Protection Controller With Pre-Write Backup for Ransomware Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection techniques are ineffective in mitigating the risk of malware attacks, leading to significant pecuniary loss and data loss due to non-instantaneous detection and data accumulation during periodic backups.
Innovation Solution
A protection controller that generates a backup copy of a file before any modification upon receiving a WRITE request, monitors for ransomware, and recovers the file using the backup copy if ransomware is detected, providing both file-level and block-level protection to eliminate the adverse effects of ransomware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If periodic backups are used to mitigate malware risk, then data loss between backup intervals is acceptable, but significant pecuniary loss and data loss occur due to the time interval between backups
Solution Approach 1:
The protection controller creates backup copies of files before modifications are made, rather than waiting for periodic backup intervals. This preliminary action ensures that if ransomware encrypts a file, the original unencrypted version is already preserved, eliminating data loss between backup intervals while maintaining system performance.
2Reliability
If conventional malware detection techniques are used, then malware can be detected, but detection is non-instantaneous leading to significant pecuniary loss and data loss
Solution Approach 1:
The protection controller performs preliminary actions by creating backup copies before file modifications occur. This allows for immediate detection and recovery if ransomware is detected, eliminating the time delay associated with conventional malware detection and response mechanisms.
3Reliability
If backup copies are generated before every WRITE request, then zero-loss ransomware protection is achieved, but resource utilization increases
Solution Approach 1:
The protection controller applies backup creation selectively based on local conditions - specifically when WRITE requests are detected. This local quality approach ensures backup protection is applied precisely where and when needed (at the point of potential ransomware impact) rather than universally, optimizing resource utilization while maintaining zero-loss protection.
4Reliability
If backup copies are retained indefinitely for ransomware recovery, then file recovery is ensured, but storage resource utilization increases
Solution Approach 1:
The protection controller retains backup copies only temporarily - specifically until the associated process completes or times out. Once the process is terminated or times out, the backup copy is discarded. This temporary retention strategy ensures file recovery capability is maintained during the critical window while minimizing long-term storage resource consumption.
Data Source
AI summary
A protection controller configured to operate in a computer system, including a process, an operating system and at least one memory disk. The protection controller is further configured to receive a memory disk request for a file, determine that the memory disk request is a WRITE request indicating a modification to the file, and, in response thereto, generate a backup copy of the file prior to the modification. Furthermore, the protection controller is configured to determine that the process includes ransomware and, in response thereto, recover the file based on the backup copy to provide zero-loss ransomware protection to the computer system with an improved overall data security.