Backup Snapshot Locking for Malicious Modification Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network backup systems face challenges in detecting and mitigating malicious activity, particularly zero-day attacks, as they often rely on library-based countermeasures that may not be updated in time to detect newly developed threats, and existing methods struggle to identify corrupted or modified common files without direct comparison or decryption.
Innovation Solution
A network backup system that uses deduplication and checksums or signatures to identify atypical modifications in common files, monitors file modification behaviors, and locks or duplicates backup snapshots to prevent malicious changes, even if files are encrypted, by maintaining versions of common files prior to modifications and locking backup snapshots.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If library-based countermeasures are used to detect malicious code, then detection accuracy is improved, but the system cannot detect zero-day attacks because the library is not updated in time
Solution Approach 1:
The system performs preliminary actions by creating and storing checksums of common files before malicious modifications occur. These pre-stored checksums enable immediate detection of any deviations from the known good state, eliminating the time delay associated with updating security libraries for zero-day attacks.
Solution Approach 2:
The system creates copies of the desired state of common files through checksums. Instead of relying on continuously updated security libraries, the system maintains reference copies (checksums) of legitimate file states and compares incoming files against these copies, enabling detection without time delay.
2Difficulty of detecting and measuring
If direct comparison or decryption of encrypted files is performed to detect corruption, then detection capability is improved, but system complexity and processing requirements increase
Solution Approach 1:
The system extracts only the essential identifying characteristic of files (their checksums) rather than storing or processing the complete files. This extraction approach enables detection capability while avoiding the complexity of storing, comparing, or decrypting entire encrypted files.
Solution Approach 2:
The system transforms the file detection problem from comparing entire files to comparing checksum parameters. By changing the parameter being compared from the full file content to a condensed checksum representation, the system achieves detection capability with reduced complexity.
3Measurement precision
If backup systems store multiple versions of common files to detect modifications, then detection accuracy is improved, but storage requirements and network bandwidth usage increase
Solution Approach 1:
The system creates a simplified copy (checksum) of each file version instead of storing multiple complete file copies. This approach maintains detection accuracy by preserving the essential identifying characteristic while dramatically reducing storage requirements from full file copies to compact hash values.
Solution Approach 2:
The system changes the state of file version storage from keeping complete file copies to maintaining only checksum parameters. This parameter transformation enables the system to track file versions and detect modifications accurately while minimizing storage consumption.
4Reliability
If the system monitors and locks backup snapshots to prevent malicious changes, then security is improved, but ease of operation and backup flexibility are reduced
Solution Approach 1:
The system performs preliminary actions by creating locked baseline snapshots of common files before potential malicious modifications. These pre-established locked versions serve as reference points that automatically prevent corruption from propagating, maintaining security while allowing normal backup operations to continue with minimal intervention.
Data Source
AI summary
The present disclosure describes systems and methods for detection and mitigation of malicious activity regarding user data by a network backup system. In a first aspect, a backup system receiving and deduplicating backup data from a plurality of computing devices may detect, based on changes in uniqueness or shared rates for files, atypical modifications to common files, and may take steps to mitigate any potential attack by maintaining versions of the common files prior to the modifications or locking backup snapshots. In a second aspect, the backup system may monitor file modification behaviors on a single device, relative to practices of an aggregated plurality of devices. Upon detection of potentially malicious modification activity, a previously backed up or synchronized store of data may be locked and/or duplicated, preventing any of the malicious modifications from being transferred to the backup system.