Data Modification Interception for Malicious Software Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus methods are ineffective in protecting user data from modification by malicious software, as they fail to timely initiate backup data copying and assess the threat level accurately, leading to significant resource utilization and data integrity issues.
Innovation Solution
A system and method that intercepts data modification requests, analyzes parameters to determine if a backup is needed, generates and stores a backup copy, and blocks malicious processes by intercepting API calls and analyzing process parameters to assess threat levels, thereby restoring data from backups.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If backup copying is performed continuously to protect data from modification, then data protection reliability is improved, but computer resource consumption (processor time, hard disk space) increases significantly
Solution Approach 1:
The system performs preliminary analysis of program requests before data modification occurs. It intercepts API calls, analyzes program parameters and behavior patterns, and determines threat levels in advance. Backup copying is triggered only when malicious activity is detected, rather than continuously, thus maintaining data protection while reducing unnecessary resource consumption.
Solution Approach 2:
The system implements a feedback mechanism where program behavior is continuously monitored and analyzed. The analysis results feed back into the decision-making process for initiating backup operations. This closed-loop control ensures backup copying is performed only when actually needed based on real-time threat assessment, optimizing the balance between protection reliability and resource efficiency.
2Use of energy by moving object
If backup copying is delayed until after malicious software modifies data, then resource consumption is reduced, but data integrity is compromised
Solution Approach 1:
The system performs preliminary analysis of program requests before data modification occurs. It intercepts API calls, analyzes program parameters and behavior patterns, and determines threat levels in advance. Backup copying is triggered only when malicious activity is detected, rather than continuously, thus maintaining data protection while reducing unnecessary resource consumption.
3Reliability
If all data modification requests are blocked to protect data integrity, then data protection is improved, but legitimate program operations are hindered
Solution Approach 1:
The system introduces an intermediary analysis layer between the program and the data. Instead of directly blocking or allowing modifications, it intercepts API calls, analyzes program parameters and behavior patterns, and makes intelligent decisions. This intermediary mechanism distinguishes between legitimate and malicious operations, protecting data integrity while allowing smooth operation of authorized programs.
Solution Approach 2:
The system implements a feedback mechanism where program behavior is continuously monitored and analyzed. The analysis results feed back into the decision-making process for initiating backup operations. This closed-loop control ensures backup copying is performed only when actually needed based on real-time threat assessment, optimizing the balance between protection reliability and resource efficiency.
4Measurement precision
If thorough analysis of program parameters is performed to accurately identify malicious software, then detection precision is improved, but processor time consumption increases
Solution Approach 1:
The system applies partial analysis to all program requests and excessive (thorough) analysis only to suspicious cases. It first intercepts API calls and performs initial parameter checking, then conducts more intensive analysis only when malicious behavior patterns are detected. This staged approach maintains high detection precision while avoiding unnecessary processor time consumption on legitimate programs.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed is a system and method for restoring modified data. An example method includes intercepting, by an activity tracking module, a request from a program to modify data; determining, by an analysis module, parameters of the intercepted request; generating, by the analysis module, a request to generate a backup copy of the data based on at least one of the determined parameters of the intercepted request; and generating and storing, by a backup module, the backup copy of the data in an electronic database.