurs. By scanning modified files in advance and identifying malware infections beforehand, the system prevents infected data from being restored while still allowing complete recovery of clean files from the latest backup.
Solution Approach 2:
The system converts the potential harm of malware in latest backups into a benefit by using antivirus scanning to identify and isolate infected files. The latest backup provides complete data recovery capability, while the antivirus integration transforms the risk of malware restoration into an opportunity to detect and prevent infections, ensuring both completeness and safety.
Data Source
AI summary
The invention relates to data recovery technology. An archive connection driver creates a virtual storage medium that is readable by an operating system, with the operating system running antivirus scanning algorithms on the connected virtual storage medium. Corrupted data and malware are deleted and the relevant data blocks repaired in a connected backup. Corrupted data and infected files are restored in marked invalid data in the backup.