IP Library Granted Patent US 8,745,001
Granted Patent B1
US 8,745,001 · App. 12/059,200 · Granted Jun 3, 2014

Automated remediation of corrupted and tempered files

View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 8,745,001
App. No.
12/059,200
Granted
Jun 3, 2014
Kind
B1
Abstract

A method, apparatus and computer-readable storage medium for ascertaining a set of preliminary characteristics of a first data structure and, responsive to determining that the set of preliminary characteristics matches a set of characteristics of a reference data structure, determining that a secondary characteristic of the first data structure indicates a replacement of the first data structure with the reference data structure is disclosed. Embodiments of the present invention further include replacing the first data structure with the reference data structure, in response to determining that the secondary characteristic of the first data structure indicates the replacement of the first data structure.

Claims (109)

1. A method comprising:

ascertaining a set of preliminary characteristics of a first data structure, wherein

said ascertaining said set of preliminary characteristics of said first data structure comprises

surveying said first data structure for said set of preliminary characteristics, and

storing said set of preliminary characteristics in a file integrity database;

responsive to determining that said set of preliminary characteristics matches a set of characteristics of a reference data structure, determining whether said first data structure is corrupt and should be replaced with said reference data structure, wherein

said reference data structure is a copy of said first data structure,

said determining whether said first data structure is corrupt and should be replaced with said reference data structure is performed by a computing device,

said determining whether said first data structure is corrupt and should be replaced with said reference data structure comprises determining whether a rule from a set of rules indicates replacement of said first data structure based on a set of secondary characteristics of said first data structure,

each rule from said set of rules identifies whether said first data structure is corrupt, and

said set of secondary characteristics of said first data structure comprises characteristics that identify said first data structure and describe content and/or a format of said first data structure; and

responsive to determining that said first data structure is corrupt and should be replaced with said reference data structure, replacing said first data structure with said reference data structure.

2. The method of claim 1 , further comprising, responsive to determining that said set of preliminary characteristics does not match said set of characteristics of said reference data structure:

storing said first data structure in a backup medium; and

recording said set of preliminary characteristics to said file integrity database.

3. The method of claim 1 , further comprising, responsive to determining that said first data structure is corrupt and should be replaced with said reference data structure:

running a diagnostic engine; and

recording a result of said diagnostic engine to said file integrity database.

4. The method of claim 1 , further comprising:

recording said set of preliminary characteristics and a replacement indication to said file integrity database.

5. The method of claim 1 , further comprising:

comparing said set of preliminary characteristics of said first data structure to said set of characteristics of said reference data structure, wherein

said set of characteristics of said reference data structure is stored in a file record,

said file record is selected from a plurality of file records within a machine record, and

said machine record is selected from a plurality of machine records in said file integrity database.

6. The method of claim 1 , wherein said determining whether said first data structure is corrupt and should be replaced with said reference data structure further comprises:

determining whether an item of creation data indicates that said first data structure should be replaced with said reference data structure;

determining whether an item of modification data indicates that said first data structure should be replaced with said reference data structure;

determining whether an item of access data indicates that said first data structure should be replaced with said reference data structure;

determining whether an item of ownership data indicates that said first data structure should be replaced with said reference data structure;

determining whether an internal name indicates that said first data structure should be replaced with said reference data structure;

determining whether a company name indicates that said first data structure should be replaced with said reference data structure;

determining whether an item of content data indicates that said first data structure should be replaced with said reference data structure;

determining whether an item of metadata indicates that said first data structure should be replaced with said reference data structure;

determining whether a size of said data structure indicates that said first data structure should be replaced with said reference data structure;

determining whether a hash of said data structure indicates that said first data structure should be replaced with said reference data structure;

determining whether a language of said data structure indicates that said first data structure should be replaced with said reference data structure;

determining whether a name of said data structure indicates that said first data structure should be replaced with said reference data structure;

determining whether a version of said data structure indicates that said first data structure should be replaced with said reference data structure;

determining whether a product name indicates that said first data structure should be replaced with said reference data structure; and

determining whether a product version indicates that said first data structure should be replaced with said reference data structure.

7. A system comprising:

one or more processors; and

memory coupled to said one or more processors, wherein the memory stores program instructions executable by said one or more processors to:

ascertain a set of preliminary characteristics of a first data structure, wherein

said program instructions that are executable to ascertain said set of preliminary characteristics of said first data structure are further executable to

survey said first data structure for said set of preliminary characteristics, and

store said set of preliminary characteristics in a file integrity database,

determine whether said first data structure is corrupt and should be replaced with a reference data structure, in response to a determination that said set of preliminary characteristics matches a set of characteristics of said reference data structure, wherein

said reference data structure is a copy of said first data structure,

said determination as to whether said first data structure is corrupt and should be replaced with said reference data structure determines whether a rule from a set of rules indicates replacement of said first data structure based on a set of secondary characteristics of said first data structure,

each rule from said set of rules is used to identify whether said first data structure is corrupt, and

said set of secondary characteristics of said first data structure comprises characteristics that identify said first data structure and describe content and/or a format of said first data structure, and

replace said first data structure with said reference data structure, in response to a determination that said first data structure is corrupt and should be replaced with said reference data structure.

8. The system of claim 7 , wherein the program instructions are further executable to:

store said first data structure in a backup medium, in response to a determination that said set of preliminary characteristics does not match said set of characteristics of said reference data structure, and

record said set of preliminary characteristics to said file integrity database, in response to said determination that said set of preliminary characteristics does not match said set of characteristics of said reference data structure.

9. The system of claim 7 , wherein the program instructions are further executable to:

run a diagnostic engine, and

record a result of said diagnostic engine to said file integrity database.

10. The system of claim 7 , wherein the program instructions are further executable to:

record said set of preliminary characteristics and a replacement indication to said file integrity database.

11. The system of claim 7 , wherein the program instructions are further executable to:

compare said set of preliminary characteristics of said first data structure to said set of characteristics of said reference data structure, wherein

said set of characteristics of said reference data structure is stored in a file record,

said file record is selected from a plurality of file records within a machine record, and

said machine record is selected from a plurality of machine records in said file integrity database.

12. The system of claim 7 , wherein the instructions are further configured to:

determine whether an item of creation data indicates that said first data structure should be replaced with said reference data structure,

determine whether an item of modification data indicates that said first data structure should be replaced with said reference data structure,

determine whether an item of access data indicates that said first data structure should be replaced with said reference data structure,

determine whether an item of ownership data indicates that said first data structure should be replaced with said reference data structure,

determine whether an internal name indicates that said first data structure should be replaced with said reference data structure,

determine whether a company name indicates that said first data structure should be replaced with said reference data structure,

determine whether an item of content data indicates that said first data structure should be replaced with said reference data structure,

determine whether an item of metadata indicates that said first data structure should be replaced with said reference data structure,

determine whether a size of said data structure indicates that said first data structure should be replaced with said reference data structure,

determine whether a hash of said data structure indicates that said first data structure should be replaced with said reference data structure,

determine whether a language of said data structure indicates that said first data structure should be replaced with said reference data structure,

determine whether a name of said data structure indicates that said first data structure should be replaced with said reference data structure,

determine whether a version of said data structure indicates that said first data structure should be replaced with said reference data structure,

determine whether a product name indicates that said first data structure should be replaced with said reference data structure, and

determine whether a product version indicates that said first data structure should be replaced with said reference data structure.

13. A non-transitory computer-readable storage medium, comprising:

a first set of instructions, executable by a processor, configured to ascertain a set of preliminary characteristics of a first data structure, wherein

said first set of instructions that are configured to ascertain said set of preliminary characteristics of said first data structure further comprise

a first subset of instructions, executable by said processor, configured to survey said first data structure for said set of preliminary characteristics, and

a second subset of instructions, executable by said processor, configured to store said set of preliminary characteristics in a file integrity database;

a second set of instructions, executable by said processor, configured to determine whether said first data structure is corrupt and should be replaced with a reference data structure, in response to a determination that said set of preliminary characteristics matches a set of characteristics of said reference data structure, wherein

said reference data structure is a copy of said first data structure,

said determination as to whether said first data structure is corrupt and should be replaced with said reference data structure determines whether a rule from a set of rules indicates replacement of said first data structure based on a set of secondary characteristics of said first data structure,

each rule from said set of rules is used to identify whether said first data structure is corrupt, and

said set of secondary characteristics of said first data structure comprises characteristics that identify said first data structure and describe content and/or a format of said first data structure; and

a third set of instructions, executable by said processor, configured to replace said first data structure with said reference data structure in response to determining that said first data structure is corrupt and should be replaced with said reference data structure.

14. The non-transitory computer-readable storage medium of claim 13 , further comprising:

a fourth set of instructions, executable by said processor, configured to:

store said first data structure in a backup medium, in response to a determination that said set of preliminary characteristics does not match said set of characteristics of said reference data structure, and

record said set of preliminary characteristics to said file integrity database, in response to said determination that said set of preliminary characteristics does not match said set of characteristics of said reference data structure.

15. The non-transitory computer-readable storage medium of claim 13 , further comprising:

a fourth set of instructions, executable by said processor, configured to:

run a diagnostic engine, in response to a determination that said first data structure is corrupt and should be replaced with said reference data structure, and

record a result of said diagnostic engine to said file integrity database, in response to said determination that said first data structure should be replaced with said reference data structure.

16. The non-transitory computer-readable storage medium of claim 13 , further comprising:

a fourth set of instructions, executable by said processor, configured to record said set of preliminary characteristics and a replacement indication to said file integrity database.

17. The non-transitory computer-readable storage medium of claim 13 , further comprising:

a fourth set of instructions, executable by said processor, configured to compare said set of preliminary characteristics of said first data structure to said set of characteristics of said reference data structure, wherein

said set of characteristics of said reference data structure are stored in a file record,

said file record is selected from a plurality of file records within a machine record, and

said machine record is selected from a plurality of machine records in said file integrity database.

Assignments (5)
NOTICE OF SUCCESSION OF AGENCY (REEL 050926 / FRAME 0560) Recorded Sep 13, 2022
From: JPMORGAN CHASE BANK, N.A.
To: BANK OF AMERICA, N.A., AS COLLATERAL AGENT
Reel/Frame 061422/0371 →
SECURITY AGREEMENT Recorded Sep 13, 2022
From: NORTONLIFELOCK INC.
To: BANK OF AMERICA, N.A., AS COLLATERAL AGENT
Reel/Frame 062220/0001 →
CHANGE OF NAME Recorded Jun 18, 2020
From: SYMANTEC CORPORATION
To: NORTONLIFELOCK INC.
Reel/Frame 053306/0878 →
SECURITY AGREEMENT Recorded Nov 4, 2019
From: SYMANTEC CORPORATION; BLUE COAT LLC; LIFELOCK, INC,; SYMANTEC OPERATING CORPORATION
To: JPMORGAN, N.A.
Reel/Frame 050926/0560 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 29, 2015
From: SYMANTEC OPERATING CORPORATION
To: SYMANTEC CORPORATION
Reel/Frame 036205/0117 →