Database Replication Risk Evaluation for Malware Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems face challenges in quickly recovering from data-destructive malware attacks, as traditional security measures often disable malicious code without restoring files, disrupting system operation.
Innovation Solution
Implementing a data replication system with multiple versions of a database across servers, where modifications are evaluated based on a security profile to determine risk levels, allowing or preventing changes on secondary servers, and using delayed replication to isolate and recover from malicious transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security software disables or removes detected malware code, then malicious actions are prevented, but files modified by malware are not restored and system operation remains disrupted
Solution Approach 1:
The system performs preliminary actions by creating and maintaining backup copies of files before malware can modify them. When malware is detected, the pre-existing backups enable immediate restoration without disruption to system operation, resolving the contradiction between preventing malicious actions and maintaining ease of operation.
Solution Approach 2:
The system prepares compensatory measures in advance by continuously maintaining backup versions of files. This beforehand cushioning ensures that when malware attacks occur, the system has pre-prepared restoration capabilities, preventing operational disruption while maintaining security.
2Ease of operation
If files are restored after malware attack, then system operation can be recovered, but traditional backup procedures are lengthy and time-consuming
Solution Approach 1:
The system maintains continuous backup operations, ensuring that backup copies are always available and synchronized with current file states. This continuous useful action eliminates the need for time-consuming backup procedures during restoration, enabling immediate system recovery while maintaining ease of operation.
Solution Approach 2:
The system uses copying to create and maintain backup versions of files in real-time. These copies are kept ready for immediate restoration, eliminating the need for lengthy backup procedures during attack recovery and significantly reducing loss of time.
3Reliability
If data replication is implemented across multiple servers, then system availability is improved, but complexity of managing replicated databases increases
Solution Approach 1:
The system merges the functions of multiple data servers into a unified replication management architecture. By combining backup management, replication control, and restoration operations into an integrated system, the complexity of managing replicated databases is reduced while maintaining high system availability.
Solution Approach 2:
The replication management system performs multiple functions including backup creation, replication coordination, malware detection, and restoration operations. This multi-functionality reduces the need for separate management systems, thereby reducing overall device complexity while improving reliability through distributed data replication.
Data Source
AI summary
Example systems and methods are disclosed for protection of data servers configured for data replication of a database. An example system includes a processing circuit configured to receive records indicating respective modifications performed on a first version of the database stored in a first data server of the plurality of data servers. The processing circuit determines a risk level of a modification indicated by a record based on a set of factors indicated in a security profile, the set of factors being indicative of anomalous data access activity. The processing circuit performs the modification in a second data server, in response to the risk level being less than a threshold level indicated in the security profile. The processing circuit prevents the modification indicated by the record from being performed in the second data server in response to the risk level being greater than or equal to the threshold level.