System and method of preventing malware reoccurrence when restoring a computing device using a backup image

Patent metadata

Field	Value
Publication number	US-11579985-B2
Application number	US-202016889184-A
Country	US
Kind code	B2
Filing date	Jun 1, 2020
Priority date	May 31, 2019
Publication date	Feb 14, 2023
Grant date	Feb 14, 2023

Abstract

Disclosed herein are systems and method for preventing malware reoccurrence when restoring a computing device using a backup image. In one exemplary aspect, a method may identify, from a plurality of backup images for a computing device, a backup image that was created most recently before the computing device was compromised. The method may mount the backup image as a disk and scanning the disk for malicious software. The method may disable all ports and services on the computing device to prevent unauthorized network connections and service launches. The method may restore data to the computing device from the mounted disk. The method may update software on the computing device and applying latest patches, and reopen the ports and restart the services on the computing device subsequent to updating the software and applying the latest patches.

First claim

What is claimed is:

1. A method of preventing malware reoccurrence when restoring a computing device using a backup image, comprising:
identifying, from a plurality of backup images for a computing device, a backup image that was created most recently before the computing device was compromised;
mounting the backup image as a disk and scanning the disk for malicious software;
disabling all ports and services on the computing device to prevent unauthorized network connections and service launches;
restoring data to the computing device from the mounted disk;
updating software on the computing device and applying latest patches, wherein the software comprises a first version of an application that became infected and is a cause of the computing device being compromised, and wherein updating the software comprises:
determining whether a new version of the application comprises a security issue that caused the application to become infected; and
in response to determining that the new version comprises the security issue, delaying updating the application to the new version until the security issue is resolved in the new version; and

reopening the ports and restarting the services on the computing device subsequent to updating the software and applying the latest patches.

2. The method of claim 1 , wherein updating software on the computing device and applying latest patches further comprises:
identifying a security issue that caused the computing device to be compromised;
determining whether a patch that resolves the security issue exists; and
in response to determining that the patch exists, installing the patch.

3. The method of claim 1 , wherein updating software on the computing device and applying latest patches further comprises:
determining whether the new version comprises known security issues that are unresolved; and
in response to determining that the new version does not comprise known security issues that are unresolved, updating the application to the new version.

4. The method of claim 1 , further comprising restarting the computing device subsequent to restoring the data.

5. The method of claim 1 , wherein disabling the ports comprises either blocking or closing a portion of the ports from establishing the unauthorized network connections.

6. The method of claim 1 , wherein disabling the services comprises suspending or stopping a portion of the services and system processes.

7. A system of preventing malware reoccurrence when restoring a computing device using
a backup image, comprising:
a hardware processor configured to:
identify, from a plurality of backup images for a computing device, a backup image that was created most recently before the computing device was compromised;
mount the backup image as a disk and scanning the disk for malicious software;
disable all ports and services on the computing device to prevent unauthorized network connections and service launches;
restore data to the computing device from the mounted disk;
update software on the computing device and applying latest patches, wherein the software comprises a first version of an application that became infected and is a cause of the computing device being compromised, and wherein updating the software comprises:
determining whether a new version of the application comprises a security issue that caused the application to become infected; and
in response to determining that the new version comprises the security issue, delaying updating the application to the new version until the security issue is resolved in the new version; and

reopen the ports and restarting the services on the computing device subsequent to updating the software and applying the latest patches.

8. The system of claim 7 , wherein the hardware processor is configured to update software on the computing device and applying latest patches by:
identifying a security issue that caused the computing device to be compromised;
determining whether a patch that resolves the security issue exists; and
in response to determining that the patch exists, installing the patch.

9. The system of claim 7 , wherein the hardware processor is configured to updating software on the computing device and applying latest patches by:
determining whether the new version comprises known security issues that are unresolved; and
in response to determining that the new version does not comprise known security issues that are unresolved, updating the application to the new version.

10. The system of claim 7 , wherein the hardware processor is configured to restart the computing device subsequent to restoring the data.

11. The system of claim 7 , wherein the hardware processor is configured to disable the ports by either blocking or closing a portion of the ports from establishing the unauthorized network connections.

12. The system of claim 7 , wherein the hardware processor is configured to disable the services by suspending or stopping a portion of the services and system processes.

13. A non-transitory computer readable medium storing thereon computer executable instructions for preventing malware reoccurrence when restoring a computing device using a backup image, including instructions for:
identifying, from a plurality of backup images for a computing device, a backup image that was created most recently before the computing device was compromised;
mounting the backup image as a disk and scanning the disk for malicious software;
disabling all ports and services on the computing device to prevent unauthorized network connections and service launches;
restoring data to the computing device from the mounted disk;
updating software on the computing device and applying latest patches, wherein the software comprises a first version of an application that became infected and is a cause of the computing device being compromised, and wherein updating the software comprises:
determining whether a new version of the application comprises a security issue that caused the application to become infected; and
in response to determining that the new version comprises the security issue, delaying updating the application to the new version until the security issue is resolved in the new version; and

reopening the ports and restarting the services on the computing device subsequent to updating the software and applying the latest patches.

14. The non-transitory computer readable medium of claim 13 , wherein the instruction for updating software on the computing device and applying latest patches further comprises instructions for:
identifying a security issue that caused the computing device to be compromised;
determining whether a patch that resolves the security issue exists; and
in response to determining that the patch exists, installing the patch.

15. The non-transitory computer readable medium of claim 13 , wherein the instruction for updating software on the computing device and applying latest patches further comprises instructions for:
determining whether the new version comprises known security issues that are unresolved; and
in response to determining that the new version does not comprise known security issues that are unresolved, updating the application to the new version.

16. The non-transitory computer readable medium of claim 13 , further comprising instructions for restarting the computing device subsequent to restoring the data.

17. The non-transitory computer readable medium of claim 13 , wherein the instruction for disabling the ports comprises further instructions for either blo

Assignees

• Acronis Int Gmbh

Inventors

• Beloussov Serguei
• Ishanov Oleg
• Strogov Vladimir
• Kulaga Andrey
• Kornachev Igor
• Sergeev Alexey
• Enakiev Anton
• Protasov Stanislav

Classifications

• G06F21/568 Primary

  eliminating virus, restoring damaged files · CPC title

• G06F11/1451

  by selection of backup contents · CPC title

• G06F11/1469 Primary

  Backup restoration techniques · CPC title

• G06F2201/84

  Using snapshots, i.e. a logical point-in-time copy of the data · CPC title

• G06F8/65

  Updates (security arrangements therefor G06F21/57) · CPC title