Protecting backup files from malware

Patent metadata

Field	Value
Publication number	US-10289845-B2
Application number	US-201715844777-A
Country	US
Kind code	B2
Filing date	Dec 18, 2017
Priority date	Jan 19, 2017
Publication date	May 14, 2019
Grant date	May 14, 2019

Abstract

A method for safeguarding a stored file from malware. In one embodiment, the method includes at least one computer processor receiving, to a storage system, a first file from a first computing device. The method further includes analyzing the received first file to determine whether the received first file is suspected of encryption by malware. The method further includes responding to determining that the received first file is suspected of encryption by malware, initiating one or more actions, including suspending replacement of an instance of the first file backed up to the storage system with the received first file. The method further includes storing the received first file to a portion of the storage system designated for file isolation.

First claim

What is claimed is:

1. A method for safeguarding a stored file from malware, the method comprising:
receiving, by one or more computer processors, to a storage system, a first file from a first computing device, wherein the first computing device is associated with a first user;
analyzing, by one or more computer processors, the received first file to determine whether the received first file is suspected of encryption by malware;
responsive to determining that the received first file is suspected of encryption by malware, initiating, by one or more computer processors, one or more actions, including:
(i) suspending replacement of an instance of the first file backed up to the storage system with the received first file;
(ii) determining, based a profile associated with the first user, to interface with the first user utilizing two or more computing devices associated with the first user, wherein the first computing computing device includes the first file that is not stored on a second computing device; and
(iii) transmitting a notification, to the first user associated with the received first file, to the two or more computing devices associated with the first user, wherein transmitting the notification to the two or more computing devices associated with the first user includes transmitting the notification to the second computing device, wherein the notification includes a result of analysis of the received first file, and

storing, by one or more computer processors, the received first file to a portion of the storage system designated for file isolation.

2. The method of claim 1 , further comprising:
determining, by one or more computer processors, that the storage system utilizes one or more security measures, wherein a first security measure dictates that a confirmation of a false-positive result by a user is received from a computing device, identified within a profile associated with the user, different from computing devices that store a version of a file that is suspected of encryption by malware; and
receiving, by one or more computer processors, from a computing device associated with the first user, a response from the first user associated with the received first file, indicating whether the analysis of the received first file is a false-positive result for encryption by malware.

3. The method of claim 2 , further comprising:
in response to receiving the response from the computing device associated with the first user that indicates that the analysis of the received first file is not a false-positive result, identifying, by one or more computer processors, a profile associated with the user of the received first file;
determining, by one or more computer processors, a listing of files backed up to the storage system corresponding to the first user and the first computing device, including the received first file; and
suspending, by one or more computer processors, rotation of files of the determined listing of files backed up to the storage system.

4. The method of claim 2 , further comprising:
in response to receiving the response from the computing device associated with the first user that indicates that the analysis of the received first is a false-positive result determining, by one or more computer processors, whether the response indicating the false-positive result is received from the second computing device associated with the first user;
in response to determining that the response indicating the false-positive result is received from the second computing device associated with the first user, determining, by one or more computer processors, a listing of files backed up to the storage system corresponding to the first user and the first computing device, including the received first file;
resuming, by one or more computer processors, rotation of files of the determined listing of files backed up to the storage system; and
storing, by one or more computer processors, the received first file to the storage system based, at least in part, on a rotation of files and the user profile of the first user, wherein the received first file is removed from file isolation in response to determining that a false-positive result is confirmed.

5. The method of claim 1 , wherein analyzing the received first file to determine whether the received first file is suspected of encryption by malware further comprises:
determining, by one or more computer processors, one or more attributes associated with the received first file;
comparing, by one or more computer processors, the one or more attributes of the received first file to one or more corresponding items related to the received first file, wherein the items related to the received first file are selected from the group consisting of a structure of the received first file, a portion of content of the received first file, one or more file attributes of other versions of the first file, a structure of another version of the first file, and a portion of content of another version of the first file; and
in response to comparison of the one or more attributes associated with the received first file and the one or more corresponding items related to the received first file identifying one or more differences indicating, by one or more computer processors, that the received first file is suspected of encryption by malware.

6. The method of claim 1 , further comprising:
determining, by one or more computer processors, that the storage system supports version control of files backed up to the storage system; and
in response to determining that the storage system supports version control of files backed up to the storage system, suspending, by one or more computer processors, file rotation of versions of the first file backed up to the storage system.

7. The method of claim 1 , further comprising:
determining, by one or more computer processors, that the storage system supports user profiles for backing up files to the storage system, a user profile including:
a list of files that a user backed up to the storage system, the list of files further including:
identities of one or more computing devices respectively associated with files of the list of files;
an indication that identifies whether a file included in the list of files, backed up to the storage system, is shared; and
one or more computing devices associated with the user, wherein the one or more computing devices of the user include the first computing device.

8. The method of claim 1 , wherein the malware suspected of encrypting the received first file is ransomware.

Assignees

• IBM

Inventors

• Charters Graham C
• Dixon Bret W
• Horwood Benjamin T
• Poga Alexander H
• Shewell Mark A

Classifications

• G06F21/568

  eliminating virus, restoring damaged files · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/565 Primary

  by checking file integrity · CPC title