MALWARE IN TREE-BASED SNAPSHOTS
Some examples relate generally to computer architecture software for information security and, in some more particular aspects, to tree-based snapshots and detecting malware therein.
1 . A method comprising at least the following operations:
generating a tree-based structure;
the tree-based structure including a first snapshot;
the first snapshot including a set of features, each feature corresponding to a feature in at least one of a directory, a file, a collection of files, and a pointer; and a plurality of pointers that, respectively, point to a feature in the set of features; and
taking a subsequent snapshot, the subsequent snapshot including a second feature corresponding to a first feature pointed at by a first pointer in the first snapshot, the subsequent snapshot further including a second pointer that points to the second feature included in the subsequent snapshot;
identifying a signature of each of the first and second snapshots; and
deleting the second pointer in the subsequent snapshot based on an identification that the signature of the second snapshot does not match the signature of the first snapshot.
2 . The method of claim 1 , wherein the first or second feature is included in a /tmp, /bin or /log directory.
3 . The method of claim 1 , wherein the deletion of the second pointer causes a creation of a backward pointer in the second snapshot pointing to the first feature in the first snapshot.
4 . The method of claim 3 , wherein a change associated with the second feature is deleted in conjunction with the deletion of the second pointer.
5 . The method of claim 4 , wherein the deleted change includes or relates to malware or ransomware.
6 . The method of claim 4 , wherein the change is included in or associated with a modified file or directory, and wherein a change is identified based on a tree change, a feature change, or a file change.
7 . A system comprising:
at least one processor for executing machine-readable instructions; and
a memory storing instructions configured to cause the at least one processor to perform operations comprising, at least:
generating a tree-based structure;
the tree-based structure including a first snapshot;
the first snapshot including a set of features, each feature corresponding to a feature in at least one of a directory, a file, a collection of files, and a pointer; and a plurality of pointers that, respectively, point to a feature in the set of features; and
taking a subsequent snapshot, the subsequent snapshot including a second feature corresponding to a first feature pointed at by a first pointer in the first snapshot, the subsequent snapshot further including a second pointer that points to the second feature included in the subsequent snapshot;
identifying a signature of each of the first and second snapshots; and
deleting the second pointer in the subsequent snapshot based on an identification that the signature of the second snapshot does not match the signature of the first snapshot.
8 . The system of claim 7 , where the first or second feature is included in a /tmp, /bin or /log directory.
9 . The system of claim 7 , wherein the deletion of the second pointer causes a creation of a backward pointer in the second snapshot pointing to the first feature in the first snapshot.
10 . The system of claim 9 , wherein a change associated with the second feature is deleted in conjunction with the deletion of the second pointer.
11 . The system of claim 10 , wherein the deleted change includes or relates to malware or ransomware.
12 . The system of claim 10 , wherein the change is included in or associated with a modified file or directory, and wherein a change is identified based on a tree change, a feature change, or a file change.
13 . A non-transitory, machine-readable medium storing instructions which, when read by a machine, cause the machine to perform operations comprising, at least:
generating a tree-based structure;
the tree-based structure including a first snapshot;
the first snapshot including a set of features, each feature corresponding to a feature in at least one of a directory, a file, a collection of files, and a pointer; and a plurality of pointers that, respectively, point to a feature in the set of features; and
taking a subsequent snapshot, the subsequent snapshot including a second feature corresponding to a first feature pointed at by a first pointer in the first snapshot, the subsequent snapshot further including a second pointer that points to the second feature included in the subsequent snapshot;
identifying a signature of each of the first and second snapshots; and
deleting the second pointer in the subsequent snapshot based on an identification that the signature of the second snapshot does not match the signature of the first snapshot.
14 . The medium of claim 13 , wherein the first or second feature is included in a /tmp, /bin or /log directory.
15 . The medium of claim 13 , wherein the deletion of the second pointer causes a creation of a backward pointer in the second snapshot pointing to the first feature in the first snapshot.
16 . The medium of claim 15 , wherein a change associated with the second feature is deleted in conjunction with the deletion of the second pointer.
17 . The medium of claim 16 , wherein the deleted change includes or relates to malware or ransomware.
18 . The medium of claim 16 , wherein the change is included in or associated with a modified file or directory, and wherein a change is identified based on a tree change, a feature change, or a file change.