Automated Cloud Malware Remediation via Synchronization History

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Cloud storage users face challenges in effectively addressing malware attacks, particularly ransomware, which can lead to data loss and require time-consuming manual remediation processes, leaving digital content vulnerable despite backup systems.

Innovation Solution

An automated remediation and restoration system that detects malware infections in cloud storage, invokes antivirus services for remediation, and restores files to a pre-infection state by identifying and replacing infected versions with previous versions from synchronization history.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual remediation methods are used to address malware attacks, then users can remove malware from their devices, but the process is time-consuming and complex requiring multiple manual steps that users may have difficulty completing

Engineering Contradiction:
Improvemalware removal effectivenessVSAvoiduser operation simplicity
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The system enables automated self-service remediation where the cloud service automatically detects malware infections through synchronization data analysis, invokes antivirus services, and restores files without requiring user intervention. The system performs multiple manual steps autonomously including detecting infections, coordinating with antivirus services, determining infection times, and restoring files from previous versions.

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The system performs preliminary actions by maintaining synchronization history and previous file versions before malware attacks occur. This pre-prepared data enables rapid automated restoration once an infection is detected, eliminating the need for users to manually recover files from backups after an attack.

Inventive Principle:
Principle #10Preliminary action

2Adaptability or versatility

If cloud storage backup systems are used to protect digital content, then files are stored online and accessible from multiple devices, but users continue to find that their digital content items remain vulnerable to attacks by malware

Engineering Contradiction:
Improvedata accessibilityVSAvoidmalware vulnerability
Core Design Contradiction:
Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The system implements feedback mechanisms by continuously monitoring synchronization data for indicators of malware infections. When malware activity is detected through changes in file synchronization patterns, the system automatically responds by invoking antivirus services and restoring affected files, creating a closed-loop protection system that adapts to threats in real-time.

Inventive Principle:
Principle #23Feedback

Solution Approach 2:

The cloud service acts as an intermediary between the user's device and malware threats. It analyzes synchronization data to detect infections, coordinates with antivirus services for remediation, and manages file restoration, thereby protecting users from direct exposure to malware while maintaining data accessibility across devices.

Inventive Principle:
Principle #24Intermediary (Mediator)

3Productivity

If automated detection and restoration systems are implemented, then malware infections are detected and files are automatically restored, but the system requires analyzing synchronization history and coordinating with antivirus services

Engineering Contradiction:
Improveremediation speedVSAvoidsystem complexity
Core Design Contradiction:
ProductivityVSDevice complexity

Solution Approach 1:

The cloud service performs multiple functions within a single integrated system: it synchronizes files across devices, detects malware infections through synchronization data analysis, coordinates with antivirus services for remediation, determines infection times, and restores files. This multi-functional approach consolidates complexity into a universal platform rather than requiring separate systems for each function.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP3959633B1Automated malware remediation and file restoration management
Publication Date: 2023.11.29 MICROSOFT TECHNOLOGY LICENSING LLC
  • EP3959633B1 patent drawingFigure 1A
  • EP3959633B1 patent drawingFigure 1B
  • EP3959633B1 patent drawingFigure 2

AI summary

A system and method for providing automated service-based malware remediation. When a computing device is attacked by malware such as ransomware, multiple manual steps are usually needed to fully remediate the device. Users are typically required to follow several steps to remove the ransomware, and potentially must engage in the challenging task of reimaging the impacted device as well as choosing a restore point for point-in-time recovery. The disclosed systems provide a mechanism by which a cloud-based service manages a fully automated remediation and file recovery process for the user.