Computer Recovery System with Clean Backup Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing disaster recovery processes for computer systems are time-consuming and complex, especially after malware or ransomware attacks, as they often restore infected states and require significant operator skill, leading to financial and reputational risks.
Innovation Solution
A computer-implemented method that searches for clean backup copies without infection signatures to restore machines to a pre-infection state, using a graphical user interface to manage the recovery process and isolate machines during restoration, ensuring a secure and efficient recovery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing disaster recovery processes are used to restore computer systems after malware attacks, then the system can be restored to operational state, but the recovery process is time-consuming and complex, and may restore infected states
Solution Approach 1:
The system performs preliminary actions by scanning backup copies for malware signatures before restoration begins, identifying clean backup copies in advance. This prevents the time-consuming process of discovering infected backups after restoration has started, thereby resolving the contradiction between ensuring system cleanliness and reducing recovery time.
Solution Approach 2:
The system introduces an intermediary scanning and identification process between the backup storage and restoration operations. This intermediary layer filters out infected backups and identifies clean ones, allowing the restoration process to proceed quickly with guaranteed cleanliness, thus resolving the time-quality contradiction.
2Ease of operation
If existing disaster recovery processes are used, then restoration can be performed, but the process requires significant operator skill and is complex to implement
Solution Approach 1:
The system performs self-service by automatically scanning backup copies, identifying clean ones, and preparing restoration processes without requiring operator intervention for each step. The automated malware signature scanning and clean backup identification eliminates the need for operators to manually inspect backups, significantly reducing skill requirements while maintaining process simplicity.
Solution Approach 2:
The system performs preliminary scanning and identification of clean backups before the operator needs to initiate restoration. This preliminary action automates the complex analysis work, presenting only simple restoration commands to the operator, thereby reducing both complexity and skill requirements.
3Productivity
If backup copies are restored without verification, then recovery speed is increased, but malware may be re-seeded to the system
Solution Approach 1:
The system performs preliminary malware signature scanning on all backup copies before restoration begins, identifying clean backups in advance. This allows rapid restoration of verified clean backups without the need for post-restoration scanning, thereby achieving both high recovery speed and protection against malware re-seeding.
Solution Approach 2:
The system applies preliminary anti-action by scanning for and identifying malware signatures in backup copies before restoration. This preventive measure blocks the potential re-seeding of malware by ensuring only clean backups are restored, while the automated nature of the scan maintains high recovery speed.
Data Source
AI summary
A computer-implemented method can be used for restoring a computer system following an infection event. The computer system can have a plurality of machines, in which a plurality of back-up copies are associated with each one of the plurality of machines, and in which each of the plurality of back-up copies associated with a particular machine is a different version back-up. The method can include searching the plurality of back-up copies to identify one or more clean-back-up copies that do not comprise a signature of the infection event and restoring one or more of the plurality of machines using a respective clean-back-up copy.