Method and apparatus for repairing damage to a computer system using a system rollback mechanism
AssigneeInternational Business Machines Corporation
InventorsMorton Gregory Swimmer, Ian Nicholas Whalley
Life of this patent
Estimating the term…
Abstract
A method and apparatus for managing protecting data from damage in a data processing system. The data is journaled to form journaled data. A determination is then made as to whether a virus is present in the data processing system after journaling of data has begun. Journaling involves storing a system state before an action is executed so that the state can be restored upon demand. The detection of a virus may be performed by using pattern matching on system audit trails in which the system audit trails contain activities occurring within the data processing system. In response to an identification of the virus, the data is restored to its previous state using the journaled data.
Claims67
A method in a data processing system for protecting data from damage, the method comprising:
- journaling the data to form journaled data;
- determining whether a virus is present in the data processing system after journaling of data has begun;
- and
- responsive to an identification of the virus, restoring the data using the journaled data.
A method in a data processing system for repairing damage to data, the method comprising:
- saving a state of a data object in response to a request to access the data object by a process;
- performing pattern matching of a set of actions taken within the data processing system;
- and
- determining whether an unauthorized intrusion has occurred in response to performing pattern matching.
An intrusion protection system for use in a data processing system comprising:
- a sensor filter, wherein the sensor filter receives requests to access data within the data processing system from a process;
- a pattern matcher, wherein the pattern matcher receives actions initiated by the process, compares the actions to a pattern to form a comparison, determines whether an unauthorized intrusion has occurred, generates a first indication in response to an identification of an absence of an unauthorized intrusion, and generates a second indication to restore the data to a prior state in response to an identification of the unauthorized intrusion;
- and
- a journaler, wherein the journaler journals data in response to accessing of the data and restores the data to the prior state in response to the indication by the pattern matcher, wherein the data is journaled until the first indication is generated by the pattern matcher.
A data processing system comprising:
- a bus system;
- a communications unit connected to the bus system;
- a memory connected to the bus system, wherein the memory includes as set of instructions;
- and
- a processing unit connected to the bus system, wherein the processing unit executes the set of instructions to journal the data to form journaled data;
- determines whether a virus is present in the data processing system after journaling of data has begun;
- and restores the data using the journaled data in response to an identification of the virus.
A data processing system comprising:
- a bus system;
- a communications unit connected to the bus system;
- a memory connected to the bus system, wherein the memory includes a set of instructions;
- and
- a processing unit connected to the bus system, wherein the processing unit executes the set of instructions to save a state of a data object in response to a request to access the data object by a process;
- perform pattern matching of a set of actions taken within the data processing system;
- and determine whether an unauthorized intrusion has occurred in response to performing pattern matching.
A data processing system for protecting data from damage, the data processing system comprising:
- journaling means for journaling the data to form journaled data;
- determining means for determining whether a virus is present in the data processing system after journaling of data has begun;
- and
- restoring means, responsive to an identification of the virus, for restoring the data using the journaled data.
A data processing system for repairing damage to data, the data processing system comprising:
- saving means for saving a state of a data object in response to a request to access the data object by a process;
- performing means for performing pattern matching of a set of actions taken within the data processing system;
- and
- determining means for determining whether an unauthorized intrusion has occurred in response to performing pattern matching.
A computer program product in a computer readable medium for protecting data from damage, the computer program product comprising:
- first instructions for journaling the data to form journaled data;
- second instructions for determining whether a virus is present in the data processing system after journaling of data has begun;
- and
- third instructions, responsive to an identification of the virus, for restoring the data using the journaled data.
A computer program product in a computer readable medium for repairing damage to data, the computer program product comprising:
- first instructions for saving a state of a data object in response to a request to access the data object by a process;
- second instructions for performing pattern matching of a set of actions taken within the data processing system;
- and
- third instructions for determining whether an unauthorized intrusion has occurred in response to performing pattern matching.
Dependencies are inferred from the claim text.