Malware-Aware Restore Point Selection for System Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current backup and restore technologies are ineffective in identifying the point of malicious software infection in computer systems, leading to potential restoration of infected snapshots and loss of valuable data.
Innovation Solution
A system that monitors system operations to predict the point of malware infection and creates restore points based on suspicious activity, allowing for intelligent recommendation of the best restore point for recovery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If scheduled snapshots are taken at fixed intervals, then the system can recover from hardware crashes, but the system cannot identify malware infection points
Solution Approach 1:
The system performs preliminary actions by monitoring system operations and creating restore points before malware infections occur. The behavior monitor continuously tracks system events and scores them for suspicious activity, preparing restore points in advance so that when malware is detected, the system can immediately identify the infection point without having to manually test multiple restore points.
Solution Approach 2:
The system implements feedback by using malware detection results to inform the restore point selection process. When malware is detected, the system queries restore points in chronological order starting from the most recent, using the detection information to systematically identify which restore point marks the beginning of the infection, thereby resolving the contradiction between having restore points and being able to identify the correct one.
2Ease of operation
If manual snapshots are taken at milestones, then the user can restore to known good states, but the user cannot determine when infection occurred
Solution Approach 1:
The system performs self-service by automatically monitoring system operations, scoring events for suspicious activity, and creating restore points without user intervention. The behavior monitor continuously analyzes system events and generates restore points based on detected anomalies, eliminating the need for users to manually determine when infections occurred while maintaining ease of operation through automated restore point management.
3Reliability
If restore points are stored in protected system files, then the system maintains restore functionality, but virus scanning cannot detect malware in restore points
Solution Approach 1:
The system performs preliminary malware detection and analysis before restore points are finalized. The behavior monitor continuously scores system events for suspicious activity and identifies potential malware infections in advance, allowing the system to flag problematic restore points before they are used for recovery, thereby maintaining both restore functionality and malware detection capability.
Solution Approach 2:
The system implements feedback by using malware detection results to inform restore point selection. When malware is detected in the system, the feedback mechanism queries restore points in chronological order to identify which one marks the beginning of the infection, enabling the system to provide accurate infection point identification while maintaining the protected system file structure.
4Reliability
If the user restores from an earlier snapshot to be safe, then malware-free recovery is achieved, but valuable data is lost
Solution Approach 1:
The system implements feedback by using malware detection information to guide restore point selection. When malware is detected, the system queries restore points in chronological order starting from the most recent, using the detection feedback to identify the precise point where infection began. This allows users to restore to the latest possible malware-free state, achieving reliable malware-free recovery while minimizing data loss by not unnecessarily restoring from much earlier points.
Data Source
AI summary
A computer system operation registers as an event when an operation potentially characteristic of malware occurs. Events are scored and when a threshold is reached indicative of a possible malware infection a restore point is created. Many restore points are created. When a user decides to restore the system because of the presence of malware a malware report is retrieved. The malware report describes characteristics of a particular piece of malware. The malware report is compared to the restore point logs that had been created earlier. Any number of malware reports are compared to the restore point logs. A restore point log that shares many of the same system changes or other effects also present in a malware report is likely to be an indication of the beginning of a malware infection. The matched restore point log is recommended to the user as the best restore point.