Tree-based snapshots
Some examples relate generally to computer architecture software for information security and, in some more particular aspects, to tree-based snapshots and detecting malware therein.
1. A method for recovering or backing up a system, the method comprising:
generating a tree-based structure, the tree-based structure including a first snapshot, the first snapshot including at least a first feature, the first feature corresponding to a plurality of files and a plurality of pointers to the files;
determining a modification associated with the first feature since a first point in time when the first snapshot was generated;
identifying a first file from the plurality of files, the first file associated with the modification;
splitting the first feature into a first sub-feature and a second sub-feature, the first sub-feature including the first file, the second sub-feature including unmodified files in the plurality of files excluding the first file;
copying the first sub-feature to a second snapshot, the second snapshot being generated at a second point in time, the second point in time being subsequent to the first point in time;
generating a pointer to the first sub-feature to the second snapshot, the pointer including a file level hashing associated with the second point in time;
associating a first backward pointer with the second sub-feature including the unmodified files;
copying the first backward pointer to the second snapshot; and
restoring the system at least based on the first sub-feature and the first backward pointer in the second snapshot.
2. The method of claim 1 , wherein the first feature is included in a /tmp, /bin or /log directory.
3. The method of claim 1 , wherein the method further comprises:
determining a second modification identified at a third point in time subsequent to the first point in time associated with creation of the first or a second point in time associated with creation of the second snapshot;
identifying a second modified file within either the first feature associated with the first snapshot or first sub-feature associated with the second snapshot;
splitting the second modified file a third sub-feature and a fourth sub-feature, the third sub-feature including the second modified file, the fourth sub-feature including unmodified files in the plurality of files excluding the second modified file;
copying the third sub-feature to be included in a third snapshot, the third snapshot being associated with a fourth point in time subsequent to the the first snapshot and the second snapshot; and
generating a new pointer to the third sub-feature, the pointer including a file level hash associated with the second point in time.
4. The method of claim 3 , wherein the method further comprises:
associating a second backward pointer to the unmodified files and sub-features of the first or second snapshot;
copying the second backward pointer to be included in the third snapshot; and
further restoring the system based on the third sub-feature and the second backward pointer in the third snapshot.
5. A system for recovering or backing up files or directories, the system comprising:
at least one processor for executing machine-readable instructions; and
a memory storing instructions configured to cause the at least one processor to perform operations comprising, at least:
generating a tree-based structure, the tree-based structure including a first snapshot, the first snapshot including at least a first feature, the first feature corresponding to a plurality of files and a plurality of pointers to the files;
determining a modification associated with the first feature since a first point in time when the first snapshot was generated;
identifying a first file from the plurality of files the first file associated with the modification;
splitting the first feature into a first sub-feature and a second sub-feature, the first sub-feature including the first file, the second sub-feature including unmodified files in the plurality of files excluding the first file;
copying the first sub-feature to a second snapshot, the second snapshot being generated at a second point in time, the second point in time being subsequent to the first point in time;
generating: a pointer to the first sub-feature to the second snapshot, the pointer including a file level hashing associated with the second point in time;
associating a first backward pointer with the second sub-feature including the unmodified files;
copying the first backward pointer to the second snapshot; and
restoring the system at least based on the first sub-feature and the first backward pointer in the second snapshot.
6. The system of claim 5 , wherein the first feature is included in a /tmp, /bin or /log directory.
7. The system of claim 5 , wherein further comprising:
determining a second modification identified at a third point in time subsequent to the first point in time associated with creation of the first or a second point in time associated with creation of the second snapshot;
identifying a second modified file within either the first feature associated with the first snapshot or first sub-feature associated with the second snapshot;
splitting the second modified file a third sub-feature and a fourth sub-feature, the third sub-feature including the second modified file, the fourth sub-feature including unmodified files in the plurality of files excluding the second modified file;
copying the third sub-feature to be included in a third snapshot, the third snapshot being associated with a fourth point in time subsequent to the first snapshot and the second snapshot; and
generating a new pointer to the third sub-feature, the pointer including a file level hash associated with the second point in time.
8. The system of claim 7 , wherein the further comprising:
associating a second backward pointer to the unmodified files and sub-features of the first or second snapshot;
copying the second backward pointer to be included in the third snapshot; and
further restoring the system based on the third sub-feature and the second backward pointer in the third snapshot.
9. A non-transitory, machine-readable medium storing instructions which, when read by a machine, cause the machine to perform operations in a method for recovering or backing up a system, the operations comprising, at least:
generating a tree-based structure, the tree-based structure including a first snapshot, the first snapshot including at least a first feature, the first feature corresponding to a plurality of files and a plurality of pointers to the files;
determining a modification associated with the first feature since a first point in time when the first snapshot was generated;
identifying a first file from the plurality of files, the first file associated with the modification,
splitting the first feature into a first sub-feature and a second sub-feature, the first sub-feature including the first file, the second sub-feature including unmodified files in the plurality of files excluding the first file;
copying the first sub-feature to a second snapshot, the second snapshot being generated at a second point in time, the second point in time being subsequent to the first point in time;
generating a pointer to the first sub-feature to the second snapshot, the pointer including a file level hashing associated with the second point in time;
associating a first backward pointer with the second sub-feature including the unmodified files;
copying the first backward pointer to the second snapshot; and
restoring the system at least based on the first sub-feature and the first backward pointer in the second snapshot.
10. The medium of claim 9 , wherein the first feature is included in a /tmp, /bin or /log directory.
11. The medium of claim 9 , wherein further comprising:
determining a second modification identified at a third point in time subsequent to the first point in time associated with creation of the first or a second point in time associated with creation of the second snapshot;
identifying a second modified file within either the first feature associated with the first snapshot or first sub-feature associated with the second snapshot;
splitting the second modified file a third sub-feature and a fourth sub-feature, the third sub-feature including the second modified file, the fourth sub-feature including unmodified files in the plurality of files excluding the second modified file;
copying the third sub-feature to be included in a third snapshot, the third snapshot being associated with a fourth point in time subsequent to the first snapshot and the second snapshot; and
generating a new pointer to the third sub-feature, the pointer including a file level hash associated with the second point in time.
12. The medium of claim 11 , wherein further comprising:
associating a second backward pointer to the unmodified files and sub-features of the first or second snapshot;
copying the second backward pointer to be included in the third snapshot; and
further restoring the system based on the third sub-feature and the second backward pointer in the third snapshot.
13. The method of claim 1 , wherein the file level hashing is decremented when a snapshot expires, and an associated file being permanently deleted when the file level hashing is reduced to a particular threshold value.
14. The method of claim 1 , where in modifying the sub-features includes merging at least the first file with a second file in the first snapshot or includes dividing at least the first file with the second file.
15. The system of claim 5 , wherein the file level hashing is decremented when a snapshot expires, and an associated file being permanently deleted when the file level hashing is reduced to a particular threshold value.
16. The system of claim 5 , where in modifying the sub-features includes merging at least the first file with a second file in the first snapshot or includes dividing at least the first file with the second file.
17. The medium of claim 9 , wherein the file level hashing is decremented when a snapshot expires, and an associated file being permanently deleted when the file level hashing is reduced to a particular threshold value.
18. The medium of claim 9 , where in modifying the sub-features includes merging at least the first file with a second file in the first snapshot or includes dividing at least the first file with the second file.