Information protection method and system

• US 20080016564A1
• Filed: 08/16/2006
• Published: 01/17/2008
• Est. Priority Date: 08/16/2005
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Baim, Jason, Cobb, Daniel, Claudatos, Christopher
• Granted Patent: US 8,255,998 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files

Abstract

A method for protecting objects in a computer system against malware is disclosed. An object is analyzed to determine whether it is infected by malware, and if it is determined to be infected, a backup copy of the object is located in a backup of the objects. The infected object is replaced with the backup copy.

Claims

1. A method for protecting objects in a computer system, comprising determining whether an object is infected by malware, and if the object is infected:

locating a first backup copy of the object in a backup of the objects; and

replacing the object with the first backup copy.

2. The method as recited in claim 1, further comprising determining whether the first backup copy is infected by malware.

3. The method as recited in claim 2, further comprising locating a second backup copy if the first backup copy is infected.

4. The method as recited in claim 3, wherein locating the second backup copy includes identifying a backup copy that is older than the first backup copy.

5. The method as recited in claim 4, wherein identifying the second backup copy includes comparing a candidate backup copy to the first backup copy to determine whether the second backup copy is different from the first backup copy.

6. The method as recited in claim 5, wherein comparing the candidate backup copy to the first backup copy includes comparing a hash value of the candidate backup copy to a hash value of the first backup copy.

7. The method as recited in claim 5, further comprising determining whether the second backup copy is infected by malware only if the second backup copy is different from the first backup copy.

8. The method as recited in claim 1, wherein the backup comprises an online backup storage and an offline backup storage, and locating the first backup copy comprises searching the online backup storage.

9. The method as recited in claim 8, wherein locating the first backup copy further comprises searching the offline backup storage after searching the online backup storage.

10. The method as recited in claim 1, further comprising determining an infection point in time at which the object became infected.

11. The method as recited in claim 10, further comprising using the infection point to select the first backup copy.

12. The method as recited in claim 11, wherein selecting the first backup copy includes selecting a backup copy made prior to the infection point.

13. The method as recited in claim 12, further comprising determining whether the first backup copy is infected by malware.

14. The method as recited in claim 13, wherein determining whether the first backup copy is infected includes submitting the first backup copy to an antivirus engine.

15. The method as recited in claim 1, further comprising querying a user whether to replace the infected object with a backup copy.

16. A method for protecting objects in a system comprising a backup including backup copies of the objects, the method comprising:

determining a pattern associated with an object, using at least one backup copy of the object; and

detecting a deviation from the pattern to identify an anomaly indicating that the object is infected by malware.

17. The method as recited in claim 16, wherein determining the pattern includes analyzing at least one selected from the group comprising object size, times of access to the object, location of access to the object, or source of changes to the object.

18. The method as recited in claim 16, wherein detecting the deviation from the pattern includes monitoring an access log for the object or analyzing the backup copies for copies that deviate from the pattern.

19. The method as recited in claim 16, further comprising identifying an infection point in time when the object became infected by malware.

20. The method as recited in claim 19, further comprising retrieving a backup copy made prior to the infection point.