Malware Process Tracking for Backup-Safe File Purging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to effectively detect and mitigate malware, particularly ransomware, which can infect production systems and backups, leading to data inaccessibility and prolonged recovery times, complicating operations and involving law enforcement or insurance companies.
Innovation Solution
A forensic engine is used to track and learn the operational characteristics of malware, allowing it to emulate communications and potentially trick the malware into sending a response back to its source, while generating snapshots for analysis in a sandbox environment to understand and mitigate its effects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional backup systems are used to protect against data loss, then data availability is improved, but the system becomes vulnerable to malware infection of backups
Solution Approach 1:
The system segments the backup environment from the production environment by creating isolated sandbox instances. Each sandbox is a separate, controlled environment where malware can be safely analyzed without affecting the main production system or primary backups. This segmentation allows the system to maintain reliable backups while protecting them from malware infection.
Solution Approach 2:
The patent introduces a forensic engine and sandbox environment as an intermediary layer between the production system and backups. This intermediary captures and analyzes malware behavior before it can infect critical systems or backups, acting as a buffer that protects the primary data storage while maintaining data availability.
2Difficulty of detecting and measuring
If malware detection and analysis systems are implemented, then malware identification capability is improved, but system complexity increases
Solution Approach 1:
The system creates simplified copies of the production environment in the form of sandbox instances. These sandboxes replicate the necessary system characteristics for malware analysis but with reduced complexity and isolation boundaries. This allows effective malware detection while managing system complexity through controlled replication rather than full system duplication.
Solution Approach 2:
The patent employs disposable sandbox instances that can be quickly created, used for malware analysis, and then discarded or reset. These temporary environments are less complex than permanent analysis systems and can be rapidly provisioned and deprovisioned, reducing the overall system complexity while maintaining high detection capability.
3Loss of information
If comprehensive malware analysis is performed in production environment, then malware understanding is improved, but operational disruption increases
Solution Approach 1:
The system performs preliminary malware analysis in isolated sandbox environments before malware can disrupt production operations. By capturing and analyzing malware behavior in advance in a controlled setting, the system gains understanding of threat patterns without allowing the malware to execute against production systems, thereby maintaining operational continuity.
Solution Approach 2:
The sandbox environment serves as an intermediary space that enables comprehensive malware analysis without direct interaction with the production system. This mediator allows full malware behavior observation while physically and logically isolating the analysis from production operations, preventing operational disruption while maintaining productivity.
Data Source
AI summary
Processes operating in a computing system are tracked. The tracking data includes or identified child processes, parent processes, and/or files associated with operation of the processes. When a process is determined to be a malware process, protective operations are performed. Protective operations may include removing or purging the malware process and all processes/files associated with the malware process in the tracking data. An infected snapshot may also be generated such that characteristics, operating procedures, and other aspects of the malware can be determined by recovering the infected snapshot to a sandbox environment and allowing the malware to execute therein.