Virus Footprint Tracking in Data Copies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer storage systems face challenges in effectively tracking and mitigating the spread of computer viruses across snapshots, backups, and file copies, as existing antivirus solutions often miss multiple copies of infected files and require costly scanning processes.
Innovation Solution
Implementing a virus tracking component that utilizes metadata to trace and update the status of virus-infected files across data protection approaches like snapshots, backups, and replications, allowing administrators to make informed decisions during data restoration without additional scanning, by using extended attributes to identify unscanned files and updating metadata accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus scanning is performed on all data copies (snapshots, backups, replications), then virus detection capability is improved, but processing resources and time consumption increase significantly
Solution Approach 1:
The system performs preliminary virus scanning on the original file before it is copied to snapshots, backups, or replications. The virus footprint is recorded in metadata at this preliminary stage, eliminating the need for repeated scanning of all copies. This preliminary action ensures that when files are restored from copies, the virus status is already known and can be prevented from re-introduction.
Solution Approach 2:
Instead of copying the actual virus scan results to all data copies, the system copies only the essential virus footprint information in metadata form. This lightweight copying approach maintains virus detection capability across all snapshots, backups, and replications without requiring full virus scanning of each copy, thus conserving processing resources.
2Reliability
If virus scanning is performed on every data copy, then complete virus mitigation is achieved, but the time required for data protection operations increases
Solution Approach 1:
Virus scanning is performed as a preliminary action when the original file is created or modified, before replication to snapshots, backups, or other copies. The virus footprint is recorded in metadata at this preliminary stage, allowing rapid restoration operations without time-consuming re-scanning of each copy.
Solution Approach 2:
The system performs partial scanning by only scanning the original file and recording the virus footprint in metadata, rather than performing complete scanning on every data copy. This partial action is sufficient for virus mitigation because the metadata footprint allows the system to identify and prevent virus re-introduction during restoration without scanning all copies.
3Loss of information
If metadata tracking is implemented across all data copies, then virus footprint propagation is improved, but system complexity increases
Solution Approach 1:
The system extracts only the essential virus footprint information from full virus scan results and stores it in metadata. This extraction approach tracks virus status across data copies without requiring complex metadata structures, maintaining simplicity while ensuring virus footprint propagation.
4Reliability
If all data copies are scanned for viruses, then complete virus removal is achieved, but processing efficiency decreases
Solution Approach 1:
Virus scanning and footprint recording is performed as a preliminary action on the original file before replication. This ensures complete virus removal capability while maintaining high productivity, as the preliminary scanned footprint is propagated to metadata without requiring re-scanning of each copy during restoration operations.
Data Source
AI summary
Techniques are provided for tracking a virus footprint in data copies. Data copies can be made in a variety of ways, like with snapshots, backups, replications, and simple copies. As copies of files that have not been scanned since they were last modified are made, these copies can be kept track of, and associated with the original file. When the original file is later scanned and found to be clean or infected, this information can be propagated through the copies.