Systems and methods for synthetic file scanning

Patent metadata

Field	Value
Publication number	US-12346441-B2
Application number	US-202117393774-A
Country	US
Kind code	B2
Filing date	Aug 4, 2021
Priority date	Aug 17, 2020
Publication date	Jul 1, 2025
Grant date	Jul 1, 2025

Abstract

Disclosed herein are systems and method for synthetic file scanning. In one exemplary aspect, a method may comprise, for each respective file in a plurality of files on a storage device, determining a respective likelihood of the respective file being targeted by the malicious activity, and including, in a subset of files, each respective file in the plurality of files with a respective likelihood that is greater than a threshold likelihood. The method may comprise for each respective file in the subset of files, identifying at least one fragment of the respective file that is susceptible to the malicious activity. The method may comprise extracting and storing at least one fragment from each respective file in a synthetic file, and scanning the synthetic file periodically instead of the plurality of files.

First claim

The invention claimed is:

1. A method for synthetic file scanning, the method comprising:
identifying, on a storage device, a plurality of files that are scanned periodically for malicious activity;
for each respective file in the plurality of files, determining a respective likelihood value of the respective file being targeted by the malicious activity;
including, in a subset of files, each respective file in the plurality of files with a respective likelihood value that is greater than a threshold likelihood value;
for each respective file in the subset of files, identifying at least one fragment of the respective file that is susceptible to the malicious activity, based on characteristics of the malicious activity;
extracting the at least one fragment from each respective file;
storing the extracted at least one fragment from each respective file in a synthetic file in encrypted form, wherein contents of the synthetic file are arranged in accordance with storage addresses of each respective file in the subset of files;
scanning the synthetic file periodically instead of the plurality of files, wherein the synthetic file is updated before each periodic scan;
determining, based on the scanning, that the synthetic file is uninfected, wherein determining that the synthetic file is uninfected is indicative that the subset of files in the plurality of files whose fragments make up the synthetic file are uninfected; and
marking each respective file in the subset of files whose fragment is included in the synthetic file as a clean file.

2. The method of claim 1 , wherein the synthetic file further comprises, for each respective fragment, a respective pointer that points to a respective storage address of the respective fragment.

3. The method of claim 2 , further comprising:
detecting a change in a fragment on the storage device; updating a corresponding fragment in the synthetic file in accordance with the change using a pointer for the corresponding fragment.

4. The method of claim 1 , further comprising: determining, based on the scanning, that a fragment in the synthetic file has been targeted by the malicious activity; identifying a file in the storage device that comprises a corresponding fragment; and performing a remediation action on the file, wherein the remediation action is one of: file removal and file quarantine.

5. The method of claim 1 , further comprising: storing an identifier of each respective file; and deleting the synthetic file.

6. The method of claim 5 , wherein the plurality of files are comprised in a first backup of the storage device, further comprising: receiving a second backup of the storage device; determining a first subset of files in the second backup that have been modified since the first backup; identifying, from the first subset of files, a second subset of files that match with the stored identifiers; and storing fragments from the second subset of files in a new synthetic file without re-determining likelihood values of the second subset of files being targeted by the malicious activity.

7. The method of claim 1 , wherein identifying the at least one fragment of the respective file that is susceptible to the malicious activity based on characteristics of the malicious activity further comprises: determining a target location of the malicious activity based on historic attacks; identifying the target location in the respective file in the subset of files; and identifying the at least one fragment of the respective file that comprises the target location.

8. The method of claim 1 , wherein the plurality of files are comprised in a backup, wherein a unique synthetic file is created for each backup.

9. A system for synthetic file scanning, the system comprising: a hardware processor configured to:
identify, on a storage device, a plurality of files that are scanned periodically for malicious activity;
for each respective file in the plurality of files, determine a respective likelihood value of the respective file being targeted by the malicious activity;
include, in a subset of files, each respective file in the plurality of files with a respective likelihood value that is greater than a threshold likelihood value;
for each respective file in the subset of files, identify at least one fragment of the respective file that is susceptible to the malicious activity, based on characteristics of the malicious activity;
extract the at least one fragment from each respective file;
store the extracted at least one fragment from each respective file in a synthetic file in encrypted form, wherein contents of the synthetic file are arranged in accordance with storage addresses of each respective file in the subset of files;
scan the synthetic file periodically instead of the plurality of files, wherein the synthetic file is updated before each periodic scan;
determine, based on the scanning, that the synthetic file is uninfected, wherein determining that the synthetic file is uninfected is indicative that the subset of files in the plurality of files whose fragments make up the synthetic file are uninfected; and
mark each respective file in the subset of files whose fragment is included in the synthetic file as a clean file.

10. The system of claim 9 , wherein the synthetic file further comprises, for each respective fragment, a respective pointer that points to a respective storage address of the respective fragment.

11. The system of claim 10 , wherein the hardware processor is further configured to: detect a change in a fragment on the storage device; update a corresponding fragment in the synthetic file in accordance with the change using a pointer for the corresponding fragment.

12. The system of claim 9 , wherein the hardware processor is further configured to: determine, based on the scanning, that a fragment in the synthetic file has been targeted by the malicious activity; identify a file in the storage device that comprises a corresponding fragment; and perform a remediation action on the file, wherein the remediation action is one of: file removal and file quarantine.

13. The system of claim 9 , wherein the hardware processor is further configured to: store an identifier of each respective file; and delete the synthetic file.

14. The system of claim 13 , wherein the plurality of files are comprised in a first backup of the storage device, wherein the hardware processor is further configured to: receive a second backup of the storage device; determine a first subset of files in the second backup that have been modified since the first backup; identify, from the first subset of files, a second subset of files that match with the stored identifiers; and store fragments from the second subset of files in a new synthetic file without re-determining likelihood values of the second subset of files being targeted by the malicious activity.

15. The system of claim 9 , wherein the hardware processor is further configured to identify the at least one fragment of the respective file that is susceptible to the malicious activity based on characteristics of the malicious activity by:
determining a target location of the malicious activity based on historic attacks; identifying the target location in the respective file in the subset of files; and identifying the at least one fragment of the respective file that comprises the target location.

16. The system of claim 9 , wherein the plurality of files are comprised in a backup, wherein a unique synthetic file is created for each backup.

17. A non-transitory computer readable medium storing thereon

Assignees

• Acronis Int Gmbh

Inventors

• Tormasov Alexander
• Beloussov Serguei
• Protasov Stanislav

Classifications

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F21/568

  eliminating virus, restoring damaged files · CPC title

• G06F21/562

  Static detection · CPC title

• G06F21/565 Primary

  by checking file integrity · CPC title

• G06F11/1451 Primary

  by selection of backup contents · CPC title