System and method for protecting against data storage attacks
AssigneeCheck Point Software Technologies Ltd.
InventorsLiran Orevi, Haggai David
Life of this patent
Estimating the term…
Abstract
A system, method, and device are provided for detecting and mitigating a storage attack at the block level by generating canary blocks by marking blocks of data (referred to as memory blocks) such that other programs do not modify these canary blocks that are monitored to detect data storage attacks that attempt to modify the canary blocks and/or by monitoring statistical and behavioral features of activities over blocks, whether they can be modified by other programs or not. The system and method also backup the memory blocks by backing up memory blocks as they are modified. When a data storage attack is detected, the attack is stopped, and the files are remediated using the backup of the affected memory blocks.
Claims20
An electronic device for detecting and mitigating a storage attack at the block level, the electronic device comprising:
- a memory including multiple memory blocks at the physical level, wherein electronic files and metadata for the electronic files are stored in one or more of the memory blocks;
- processor circuitry configured to:
- generate a backup by detecting modifications in the memory blocks and storing a memory block backup of memory blocks that have been modified;
- designate one or more of the memory blocks as canary blocks, such that an operating system does not use the canary blocks for storing the electronic files;
- detect the storage attack by monitoring the canary blocks to identify as a modified canary block a modified one of the canary blocks;
- and
- when the storage attack is detected by the identification of the modified canary block, mitigating the storage attack by:
- identifying a malicious process that caused the modification to the modified canary block;
- identifying modified memory blocks that were also modified by the identified malicious process;
- and
- restoring from the backup the memory block backup of the identified modified memory blocks, such that the electronic files and the metadata stored in the modified memory blocks are restored.
A method implemented by processor circuitry for detecting and mitigating a storage attack on memory at the block level, the method comprising:
- generating a backup using the processor circuitry by detecting modifications in memory blocks of the memory and storing a memory block backup of memory blocks that have been modified, wherein the memory includes multiple memory blocks at the physical level and electronic files and metadata for the electronic files are stored in one or more of the memory blocks;
- designating with the processor circuitry one or more of the memory blocks as canary blocks, such that an operating system does not use the canary blocks for storing the electronic files;
- detecting the storage attack with the processor circuitry by monitoring the canary blocks to identify as a modified canary block a modified one of the canary blocks;
- and
- when the storage attack is detected by the identification of the modified canary block, mitigating the storage attack with the processor circuitry by:
- identifying a malicious process that caused the modification to the modified canary block;
- identifying modified memory blocks that were also modified by the identified malicious process;
- and
- restoring from the backup the memory block backup of the identified modified memory blocks, such that the electronic files and the metadata stored in the modified memory blocks are restored.
A non-transitory computer readable memory having software embodied thereon for detecting and mitigating a storage attack at the block level when the software is executed by processor circuitry, wherein the executing of the software causes the processor circuitry to:
- generate a backup by detecting modifications in memory blocks of the memory and storing a memory block backup of memory blocks that have been modified, wherein the memory includes multiple memory blocks at the physical level and electronic files and metadata for the electronic files are stored in one or more of the memory blocks;
- designate one or more of the memory blocks as canary blocks, such that an operating system does not use the canary blocks for storing the electronic files;
- detect the storage attack by monitoring the canary blocks to identify as a modified canary block a modified one of the canary blocks;
- and
- when the storage attack is detected by the identification of the modified canary block, mitigate the storage attack by:
- identifying a malicious process that caused the modification to the modified canary block;
- identifying modified memory blocks that were also modified by the identified malicious process;
- and
- restoring from the backup the memory block backup of the identified modified memory blocks, such that the electronic files and the metadata stored in the modified memory blocks are restored.
Dependencies are inferred from the claim text.