Snapshot Recovery Chain for Malware-Safe VM Rollback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management systems face challenges in providing reliable data backup and fast recovery, especially in cases of malware attacks, due to increasing data volume and complexity, and the need for efficient data portability across diverse platforms and locations.
Innovation Solution
A snapshot-based malware management system that utilizes a distributed decentralized database and a distributed job scheduler to manage virtual machine snapshots, enabling efficient backup, recovery, and quarantine of infected files, while ensuring fault tolerance and high availability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional malware analysis methods are used, then malware can be detected and analyzed, but the analysis process is time-consuming and requires manual intervention
Solution Approach 1:
The system creates snapshot images of malware samples before actual analysis begins. These snapshots capture the malware's state at a specific point in time, allowing the system to prepare and store analysis data in advance, thereby reducing the time required for subsequent analysis steps.
Solution Approach 2:
The system creates a snapshot copy of the malware sample rather than analyzing the original directly. This snapshot contains all necessary information about the malware's structure, behavior, and characteristics, enabling parallel processing and reducing analysis time while preserving the original sample for further study.
2Loss of information
If comprehensive malware analysis is performed, then detailed information about malware behavior can be obtained, but the complexity of the analysis system increases
Solution Approach 1:
The analysis system is divided into separate functional modules: snapshot creation module, snapshot storage module, and analysis module. Each module handles a specific aspect of the analysis process independently, making the overall system more manageable and easier to maintain while providing comprehensive analysis capabilities.
Solution Approach 2:
The snapshot acts as an intermediary between the malware sample and the analysis system. It captures all necessary information about malware behavior in a standardized format, serving as a bridge that simplifies the interaction between different system components and reduces overall system complexity.
3Productivity
If multiple malware samples are analyzed simultaneously, then productivity increases, but the risk of cross-contamination between samples increases
Solution Approach 1:
The system extracts and isolates essential information from each malware sample into its own snapshot image. This extraction process creates discrete, self-contained data representations that can be analyzed simultaneously without risk of contamination, as each snapshot is independent and preserves only the specific characteristics of its source sample.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Subject matter related to snapshot-based malware management is discussed. A most recent snapshot in a snapshot chain that is not infected by malware may be identified based on mounting snapshots in the snapshot chain and determining whether the snapshots are infected. A graphical user interface showing individual snapshots in the snapshot change and indicating whether the snapshot is infected with malware may be displayed. The graphical user interface may provide a recover function for non-infected snapshots and may not enable the recover function for infected snapshots. A command to recover a non-infected snapshot in the snapshot chain may be received. Based on receiving the command, one or more non-infected snapshot may be recovered or suggested for recovery.