Ransomware mitigation device and method
AssigneeARRIS Enterprises LLC
InventorsMichael R. Kahn, Christopher Poli
Life of this patent
Estimating the term…
Abstract
A system and method for backing up data is disclosed. In one embodiment, the method includes receiving N data segments, the N of data segments together defining first backup data read from a processing device, receiving L data segments, the L data segments together defining second backup data read from the processing device temporally subsequent to the reading of the N data segments, determining if the L data segments comprise ransomware, preventing overwriting of the stored N data segments if the L data segments comprise ransomware, and storing the received L data segments if the L data segments do not comprise ransomware.
Claims14
A method of processing data on a device that includes a processor, comprising:
- receiving N data segments, the N data segments together defining first backup data read from a processing device;
- storing the received N data segments;
- after receiving the N data segments, generating a signature for each one of M of the received data segments, wherein M<=N and associatively storing each generated signature of the M received data segments with the associated one of the M data segments;
- receiving L data segments, the L data segments together defining second backup data read from the processing device temporally subsequent to the receiving of the N data segments;
- after receiving the L data segments, generating a signature for each one of J of the received data segments, wherein J<=L;
- determining if whether the L data segments comprise ransomware from a comparison of the J signatures with the M signatures by (i) determining a number of differences between the J signatures and the M signatures;
- and (ii) determining that the L data segments comprise ransomware according to the determined number of differences;
- preventing overwriting of the stored N data segments if the L data segments comprise ransomware;
- and
- storing the received L data segments if the L data segments do not comprise ransomware.
An apparatus, comprising:
- a processor;
- a memory, communicatively coupled to the processor, the memory storing processor instructions comprising processor instructions for:
- receiving N data segments, the N data segments together defining first backup data read from a processing device;
- storing the received N data segments;
- after receiving the N data segments, generating a signature for each one of M of the received data segments, wherein M<=N and associatively storing each generated signature of the M received data segments with the associated one of the M data segments;
- receiving L data segments, the L data segments together defining second backup data read from the processing device temporally subsequent to the receiving of the N data segments;
- after receiving the L data segments, generating a signature for each one of J of the received data segments, wherein J<=L;
- determining if whether the L data segments comprise ransomware from a comparison of the J signatures with the M signatures;
- preventing overwriting of the stored N data segments if the L data segments comprise ransomware;
- and
- storing the received L data segments if the L data segments do not comprise ransomware' wherein:
- the processor instructions for generating a signature for each one of M of the received data segments, wherein M<=N comprise processor instructions for generating a hash of each one of the M of the received data segments;
- and
- the processor instructions for generating a signature for each one of J of the received data segments, wherein J<=L comprise processor instructions for generating a hash of each one of the J received data segments.
Dependencies are inferred from the claim text.