Protecting backup files from malware

Patent metadata

Field	Value
Publication number	US-2018204000-A1
Application number	US-201815889298-A
Country	US
Kind code	A1
Filing date	Feb 6, 2018
Priority date	Jan 19, 2017
Publication date	Jul 19, 2018
Grant date	—

Abstract

A method for safeguarding a stored file from malware. In one embodiment, the method includes at least one computer processor receiving, to a storage system, a first file from a first computing device. The method further includes analyzing the received first file to determine whether the received first file is suspected of encryption by malware. The method further includes responding to determining that the received first file is suspected of encryption by malware, initiating one or more actions, including suspending replacement of an instance of the first file backed up to the storage system with the received first file. The method further includes storing the received first file to a portion of the storage system designated for file isolation.

First claim

What is claimed is:

1 . A method for safeguarding a stored file from malware, the method comprising:
determining, by one or more computer processors, that a storage system supports version control of files backed up to the storage system and that the storage system supports user profiles for backing up files to the storage system, a user profile including:
identities of one or more computing devices associated with the user;
one or more methods for notifying the user of a result of an analysis indicating that malware is suspected of affecting a file of the user; and
a list of files that the user backs up to the storage system, the list of files further including:
version control information corresponding to the files that the user backs up to the storage system; and
an indication, corresponding to each file the user backs up to the storage system, identifying that the file is shared and respective identities corresponding to other computing devices that utilize the shared file;
receiving, by one or more computer processors, to a storage system, a version of a first file from a first computing device associated with a first user; and analyzing, by one or more computer processors, the received version of the first file to determine whether the received first file is suspected of encryption by malware, wherein analyzing the received version of the first file to determine whether the received version of the first file is suspected of encryption by malware further comprises:
determining, by one or more computer processors, one or more attributes associated with the received version of the first file;
comparing, by one or more computer processors, the one or more attributes of the received version of first file to one or more corresponding items related to the received version of the first file, wherein the items related to the received version of first file are selected from a group consisting of a structure of the received first file, a portion of content of the received version of the first file, one or more file attributes of other versions of the first file, a structure of another version of the first file, a portion of content of another version of the first file; and
in response to the comparison of the one or more attributes associated with the received version of the first file and the one or more corresponding items related to the received version of the first file identifying one or more differences and determining, by one or more computer processors, that the received first file is suspected of encryption by malware; responsive to determining that the received version of the first file is suspected of encryption by malware, initiating, by one or more computer processors, one or more actions, including:
suspending replacement of another version of the first file backed up to the storage system with the received version of the first file;
storing the received version of the first file to a portion of the storage system designated for file isolation;
transmitting a notification to the first user indicating that the received version of the first file is suspected of encryption by malware; and
determining whether the first file is shared based on information within the profile associated with the first user;
in response to determining that the first file is shared, identifying, by one or more computer processors, respective identities for other computing devices that utilize the shared first file; and transmitting, by one or more computer processors, another notification to the respective identities for other computing devices that utilize the shared first file, the other notification indicating that the received version of the first file is suspected of encryption by malware.

Assignees

• IBM

Inventors

• Charters Graham C
• Dixon Bret W
• Horwood Benjamin T
• Poga Alexander H
• Shewell Mark A

Classifications

• G06F21/565 Primary

  by checking file integrity · CPC title

• G06F21/568

  eliminating virus, restoring damaged files · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title