Protecting backup files from malware

Patent metadata

Field	Value
Publication number	US-2019220597-A1
Application number	US-201916374050-A
Country	US
Kind code	A1
Filing date	Apr 3, 2019
Priority date	Jan 19, 2017
Publication date	Jul 18, 2019
Grant date	—

Abstract

A method for safeguarding a stored file from malware. In one embodiment, the method includes at least one computer processor receiving, to a storage system, a first file from a first computing device. The method further includes analyzing the received first file to determine whether the received first file is suspected of encryption by malware. The method further includes responding to determining that the received first file is suspected of encryption by malware, initiating one or more actions, including suspending replacement of an instance of the first file backed up to the storage system with the received first file. The method further includes storing the received first file to a portion of the storage system designated for file isolation.

First claim

What is claimed is:

1 . A method for safeguarding a stored file from malware, the method comprising:
determining, by one or more computer processors, that a storage system supports version control of files backed up to the storage system and that the storage system supports user profiles for backing up files to the storage system, a user profile including:
identities of two or more computing devices associated with the user;
one or more methods, respectively associated with a computing device associated with the user, for notifying the user of a result of an analysis indicating that malware is suspected of affecting a file of the user; and
a list of files that the user backs up to the storage system, the list of files further including:
version control information corresponding to the files that the user backs up to the storage system; and
an indication, corresponding to each file the user backs up to the storage system, identifying that the file is shared and respective identities corresponding to other computing devices that utilize the shared file;
determining, by one or more computer processors, that a first user of the storage system has two computing devices based on information within the profile corresponding to the first user; in response to determining that the first user of the storage system has two computing devices, determining, by one or more computer processors, that a first computing device includes a first file that is not stored in the second computing device, wherein the second computing device is associated with a multi-factor identification scheme; receiving, by one or more computer processors, to the storage system, a version of a first file from the first computing device associated with the first user, wherein the first file is a file of the list of files of the user; and analyzing, by one or more computer processors, the received version of the first file to determine whether the received first file is suspected of encryption by malware, wherein analyzing the received version of the first file to determine whether the received version of the first file is suspected of encryption by malware further comprises:
determining, by one or more computer processors, one or more attributes associated with the received version of the first file;
comparing, by one or more computer processors, the one or more attributes of the received version of first file to one or more corresponding items related to the received version of the first file, wherein the items related to the received version of first file are selected from a group consisting of a structure of the received first file, a portion of content of the received version of the first file, one or more file attributes of other versions of the first file, a structure of another version of the first file, a portion of content of another version of the first file; and
in response to the comparison of the one or more attributes associated with the received version of the first file and the one or more corresponding items related to the received version of the first file identifying one or more differences and determining, by one or more computer processors, that the received first file is suspected of encryption by malware; responsive to determining that the received version of the first file is suspected of encryption by malware, initiating, by one or more computer processors, actions, including:
suspending replacement of another version of the first file backed up to the storage system with the received version of the first file;
storing the received version of the first file to a portion of the storage system designated for file isolation;
transmitting, to the first computing device and the second computing device associated with the first user, a notification to the first user indicating that the received version of the first file is suspected of encryption by malware, wherein the second computing device does not store the first file included in the first computing device; and
determining whether the first file is shared based on information within the profile associated with the first user;
in response to determining that the first file is shared, identifying, by one or more computer processors, respective identities for other computing devices that utilize a version of the shared first file, an identity of a second user respectively associated with one or more other computing devices that utilize the shared first file; transmitting, by one or more computer processors, another notification to the respective identities for other computing devices that utilize the shared first file and respective identities of second computing devices corresponding to the other users, wherein the other notification indicating that the received version of the first file is suspected of encryption by malware, and wherein the second computing devices corresponding to the other users lack the shared first file; and receiving, by one or more computer processors, from the second device of the first user, and based on the multi-factor identification scheme, a response indicating whether the shared first file is encrypted by malware.

Assignees

• IBM

Inventors

• Charters Graham C
• Dixon Bret W
• Horwood Benjamin T
• Poga Alexander H
• Shewell Mark A

Classifications

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/565 Primary

  by checking file integrity · CPC title

• G06F21/568

  eliminating virus, restoring damaged files · CPC title