Malware Detection via Backup Restoration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus systems fail to detect and effectively respond to day-zero malware attacks, often resulting in incomplete cleaning or deletion of infected objects, which can leave artifacts and make it difficult to restore systems to a pre-infection state due to unknown infection times.
Innovation Solution
A system and method that combines intrusion protection systems with archiving and threat analysis to detect and eradicate day-zero malware by identifying and replacing infected objects with clean backup copies, using pattern recognition and anomaly detection to determine the infection point and restore objects to a pre-infection state, thereby simplifying recovery and reducing costs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based virus scanning is used, then detection accuracy for known viruses is improved, but the ability to detect day-zero attacks deteriorates
Solution Approach 1:
The system performs preliminary actions by creating and storing backup copies of objects before infection occurs. When a day-zero attack is detected through anomaly analysis, the system can restore from these pre-existing clean backups, eliminating the need to detect the specific malware signature in advance.
Solution Approach 2:
The patent introduces backup copies as an intermediary element between the original object and the infection. These backups serve as a mediating resource that allows system restoration without requiring direct detection or analysis of the unknown malware, bridging the gap between detection capability and recovery.
2Productivity
If cleaning or repair attempts are made on infected objects, then data recovery is improved, but the risk of leaving artifacts or damage increases
Solution Approach 1:
Instead of attempting to clean or repair the infected object, the system creates and uses a copy (backup) of the object from before infection. This copying approach ensures complete recovery of the original clean state without risking artifacts or damage that would result from cleaning operations on the infected file.
3Object-affected harmful factors
If deletion or quarantine of infected objects is performed, then spread prevention is improved, but object availability deteriorates
Solution Approach 1:
The system extracts the infected portion (the malware) from the object by restoring only the clean backup portions. Instead of removing the entire object through deletion or quarantine, the harmful elements are selectively removed while preserving the legitimate object content and maintaining availability.
4Reliability
If system restoration to pre-attack state is attempted, then data integrity is improved, but the process complexity increases due to unknown infection time
Solution Approach 1:
The system performs preliminary backup actions at regular intervals, creating a timeline of clean states. When infection occurs at an unknown time, the system can search through these pre-established backups to find the most recent clean version, simplifying the restoration process despite unknown infection timing.
Solution Approach 2:
The system uses feedback from anomaly detection results to guide the restoration process. By analyzing changes between backup versions and identifying when anomalies first appeared, the system automatically determines which backup version to restore, reducing the complexity of manual intervention.
Data Source
AI summary
A method for protecting objects in a computer system against malware is disclosed. An object is analyzed to determine whether it is infected by malware, and if it is determined to be infected, a backup copy of the object is located in a backup of the objects. The infected object is replaced with the backup copy.