# US 12,602,478 B2 · Malware monitoring and detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,602,478 B2 - Document ID: US12602478B2 - Status: Granted - Kind: B2 - Application number: 18/586,382 - Filed: 2024-02-23 - Published: 2025-08-28 - Granted: 2026-04-14 - Earliest claimed: 2024-02-23 - Assignees: Rubrik, Inc. - Applicants: Rubrik, Inc. - Inventors: Gregory Robert Johnston; Ishaan Sang; Kunal Sean Munshani; Adam Gee; Guilherme Menezes; Kelvin Kwan; Shivanshu Agrawal; Muraliraja Muniraju; Aaron Chen - Web page: https://patentgrep.com/patent/US12602478B2 ## CPC - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/568: {eliminating virus, restoring damaged files} - G06F 11/14: Error detection or correction of the data by redundancy in operations (error detection or correction of the data by redundancy in hardware G06F11/16) - G06F 11/1448: {Management of the data involved in backup or backup restore} - G06F 11/1451: {by selection of backup contents} - G06F 11/1469: {Backup restoration techniques} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 2201/84: Using snapshots, i.e. a logical point-in-time copy of the data - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods, systems, and devices for data management are described. A data management system (DMS) may maintain a malware threat feed that includes updated (e.g., periodically or continuously updated) malware intelligence. For example, the malware intelligence may involve YARA rules and known hashes indicative of malware. The DMS may use the malware intelligence to scan each new snapshot of a customer computing system to determine if the new snapshot contains malware. The DMS may periodically, or in response to reception of new malware intelligence, check the files within the most recent snapshot of each computing system for a customer to determine whether any computing system of the customer contains malware. When malware is detected in a file within a snapshot—either based on checking a newly captured snapshot or when checking snapshots based on new malware intelligence—the DMS may determine the temporally first snapshot which contained the corrupted file. ## Claims ### Claim 1 A method, comprising: receiving, by a data management system (DMS), an indication of a set of malware detection rules associated with a customer of the DMS; capturing, by the DMS, a first snapshot of a computing system associated with the customer and a differential filesystem metadata file, wherein the differential filesystem metadata file includes metadata indicative of files that have been modified or added with respect to a second snapshot of the computing system, the second snapshot prior in time to the first snapshot; performing a check, by the DMS and based at least in part on capturing the first snapshot, of a set of files within the first snapshot based at least in part on the set of malware detection rules, wherein the set of files comprises the files indicated by the differential filesystem metadata file as having been modified or added with respect to the second snapshot; detecting, by the DMS and based at least in part on the check, that a file of the set of files comprises first malware; and identifying, by the DMS based at least in part on detecting that the file comprises the first malware, a temporally first snapshot of the computing system that includes the file comprising the first malware. ### Claim 2 (depends on 1) The method of claim 1, further comprising: transmitting, by the DMS to a computing device associated with an administrative account associated with the customer, an alert message comprising an indication that the file comprises the first malware and an indication of the temporally first snapshot. ### Claim 3 (depends on 2) The method of claim 2, further comprising: receiving, by the DMS from the computing device and based at least in part on the alert message, a recovery request message, wherein the recovery request message comprises an indication to perform a recovery procedure for the computing system using a recovery snapshot that is temporally prior to the temporally first snapshot; and performing, by the DMS, the recovery procedure based at least in part on the recovery request message. ### Claim 4 (depends on 3) The method of claim 3, further comprising: identifying, by the DMS and based at least in part on detecting that the file comprises the first malware, the recovery snapshot, wherein the recovery snapshot is prior in time to the temporally first snapshot in a chain of snapshots of the computing system, and wherein the alert message further comprises an indication of the recovery snapshot. ### Claim 5 (depends on 1) The method of claim 1, further comprising: performing a second check, by the DMS and based at least in part on reception of the set of malware detection rules, of respective sets of files within a respective set of most recent snapshots of a set of computing systems associated with the customer based at least in part on the set of malware detection rules, the set of computing systems comprising the computing system. ### Claim 6 (depends on 5) The method of claim 5, further comprising: detecting, by the DMS and based on the second check, that a second file of a respective set of files within a first most recent snapshot of the respective set of most recent snapshots corresponding to a first respective computing system of the set of computing systems comprises second malware; and identifying, by the DMS and based on detecting that the second file comprises the second malware, a second temporally first snapshot of the first respective computing system that includes the second file comprising the second malware. ### Claim 7 (depends on 6) The method of claim 6, further comprising: transmitting, by the DMS to a computing device associated with an administrative account associated with the customer, an alert message comprising an indication that the second file comprises the second malware and an indication of the second temporally first snapshot. ### Claim 8 (depends on 5) The method of claim 5, further comprising: identifying, by the DMS, that a time period since a last check of the respective sets of files within the respective set of most recent snapshots of the set of computing systems satisfies a threshold time period, wherein performance of the second check is based at least in part on identifying that the time period satisfies the threshold time period. ### Claim 9 (depends on 5) The method of claim 5, wherein performing the second check comprises: scanning the respective sets of files against the set of malware detection rules. ### Claim 10 (depends on 5) The method of claim 5, wherein performing the second check comprises: performing a comparison of a hash catalog associated with the customer to a set of hashes indicative of malware, the set of malware detection rules comprising the set of hashes indicative of malware. ### Claim 11 (depends on 1) The method of claim 1, wherein performing the check comprises: scanning the set of files against the set of malware detection rules. ### Claim 12 (depends on 1) The method of claim 1, wherein performing the check comprises: computing a respective set of hashes for the set of files; and performing a comparison of the respective set of hashes to a bloom filter representative of a set of hashes indicative of malware, the set of malware detection rules comprising the set of hashes indicative of malware. ### Claim 13 (depends on 12) The method of claim 12, further comprising: identifying, based at least in part on the comparison, that a subset of hashes of the respective set of hashes match known malware; and checking a subset of the set of files corresponding to the subset of hashes against a set of known malware. ### Claim 14 (depends on 1) The method of claim 1, wherein the set of malware detection rules comprise a first subset of malware detection rules specific to the customer and a second subset of malware detection rules common to a plurality of customers of the DMS. ### Claim 15 (depends on 14) The method of claim 14, further comprising: receiving, by the DMS, an indication of a second set of malware detection rules associated with a second customer of the DMS, wherein the second set of malware detection rules comprise a third subset of malware detection rules specific to the customer and the second subset of malware detection rules. ### Claim 16 (depends on 15) The method of claim 15, further comprising: capturing, by the DMS, a third snapshot of a second computing system associated with the second customer; performing a second check, by the DMS and based at least in part on capturing the third snapshot, of a second set of files within the third snapshot based at least in part on the set of malware detection rules, wherein the second set of files comprise files that have been modified or added with respect to a fourth snapshot of the second computing system prior in time to the third snapshot; detecting, by the DMS and based at least in part on the check, that a second file of the set of files comprises second malware; and identifying, by the DMS based at least in part on detecting that the second file comprises the second malware, a second temporally first snapshot of the second computing system that includes the second file comprising the second malware. ### Claim 17 An apparatus, comprising: one or more memories storing processor-executable code; and one or more processors coupled with the one or more memories and individually or collectively operable to execute the code to cause the apparatus to: receive, by a data management system (DMS), an indication of a set of malware detection rules associated with a customer of the DMS; capture, by the DMS, a first snapshot of a computing system associated with the customer and a differential filesystem metadata file, wherein the differential filesystem metadata file includes metadata indicative of files that have been modified or added with respect to a second snapshot of the computing system, the second snapshot prior in time to the first snapshot; perform a check, by the DMS and based at least in part on capturing the first snapshot, of a set of files within the first snapshot based at least in part on the set of malware detection rules, wherein the set of files comprises the files indicated by the differential filesystem metadata file as having been modified or added with respect to the second snapshot; detect, by the DMS and based at least in part on the check, that a file of the set of files comprises first malware; and identify, by the DMS based at least in part on detecting that the file comprises the first malware, a temporally first snapshot of the computing system that includes the file comprising the first malware. ### Claim 18 (depends on 17) The apparatus of claim 17, wherein the one or more processors are individually or collectively further operable to execute the code to cause the apparatus to: transmit, by the DMS to a computing device associated with an administrative account associated with the customer, an alert message comprising an indication that the file comprises the first malware and an indication of the temporally first snapshot. ### Claim 19 (depends on 18) The apparatus of claim 18, wherein the one or more processors are individually or collectively further operable to execute the code to cause the apparatus to: receive, by the DMS from the computing device and based at least in part on the alert message, a recovery request message, wherein the recovery request message comprises an indication to perform a recovery procedure for the computing system using a recovery snapshot that is temporally prior to the temporally first snapshot; and perform, by the DMS, the recovery procedure based at least in part on the recovery request message. ### Claim 20 A non-transitory computer-readable medium storing code, the code comprising instructions executable by one or more processors to: receive, by a data management system (DMS), an indication of a set of malware detection rules associated with a customer of the DMS; capture, by the DMS, a first snapshot of a computing system associated with the customer and a differential filesystem metadata file, wherein the differential filesystem metadata file includes metadata indicative of files that have been modified or added with respect to a second snapshot of the computing system, the second snapshot prior in time to the first snapshot; perform a check, by the DMS and based at least in part on capturing the first snapshot, of a set of files within the first snapshot based at least in part on the set of malware detection rules, wherein the set of files comprises the files indicated by the differential filesystem metadata file as having been modified or added with respect to the second snapshot; detect, by the DMS and based at least in part on the check, that a file of the set of files comprises first malware; and identify, by the DMS based at least in part on detecting that the file comprises the first malware, a temporally first snapshot of the computing system that includes the file comprising the first malware.