Virtual Volume Sparse Files for Malware Inspection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current virus and malware detection methods in backup archives require full scanning of large archives, which is time-consuming and resource-intensive, especially when archives are stored in the cloud, and do not allow for scanning at arbitrary time points or repair of infected data.

Innovation Solution

The method involves generating a virtual volume with empty sparse files that represent files in a backup slice, comparing file information across different time points, retrieving changed content, and scanning for viruses, with infected files being removed to create a cured slice.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If full scanning of large archives is performed, then virus and malware detection completeness is improved, but scanning time and computational resource usage increase significantly

Engineering Contradiction:

Improvevirus and malware detection completenessVSAvoidscanning time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The archive is divided into multiple slices, each representing a point in time. Instead of scanning the entire archive at once, the system scans individual slices separately, allowing parallel processing and reducing the time required for complete archive scanning while maintaining detection completeness.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary actions by creating virtual volumes from archive slices before actual virus scanning. Empty sparse files are pre-created to represent files in the archive, and the virtual volume structure is prepared in advance, enabling faster subsequent scanning operations.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If full scanning of large archives is performed, then virus and malware detection completeness is improved, but computational resource usage increases significantly

Engineering Contradiction:

Improvevirus and malware detection completenessVSAvoidcomputational resource usage

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The archive is segmented into multiple slices that can be processed independently. This allows computational resources to be distributed across multiple smaller scanning tasks rather than concentrating all resources on a single large-scale scan, improving resource efficiency while maintaining complete detection coverage.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system creates virtual copies (virtual volumes) of archive slices in memory rather than repeatedly accessing the physical archive storage during scanning. This copying approach reduces I/O operations and computational overhead, lowering resource usage while enabling complete virus detection across all archive contents.

Inventive Principle:

Principle #26Copying

3Adaptability or versatility

If archives are stored in cloud storage, then storage scalability is improved, but access speed deteriorates due to network dependencies

Engineering Contradiction:

Improvestorage scalabilityVSAvoidaccess speed

Core Design Contradiction:

Adaptability or versatilityVSSpeed

Solution Approach 1:

The system performs preliminary actions by creating virtual volumes from cloud-stored archive slices before actual virus scanning operations. This pre-loading of data into local memory reduces subsequent access dependencies on network speed, improving access performance while maintaining cloud storage scalability.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The virtual volume acts as an intermediary layer between the cloud storage system and the virus scanning process. It buffers data locally, reducing direct network access requirements during scanning operations and improving access speed while preserving the scalability benefits of cloud storage.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Reliability

If conventional scanning methods are used, then comprehensive archive inspection is achieved, but the ability to scan arbitrary time points and repair infected data is lost

Engineering Contradiction:

Improvearchive inspection completenessVSAvoidarbitrary time point scanning capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The archive is segmented into chronological slices, each representing a specific point in time. This segmentation enables the system to scan arbitrary time points by selecting and processing specific slices independently, providing temporal flexibility while maintaining comprehensive inspection capability through systematic coverage of all slices.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system implements dynamic slice selection, allowing users to specify arbitrary time points for scanning. The virtual volume creation and virus scanning processes can be dynamically applied to any slice in the archive, enabling flexible temporal querying and targeted inspection of specific historical states without requiring complete archive re-scanning.

Inventive Principle:

Principle #15Dynamics

Data Source

PatentUS11562067B2System and method of inspecting archive slices for malware using empty sparse files

Publication Date: 2023.01.24 ACRONIS INT

AI summary

Disclosed herein are systems and method for inspecting archived slices for malware using empty spare files. In one exemplary aspect, the method comprises generating a backup slice and a virtual volume comprising a list of files in the backup slice and associated file information. The method comprises mounting the virtual volume to a disk. The method comprises creating, in the virtual volume, empty sparse files that are placeholders of the files reference in the list of files. The method comprises detecting a change between a respective empty sparse file and a corresponding file in a previous backup slice and accordingly storing the actual content of the file in the virtual volume in place of the respective empty sparse file. The method comprises scanning the virtual volume for malicious software and generating a cured slice that replaces the backup slice in the backup archive upon detection.