Snapshot Malware Detection With Safe Recovery Point Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management systems face challenges in maintaining up-to-date malware scans, especially with emerging strains, and lack historical records for safe recovery points upon detection, leading to inefficiencies in data backup and recovery processes.
Innovation Solution
A data management system (DMS) maintains a malware threat feed with updated intelligence, performing incremental scans on new snapshots and full scans based on newly acquired intelligence to ensure all files are scanned with current malware detection, and identifies safe recovery points by tracking the first snapshot of malware introduction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If incremental scans are performed on new snapshots only, then scan performance and speed are improved, but detection reliability deteriorates because historical malware introduction points cannot be identified
Solution Approach 1:
The scan process is segmented into two complementary types: incremental scans for new snapshots (for speed) and full scans for historical snapshots (for reliability). The system maintains both scan types and applies them appropriately to different snapshot groups, resolving the contradiction between speed and thoroughness.
Solution Approach 2:
The system performs preliminary full scans on historical snapshots to establish a baseline of malware-free states before the current time. This preliminary action creates reference points that enable reliable identification of malware introduction points when combined with incremental scanning of new snapshots.
2Reliability
If full scans are performed on all snapshots, then detection reliability is improved, but productivity and time required for scanning deteriorate
Solution Approach 1:
Snapshots are segmented into historical snapshots (prior to current time) and new snapshots (current time). Different scanning strategies are applied to each segment: full scans for historical snapshots to establish clean baselines, and incremental scans for new snapshots to maintain speed. This segmentation resolves the contradiction by applying the right scan type to the right data.
Solution Approach 2:
The scanning strategy is dynamic rather than static. The system adapts its scanning behavior based on the snapshot type and time, switching between full and incremental scans as needed. This dynamic approach allows the system to maintain both high reliability and productivity by optimizing scan methods for each specific context.
3Reliability
If endpoint protection is used for malware scanning, then detection capability is improved, but loss of historical records deteriorates because safe recovery points cannot be identified
Solution Approach 1:
The system performs preliminary full scans on historical snapshots to identify and record safe recovery points before malware introduction. This preliminary action preserves historical information about clean states, enabling later identification of safe recovery points when malware is detected, thus resolving the information loss problem.
Solution Approach 2:
The system uses feedback from full scans of historical snapshots to establish a knowledge base of safe states. When incremental scans detect malware in new snapshots, the system references the feedback from historical scans to identify the exact point of contamination and determine safe recovery points, thereby recovering lost historical information.
4Measurement precision
If malware intelligence is updated continuously, then detection accuracy is improved, but device complexity and resource requirements deteriorate
Solution Approach 1:
The system performs preliminary updates of malware intelligence by incorporating new intelligence data before it is needed for scanning. This preliminary action ensures that the most current detection capabilities are ready to be applied immediately to new snapshots, improving accuracy without requiring complex real-time updates during the scanning process.
Solution Approach 2:
The malware intelligence system is dynamic, automatically updating detection rules and signatures as new threats emerge. The system adapts its scanning behavior based on the timing and nature of intelligence updates, applying full scans when new intelligence is received and incremental scans when using existing intelligence, thus managing complexity through adaptive behavior.
Data Source
AI summary
Methods, systems, and devices for data management are described. A data management system (DMS) may maintain a malware threat feed that includes updated (e.g., periodically or continuously updated) malware intelligence. For example, the malware intelligence may involve YARA rules and known hashes indicative of malware. The DMS may use the malware intelligence to scan each new snapshot of a customer computing system to determine if the new snapshot contains malware. The DMS may periodically, or in response to reception of new malware intelligence, check the files within the most recent snapshot of each computing system for a customer to determine whether any computing system of the customer contains malware. When malware is detected in a file within a snapshot—either based on checking a newly captured snapshot or when checking snapshots based on new malware intelligence—the DMS may determine the temporally first snapshot which contained the corrupted file.