Deleted File Data Analysis for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current information security systems face challenges in detecting malware and computer attacks, particularly when infections occur before security tools are installed or when attackers remove traces of their presence, leading to missed detection of past infections and incomplete analysis of infection chains.
Innovation Solution
A method and system that search for and analyze data from deleted files on a machine-readable medium, reading relevant data into RAM for analysis, and generating notifications when information security threats are detected, using conditions such as readability of file paths and contents, even if files are overwritten or corrupted, to identify malware and computer attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security tools are installed after malware infection, then the system can provide security protection for future threats, but it cannot detect past infections or traces of compromise
Solution Approach 1:
The system performs preliminary scanning of the file system to identify deleted files and their metadata before analyzing them for malware indicators. By proactively searching for traces of compromise in deleted files, the system can detect past infections even after the malware has been removed, resolving the contradiction between providing future security protection and detecting past threats.
2Object-affected harmful factors
If attackers remove traces of their presence by deleting files, then they can hide their activities, but residual data may remain on the storage medium for detection
Solution Approach 1:
The system extracts residual data from deleted files by scanning the file system for file metadata and content that remains on the storage medium after deletion. By separating and analyzing this residual information independently from the file system structure, the system can detect indicators of compromise even when attackers attempt to remove traces, effectively countering the trace removal strategy.
3Measurement precision
If comprehensive analysis of all files is performed, then detection accuracy improves, but analysis time and system resources increase significantly
Solution Approach 1:
The system applies local quality by focusing analysis specifically on deleted files and their metadata rather than performing comprehensive analysis of all files in the system. By concentrating detection resources on the specific location where compromise traces are most likely to exist (deleted files), the system achieves high detection accuracy while minimizing analysis time and resource consumption.
Solution Approach 2:
The system performs partial action by analyzing only the portion of the file system that contains deleted files and their residual data, rather than analyzing every file. This selective approach provides sufficient detection capability for past infections without the excessive time and resource costs of a complete system-wide analysis.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are systems and methods for identifying information security threats. An exemplary method comprises: searching a machine-readable medium of a computer for data corresponding to at least one deleted file, when data corresponding to a deleted file is found, reading at least a portion of the data into RAM, analyzing the read data for information about information security threats, and when information about information security threats is detected, generating notification. In another example, the method comprises: searching for data corresponding to at least one deleted file, when data corresponding to the deleted file is found, checking for a possibility of analyzing the data, when conditions of analysis are satisfied, reading at least a portion of the data into RAM, analyzing the read data for information about information security threats, and when information about information security threats is detected, generating notification about the detected information security threat.