Protecting backup files from malware

Patent metadata

Field	Value
Publication number	US-10289844-B2
Application number	US-201715409692-A
Country	US
Kind code	B2
Filing date	Jan 19, 2017
Priority date	Jan 19, 2017
Publication date	May 14, 2019
Grant date	May 14, 2019

Abstract

A method for safeguarding a stored file from malware. In one embodiment, the method includes at least one computer processor receiving, to a storage system, a first file from a first computing device. The method further includes analyzing the received first file to determine whether the received first file is suspected of encryption by malware. The method further includes responding to determining that the received first file is suspected of encryption by malware, initiating one or more actions, including suspending replacement of an instance of the first file backed up to the storage system with the received first file. The method further includes storing the received first file to a portion of the storage system designated for file isolation.

First claim

What is claimed is:

1. A computer program product for safeguarding a stored file from malware, the computer program product comprising:
one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the program instructions readable/executable by one or more computer processors and further comprising:
program instructions to receive, to a storage system, a first file from a first computing device, wherein the first computing device is associated with a first user;
program instructions to analyze the received first file to determine whether the received first file is suspected of encryption by malware;
program instructions to respond to determining that the received first file is suspected of encryption by malware by initiating one or more actions, including:
(i) suspending replacement of an instance of the first file backed up to the storage system with the received first file;
(ii) determining, based a profile associated with the first user, to interface with the first user utilizing two or more computing devices associated with the first user, wherein the first computing device includes the first file that is not stored on the second computing device; and
(iii) transmitting a notification, to the first user associated with the received first file, to the two or more computing devices associated with the first user, wherein transmitting the notification to the two or more computing devices associated with the first user includes transmitting the notification to the second computing device, wherein the notification includes a result of analysis of the received first file; and

program instructions to store the received first file to a portion of the storage system designated for file isolation.

2. The computer program product of claim 1 , further comprising:
program instructions to determine that the storage system utilizes one or more security measures, wherein a first security measure dictates that a confirmation of a false-positive result by a user is received from a computing device, identified within a profile associated with the user, different from computing devices that store a version of a file that is suspected of encryption by malware; and
program instructions to receive, from a computing device associated with the first user, a response from the first user associated with the received first file, indicating whether the analysis of the received first file is a false-positive result for encryption by malware.

3. The computer program product of claim 1 , wherein the program instructions to analyze the received first file to determine whether the received first file is suspected of encryption by malware further comprise:
program instructions to determine one or more attributes associated with the received first file;
program instructions to compare the one or more attributes of the received first file to one or more corresponding items related to the received first file, wherein the items related to the received first file are selected from the group consisting of a structure of the received first file, a portion of content of the received first file, one or more file attributes of other versions of the first file, a structure of another version of the first file, and a portion of content of another version of the first file; and
program instructions to respond to the comparison of the one or more attributes associated with the received first file and the one or more corresponding items related to the received first file identifying one or more differences by indicating that the received first file is suspected of encryption by malware.

4. The computer program product of claim 1 , further comprising:
program instructions to determine that the storage system supports version control of files backed up to the storage system; and
program instructions to respond to determining that the storage system supports version control of files backed up to the storage system by suspending file rotation of versions of the first file backed up to the storage system.

5. The computer program product of claim 2 , further comprising:
program instructions to respond to receiving the response from the computing device associated with the first user that indicates that the analysis of the received first file is not a false-positive result by identifying a profile associated with the user of the received first file;
program instructions to determine a listing of files backed up to the storage system corresponding to the first user and the first computing device, including the received first file; and
program instructions to suspend rotation of files of the determined listing of files backed up to the storage system.

6. The computer program product of claim 2 , further comprising:
program instructions to respond to receiving the response from the computing device associated with the first user that indicates that the analysis of the received first is a false-positive result by determining whether the response indicating the false-positive result is received from the second computing device associated with the first user;
program instructions to respond to determining that the response indicating the false-positive result is received from the second computing device associated with the first user by determine a listing of files backed up to the storage system corresponding to the first user and the first computing device, including the received first file;
program instructions to resume rotation of files of the determined listing of files backed up to the storage system; and
program instructions to store the received first file to the storage system based, at least in part, on a rotations of files and the user profile of the first user, wherein the received first files is removed from file isolation in response to determining that a false-positive result is confirmed.

7. A computer system for safeguarding a stored file from malware, the computer system comprising:
one or more computer processors;
one or more computer readable storage media;
program instructions stored on the computer readable storage media for reading/execution by at least one of the one or more computer processors, the program instructions further comprising:
program instructions to receive, to a storage system, a first file from a first computing device, wherein the first computing device is associated with a first user;
program instructions to analyze the received first file to determine whether the received first file is suspected of encryption by malware;
program instructions to respond to determining that the received first file is suspected of encryption by malware by initiating one or more actions, including:
(i) suspending replacement of an instance of the first file backed up to the storage system with the received first file;
(ii) determining, based a profile associated with the first user, to interface with the first user utilizing two or more computing devices associated with the first user, wherein the first computing device includes the first file that is not stored on the second computing device; and
(iii) transmitting a notification, to the first user associated with the received first file, to the two or more computing devices associated with the first user, wherein transmitting the notification to the two or more computing devices associated with the first user includes transmitting the notification to the second computing device, wherein the notification includes a result of analysis of the received first file; and

program instructions to store the received first file to a portion of the storage system designated for file isolation.

8. The computer system of claim 7 , further comprising

Assignees

• IBM

Inventors

• Charters Graham C
• Dixon Bret W
• Horwood Benjamin T
• Poga Alexander H
• Shewell Mark A

Classifications

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/565 Primary

  by checking file integrity · CPC title

• G06F21/568

  eliminating virus, restoring damaged files · CPC title