Back to results
US 12,743,512 B2Granted
Systems and methods for real-time database scanning using replication stream
AssigneeCloud Linux Software Inc.
InventorsIgor Seletskiy, Alexey Parfenov, Vitalii Rudnykh
Life of this patent
Estimating the term…
Abstract
Disclosed herein are systems and method for detecting malware signatures in replica databases. In one exemplary aspect, a method includes identifying a plurality of replica databases corresponding to a master database. In response to detecting a change in at least one entry of a first replica database of the plurality of replica databases, the method includes analyzing the change for malware. In response to detecting malware, the method includes executing a remediation action to resolve the malware.
Claims20
A method for a malware detection, a method comprising:
- identifying a plurality of replica databases corresponding to a master database, wherein data stored on each replica database of the plurality of replica databases is synchronized with data stored on the master database in real-time;
- in response to detecting a change in at least one entry of a first replica database of the plurality of replica databases, analyzing the change for malware by:
- retrieving a record associated with the at least one entry;
- applying a transformation to original contents of the record, wherein the transformation restructures text in the record;
- and
- scanning the transformed contents of the record for a malware signature;
- in response to detecting a portion of the transformed contents that matches the malware signature, executing a remediation action that removes a corresponding portion from the original contents of the record, wherein executing the remediation action comprises determining whether the portion is inside serialized data in the original contents of the record, and in response to determining that the portion is inside serialized data, fixing a serialized string length of the original contents after removing the corresponding portion;
- and
- updating the first replica database by replacing the at least one entry with an entry of the record on which the remediation action was executed.
6 more elements
A system for detecting malware signatures in a database, the system comprising:
- at least one memory;
- and
- at least one hardware processor coupled with the at least one memory configured, individually or in combination, to:
- identify a plurality of replica databases corresponding to a master database, wherein data stored on each replica database of the plurality of replica databases is synchronized with data stored on the master database in real-time;
- in response to detecting a change in at least one entry of a first replica database of the plurality of replica databases, analyze the change for malware by:
- retrieving a record associated with the at least one entry;
- applying a transformation to original contents of the record, wherein the transformation restructures text in the record;
- and
- scanning the transformed contents of the record for a malware signature;
- in response to detecting a portion of the transformed contents that matches the malware signature, execute a remediation action that removes a corresponding portion from the original contents of the record, wherein executing the remediation action comprises determining whether the portion is inside serialized data in the original contents of the record, and in response to determining that the portion is inside serialized data, fixing a serialized string length of the original contents after removing the corresponding portion;
- and
- update the first replica database by replacing the at least one entry with an entry of the record on which the remediation action was executed.
9 more elements
A non-transitory computer readable medium storing thereon computer executable instructions for detecting malware signatures in a database, including instructions for:
- identifying a plurality of replica databases corresponding to a master database, wherein data stored on each replica database of the plurality of replica databases is synchronized with data stored on the master database in real-time;
- in response to detecting a change in at least one entry of a first replica database of the plurality of replica databases, analyzing the change for malware by:
- retrieving a record associated with the at least one entry;
- applying a transformation to original contents of the record, wherein the transformation restructures text in the record;
- and
- scanning the transformed contents of the record for a malware signature;
- in response to detecting a portion of the transformed contents that matches the malware signature, executing a remediation action that removes a corresponding portion from the original contents of the record, wherein executing the remediation action comprises determining whether the portion is inside serialized data in the original contents of the record, and in response to determining that the portion is inside serialized data, fixing a serialized string length of the original contents after removing the corresponding portion;
- and
- updating the first replica database by replacing the at least one entry with an entry of the record on which the remediation action was executed.
6 more elements
Dependencies are inferred from the claim text.