Event-Labelled Backup Restoration for Rootkit Infection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies for restoring computer systems from malware infections, particularly rootkits, are inefficient and resource-intensive, often failing to detect malware before system reboot, which can lead to unknown malware behavior.
Innovation Solution
A computer security system that includes a rootkit detection system and a backup unit, utilizing system dump sequence analysis and machine learning to detect rootkits and restore the system to a clean state prior to infection by labeling and indexing backup copies corresponding to specific events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full system recovery is performed by scanning and iterating through backup slices, then system restoration is achieved, but the process becomes time-consuming and resource-intensive
Solution Approach 1:
The system performs preliminary actions by creating labeled backup copies at specific points in time before potential malware infection. Each backup is tagged with metadata indicating its creation time and associated events, enabling rapid identification and restoration of the cleanest available backup without needing to scan entire backup slices during recovery operations.
2Difficulty of detecting and measuring
If standard anti-virus scanning is used to detect rootkits, then malware detection is attempted, but rootkits remain undetected due to their hidden nature
Solution Approach 1:
The system performs preliminary actions by capturing system state information and creating labeled backup copies at regular intervals before malware can execute. This allows the system to preserve clean states for restoration even when malware attempts to hide during detection scans.
Solution Approach 2:
Instead of attempting to detect hidden rootkit malware through scanning, the system creates copies of the system state at labeled time points. When infection is suspected, the system restores from the most recent clean backup copy rather than attempting to scan and detect the hidden malware, thereby avoiding the detection accuracy problem.
3Ease of operation
If system restoration is performed without event labeling, then backup retrieval is simplified, but the system cannot identify the clean copy preceding the infection event
Solution Approach 1:
The system performs preliminary actions by labeling backup copies with metadata about their creation time and associated system events. This labeling occurs in advance and enables precise identification of the clean backup copy that preceded the infection event, combining ease of operation with accurate identification through the labeled metadata structure.
Data Source
AI summary
The present disclosure relates to a system and method for creating a backup and restoring the exact clean system state prior to malware detection. The system includes a security system, in communication with one or more applications of a computing system, and a backup unit. The security system detects malware during execution of the applications or events based on a memory dump analysis. The backup unit creates a backup copy of the system state corresponding to each event, labels each copy and creates an index. When the security system detects presence of the malware at a particular event, the backup system parses the index, and with use of the labels, retrieves the exact backup copy that belongs to the event preceding the other event that caused the malware attack.