Malware Recovery via Snapshot Forensics and Recursive Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware attacks result in significant data loss and recovery costs due to delayed detection and the need for restoring data from outdated backups, as malware can corrupt files in ways that evade scanners and complicate forensic analysis.
Innovation Solution
A method involving frequent data backups in the form of snapshots, forensic scanning to identify corrupted files, and restoration of files to their uncorrupted versions, along with maintaining an event log to track modifying writes and recursive scanning to identify and restore at-risk files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If frequent data backups are made, then data recovery speed is improved, but storage space requirements increase
Solution Approach 1:
The patent implements incremental backups where each backup stores only the changes since the previous backup, nesting the backup structure so that full backups contain base data and subsequent backups contain only deltas or differences, reducing overall storage requirements while maintaining rapid recovery capability
Solution Approach 2:
The backup system divides data into multiple segments or blocks, backing up only modified segments rather than entire files, allowing frequent backups with minimal storage overhead while enabling fast recovery by restoring only necessary segments
2Reliability
If entire volumes of data are restored from backups, then data integrity is improved, but recovery time increases
Solution Approach 1:
The system extracts and restores only the specific corrupted files or data blocks that are affected by malware, rather than restoring entire volumes, maintaining data integrity for affected files while dramatically reducing recovery time by excluding unaffected data
Solution Approach 2:
The patent applies partial action by performing selective restoration of only the necessary portions of data that contain malware or are corrupted, rather than restoring complete volumes, achieving sufficient data recovery with reduced time and resource expenditure
3Difficulty of detecting and measuring
If malware scanners are used to detect attacks, then detection capability is improved, but malware can evade detection through modification techniques
Solution Approach 1:
The system creates baseline profiles of normal file characteristics (hashes, digital signatures, structural properties) before malware infection, enabling detection of deviations that indicate compromise even when malware attempts to evade traditional scanners through modification or obfuscation techniques
Data Source
AI summary
A method and computer program product with encoded instructions provides for repeatedly making data backups for files by making a series of snapshots of file storage volumes containing the files. The method and computer product further provide for determining that a malware attack has occurred, identifying corrupted files and, for each corrupted file, scanning the series of snapshots to identify an uncorrupted version of the file. Each corrupted file is restored to an uncorrupted version thereof. An event log contains write events and snapshot creation events corresponding to creation of each of the snapshots. A forensic scan scans the event log to determine modifying writes made by the corrupted files and which modified further files. The further files are restored to unmodified versions thereof. A list of at-risk files includes the corrupted files and the further files and the forensic scan is repeated on the at-risk files.