Restoration of data corrupted by viruses using pre-infected copy of data
First Claim
1. A method comprising:
- determining whether a set of data received from a computer exhibits an indication of data corruption at the computer; and
if the set of data exhibits an indication of data corruption, performing acts of;
causing data at the computer to be deleted so as to eliminate the source of the data corruption; and
transmitting a copy of the mirrored data from a network appliance to the computer to restore the data that has been corrupted at the computer, wherein the mirrored data represents data that was stored at the computer prior to the data corruption.
10 Assignments
0 Petitions
Accused Products
Abstract
Post-infection virus protection through data restoration using mirrored data that has been obtained prior to the virus infection. A network appliance in a network mirrors the data of a number of computers in an ongoing manner. An anti-virus module of the network appliance scans data received from a computer to determine whether the computer is infected by a virus. If no virus is identified, the network appliance uses the received data to update a mirrored copy of the computer'"'"'s data. If, however, the network appliance identifies a virus, the mirrored copy is not updated. Instead, the previous mirrored copy, which represents a pre-infection state of the data, is used to restore the infected computer to its pre-infection state. In this manner, a single copy of an anti-virus utility executed at the network appliance can protect an arbitrary number of computers, which do not require their own anti-virus software.
287 Citations
21 Claims
-
1. A method comprising:
-
determining whether a set of data received from a computer exhibits an indication of data corruption at the computer; and
if the set of data exhibits an indication of data corruption, performing acts of;causing data at the computer to be deleted so as to eliminate the source of the data corruption; and transmitting a copy of the mirrored data from a network appliance to the computer to restore the data that has been corrupted at the computer, wherein the mirrored data represents data that was stored at the computer prior to the data corruption. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A method comprising:
-
receiving a set of data from a computer; determining whether the set of data exhibits an indication of the computer having received virus; and if the set of data exhibits said indication, performing acts of; causing data at the computer to be deleted so as to eliminate any copy of the virus at the computer; and transmitting a copy of the mirrored data from a network appliance to the computer to restore the data that has been corrupted at the computer, wherein the mirrored data represents data that was stored at the computer prior to the data corruption. - View Dependent Claims (12, 13, 14, 15, 16)
-
-
17. A computer network, comprising:
-
one or more computers, each having a storage device in which data is stored; and a network appliance including; a mirroring storage device that maintains a mirrored copy of the data stored in the storage device of each of the one or more computers; a signature analyzer that performs signature analysis on sets of data received from the one or more computers to determine whether the sets of data exhibit an indication of corruption of the data stored in the storage devices of the corresponding computers; and a scrubbing module that, if it is determined that a particular set of data exhibits said indication, controls restoration of the data stored in the storage device of the corresponding computer. - View Dependent Claims (18, 19, 20, 21)
-
Specification