File Context Tag Backup for Malicious Software Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing threat of malicious software attacks, such as ransomware, on computer systems poses a significant risk to important data, as existing technologies fail to effectively detect and prevent attacks that result in data deletion, modification, renaming, or encryption, leading to potential data loss and system disruption.
Innovation Solution
A method and computer system that utilize a file context tag structure to identify and back up specific file types susceptible to malicious attacks, employing a micro filter in kernel mode to monitor I/O requests, check for secure attributes, and perform backups when necessary, thereby preventing malicious software from attacking files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing technologies are used to detect and prevent malicious software attacks, then data protection is attempted, but the detection effectiveness is insufficient and data loss still occurs
Solution Approach 1:
The patent segments the file protection process into distinct stages: I/O request interception, file type identification, backup status checking via file context tags, and conditional backup execution. This segmentation allows each component to focus on a specific task, improving overall detection reliability without requiring a monolithic complex system.
Solution Approach 2:
The patent implements preliminary action by performing file backups before malicious software can execute destructive operations. The system proactively identifies susceptible file types and creates backup copies in advance, ensuring that even if detection fails, the original data remains protected. This preventive approach enhances reliability without proportionally increasing system complexity.
2Reliability
If comprehensive file monitoring and backup processes are implemented, then data loss risk is reduced, but system performance and processing speed decrease
Solution Approach 1:
The patent applies local quality by implementing selective monitoring based on file types. Instead of uniformly monitoring all files, the system identifies specific susceptible file types (e.g., documents, databases) and applies backup operations only to those categories. This targeted approach reduces overall system processing overhead while maintaining protection for critical data.
Solution Approach 2:
The patent uses copying to create backup files that serve as protective replicas. When a file is identified as susceptible, the system creates a copy rather than duplicating the entire file management process. This copying mechanism provides redundancy for data protection while minimizing the performance impact on primary system operations.
3Reliability
If all file types are monitored and backed up, then complete data protection is achieved, but resource consumption and processing overhead increase
Solution Approach 1:
The patent implements local quality by differentiating protection levels across file types. The system identifies susceptible file types and applies comprehensive monitoring and backup only to those categories, while less critical file types receive minimal or no protection. This differentiated approach achieves adequate data protection coverage without uniformly consuming system resources across all files.
Solution Approach 2:
The patent changes the parameter of file susceptibility classification to optimize resource usage. By categorizing files based on their vulnerability to malicious software and business criticality, the system dynamically adjusts which files receive backup protection. This parameter-based classification enables the system to maintain appropriate protection coverage while significantly reducing resource consumption compared to universal monitoring.
Data Source
AI summary
A method for preventing malicious software from attacking files of a computer system includes the following steps. Whether a file type of a specific file corresponding to an input/output (I/O) request is a to-be-backed-up file type is checked, wherein the to-be-backed-up file type belongs to one of multiple predetermined file types susceptible to malicious software attack. When the file type of the specific file is the to-be-backed-up file type, a backup already tag in a file context tag structure of the specific file is checked. When the backup already tag shows that the specific file has not been backed up, a backup process is performed for the specific file.