Application dependency based malware recovery

Patent metadata

Field	Value
Publication number	US-12265454-B2
Application number	US-202318226567-A
Country	US
Kind code	B2
Filing date	Jul 26, 2023
Priority date	Jul 26, 2023
Publication date	Apr 1, 2025
Grant date	Apr 1, 2025

Abstract

An embodiment identifies a fileset used by an executing application. An embodiment generates, at a first time, a first snapshot of the fileset, the first snapshot comprising a first state of the fileset at the first time and a first indicator corresponding to the first state of the fileset. An embodiment selects, at a recovery time later than the first time, from a sequence of snapshots of the fileset including the first snapshot, a recovery snapshot, the recovery snapshot comprising a recovery indicator, wherein the recovery indicator has a difference from the first indicator that is higher than a threshold value. An embodiment restores, using the recovery snapshot, the fileset to a state other than the first state, the restoring resulting in a restored application.

First claim

What is claimed is:

1. A computer-implemented method comprising:
identifying a fileset used by an executing application;
generating, at a first time, a first snapshot of the fileset, the first snapshot comprising a first state of the fileset at the first time and a first indicator corresponding to the first state of the fileset;
selecting, at a recovery time later than the first time, from a sequence of snapshots of the fileset including the first snapshot, a recovery snapshot, the recovery snapshot comprising a recovery indicator, wherein the recovery indicator has a difference from the first indicator that is higher than a threshold value;
restoring, using the recovery snapshot, the fileset to a state other than the first state, the restoring resulting in a restored application;
testing the restored application, the testing comprising executing the restored application in a test environment;
determining that the restored application does not meet a test success criterion;
selecting, from the sequence of snapshots of the fileset including the first snapshot, a second recovery snapshot, wherein the recovery snapshot was generated at a second time, wherein the second recovery snapshot was generated at a third time earlier than the second time; restoring, using the second recovery snapshot, the fileset to a state other than the first state, the restoring using the second recovery snapshot resulting in a second restored application; and
retesting the second restored application, the retesting comprising executing the second restored application in the test environment.

2. The computer-implemented method of claim 1 , wherein the first indicator comprises an encryption state of the fileset.

3. The computer-implemented method of claim 1 , wherein the first indicator comprises a bulk action state of the fileset.

4. The computer-implemented method of claim 1 , further comprising:
determining that the restored application meets a test success criterion; and
executing, in a production environment, the restored application.

5. A computer program product comprising one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions executable by a processor to cause the processor to perform operations comprising:
identifying a fileset used by an executing application;
generating, at a first time, a first snapshot of the fileset, the first snapshot comprising a first state of the fileset at the first time and a first indicator corresponding to the first state of the fileset;
selecting, at a recovery time later than the first time, from a sequence of snapshots of the fileset including the first snapshot, a recovery snapshot, the recovery snapshot comprising a recovery indicator, wherein the recovery indicator has a difference from the first indicator that is higher than a threshold value;
restoring, using the recovery snapshot, the fileset to a state other than the first state, the restoring resulting in a restored application;
testing the restored application, the testing comprising executing the restored application in a test environment;
determining that the restored application does not meet a test success criterion;
selecting, from the sequence of snapshots of the fileset including the first snapshot, a second recovery snapshot, wherein the recovery snapshot was generated at a second time, wherein the second recovery snapshot was generated at a third time earlier than the second time; restoring, using the second recovery snapshot, the fileset to a state other than the first state, the restoring using the second recovery snapshot resulting in a second restored application; and
retesting the second restored application, the retesting comprising executing the second restored application in the test environment.

6. The computer program product of claim 5 , wherein the stored program instructions are stored in a computer readable storage device in a data processing system, and wherein the stored program instructions are transferred over a network from a remote data processing system.

7. The computer program product of claim 5 , wherein the stored program instructions are stored in a computer readable storage device in a server data processing system, and wherein the stored program instructions are downloaded in response to a request over a network to a remote data processing system for use in a computer readable storage device associated with the remote data processing system, further comprising:
program instructions to meter use of the program instructions associated with the request; and
program instructions to generate an invoice based on the metered use.

8. The computer program product of claim 5 , wherein the first indicator comprises an encryption state of the fileset.

9. The computer program product of claim 5 , wherein the first indicator comprises a bulk action state of the fileset.

10. The computer program product of claim 5 , further comprising:
determining that the restored application meets a test success criterion; and
executing, in a production environment, the restored application.

11. A computer system comprising a processor and one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions executable by the processor to cause the processor to perform operations comprising:
identifying a fileset used by an executing application;
generating, at a first time, a first snapshot of the fileset, the first snapshot comprising a first state of the fileset at the first time and a first indicator corresponding to the first state of the fileset;
selecting, at a recovery time later than the first time, from a sequence of snapshots of the fileset including the first snapshot, a recovery snapshot, the recovery snapshot comprising a recovery indicator, wherein the recovery indicator has a difference from the first indicator that is higher than a threshold value;
restoring, using the recovery snapshot, the fileset to a state other than the first state, the restoring resulting in a restored application;
testing the restored application, the testing comprising executing the restored application in a test environment;
determining that the restored application does not meet a test success criterion;
selecting, from the sequence of snapshots of the fileset including the first snapshot, a second recovery snapshot, wherein the recovery snapshot was generated at a second time, wherein the second recovery snapshot was generated at a third time earlier than the second time; restoring, using the second recovery snapshot, the fileset to a state other than the first state, the restoring using the second recovery snapshot resulting in a second restored application; and
retesting the second restored application, the retesting comprising executing the second restored application in the test environment.

12. The computer system of claim 11 , wherein the first indicator comprises an encryption state of the fileset.

13. The computer system of claim 11 , wherein the first indicator comprises a bulk action state of the fileset.

14. The computer system of claim 11 , further comprising:
determining that the restored application meets a test success criterion; and
executing, in a production environment, the restored application.

Assignees

• IBM

Inventors

• Farr Erin M
• Hsu Yu-Cheng
• Gupta Pratik

Classifications

• G06F11/3698

  Environments for analysis, debugging or testing of software · CPC title

• G06F16/122

  using management policies (point-in-time backing up or restoration of persistent data G06F11/1446; file migration policies for HSM systems G06F16/185) · CPC title

• G06F2201/84

  Using snapshots, i.e. a logical point-in-time copy of the data · CPC title

• G06F16/128 Primary

  Details of file system snapshots on the file-level, e.g. snapshot creation, administration, deletion (error detection or correction of the data by redundancy in operations or in hardware G06F11/14, G06F11/16) · CPC title

• G06F2201/815

  Virtual · CPC title