Deleted File Data Analysis for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing information security technologies face challenges in detecting malware and computer attacks, particularly when attackers remove traces of infection, leading to low detection rates of past infections and missed threats, especially with new, unknown malware exploiting zero-day vulnerabilities.
Innovation Solution
A method and system that search for and analyze data from deleted files on a machine-readable medium, reading relevant data into RAM for analysis, generating notifications about detected information security threats, including malware and computer attacks, even if traces have been removed, using conditions such as readability and integrity of deleted file data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security tools use traditional detection methods (signature-based, heuristic analysis, behavioral analysis), then they can detect active malware infections, but they cannot detect past infections when attackers have removed traces of infection
Solution Approach 1:
The system performs preliminary actions by creating and storing backup copies of files before they are deleted or modified by attackers. These backup copies preserve indicators of compromise (IOCs) and infection chain information that would otherwise be lost when attackers remove traces of their attacks
Solution Approach 2:
The system creates copies of files and their metadata at different points in time, allowing security analysis of historical file states. By copying and preserving deleted or modified files in backup storage, the system enables detection of past infections even after attackers have attempted to erase evidence
2Object-generated harmful factors
If attackers remove traces of infection after malware installation, then they can hide their presence, but security tools cannot detect the infection chain or indicators of compromise
Solution Approach 1:
The system performs preliminary backup of files before attackers can remove them, preserving the infection chain evidence in advance. By proactively creating backup copies with complete metadata and content, the system ensures that indicators of compromise remain available for later analysis
Solution Approach 2:
The system creates and preserves copies of infected files and their metadata in backup storage, allowing security tools to analyze the complete infection chain including droppers, downloaders, and payload relationships that would otherwise be destroyed by attackers
3Reliability
If security tools are installed after malware infection occurs, then they can provide ongoing protection, but they cannot detect infections that occurred before their installation
Solution Approach 1:
The system performs preliminary backup and preservation of file data from before the security tool installation, enabling immediate analysis of historical infection evidence without waiting for new infections to occur
Solution Approach 2:
The system copies and preserves historical file states and metadata in backup storage, allowing security analysts to immediately examine past infections, infection chains, and indicators of compromise as soon as the security tool is deployed, eliminating the time loss associated with retroactive detection
Data Source
AI summary
Disclosed herein are systems and methods for identifying information security threats. In one aspect, an exemplary method comprises: searching a machine-readable medium of a computer for data corresponding to at least one deleted file, when data corresponding to a deleted file is found, reading at least a portion of the data into RAM, analyzing the read data for information about information security threats, and when information about information security threats is detected, generating notification. In another aspect, the method comprises: searching for data corresponding to at least one deleted file, when data corresponding to the deleted file is found, checking for a possibility of analyzing the data, when conditions of analysis are satisfied, reading at least a portion of the data into RAM, analyzing the read data for information about information security threats, and when information about information security threats is detected, generating notification about the detected information security threat.