Systems and methods for identifying malware locations based on analyses of backup files
The disclosed computer-implemented method for identifying malware locations based on analyses of backup files may include (i) identifying a presence of a backup file set and (ii) performing a security action that may include (a) detecting, based on a scan of the backup file set, malware in the backup file set, (b) determining, based on a location of the malware in a system file structure of the backup file set, a subgraph of the system file structure of the backup file set that includes the malware, (c) identifying a string prefix for the subgraph of the system file structure of the backup file set, (d) using an index to cross-reference the string prefix to a pointer identifying a subgraph of an original file set, and (e) scanning a file in the subgraph of the original file set for the malware. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for identifying malware locations based on analyses of backup files, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying, at the computing device, a presence of a backup file set; and
performing, at the computing device, a first security action comprising:
detecting, based on a scan of the backup file set, malware in the backup file set;
determining, based on a location of the malware in a system file structure of the backup file set, a subgraph of the system file structure of the backup file set that includes the malware;
identifying a string prefix for the subgraph of the system file structure of the backup file set;
using an index to cross-reference the string prefix to a pointer identifying a subgraph of an original file set; and
scanning a file in the subgraph of the original file set for the malware.
2. The method of claim 1 , further comprising:
scanning the backup file set to identify the subgraph of the system file structure of the backup file set; and
adding information describing the subgraph of the system file structure of the backup file set to a structural graph describing a system file structure of the backup file set.
3. The method of claim 1 , further comprising:
scanning the original file set to identify the subgraph of the system file structure of the original file set; and
adding information describing the subgraph of the system file structure of the original file set to a structural graph describing a system file structure of the original file set.
4. The method of claim 1 , further comprising:
adding, to the index, the string prefix for the subgraph of the system file structure of the backup file set; and
adding, to the index, the pointer.
5. The method of claim 1 , wherein the system file structure of the backup file set is a directory hierarchy.
6. The method of claim 1 , wherein the string prefix for the subgraph of the system file structure of the backup file set has a fixed length.
7. The method of claim 6 , wherein the fixed length is configurable.
8. The method of claim 1 , wherein the file is a compressed archive file.
9. The method of claim 1 , further comprising:
detecting the malware in the file; and
performing, in response to detecting the malware, a second security action in an attempt to ameliorate a potential security risk posed by the malware.
10. A system for identifying malware locations based on analyses of backup files, the system comprising:
at least one physical processor;
physical memory comprising computer-executable instructions that, when executed by the at least one physical processor, cause the at least one physical processor to:
identify a presence of a backup file set; and
perform a security action comprising:
detecting, based on a scan of the backup file set, malware in the backup file set;
determining, based on a location of the malware in a system file structure of the backup file set, a subgraph of the system file structure of the backup file set that includes the malware;
identifying a string prefix for the subgraph of the system file structure of the backup file set;
using an index to cross-reference the string prefix to a pointer identifying a subgraph of an original file set; and
scanning a file in the subgraph of the original file set for the malware.
11. The system of claim 10 , wherein the physical memory further comprises computer-executable instructions that, when executed by the at least one physical processor, cause the at least one physical processor to:
scan the backup file set to identify the subgraph of the system file structure of the backup file set; and
add information describing the subgraph of the system file structure of the backup file set to a structural graph describing a system file structure of the backup file set.
12. The system of claim 10 , wherein the physical memory further comprises computer-executable instructions that, when executed by the at least one physical processor, cause the at least one physical processor to:
scan the original file set to identify the subgraph of the system file structure of the original file set; and
add information describing the subgraph of the system file structure of the original file set to a structural graph describing a system file structure of the original file set.
13. The system of claim 10 , wherein the physical memory further comprises computer-executable instructions that, when executed by the at least one physical processor, cause the at least one physical processor to:
add, to the index, the string prefix for the subgraph of the system file structure of the backup file set; and
add, to the index, the pointer.
14. The system of claim 10 , wherein the system file structure of the backup file set is a directory hierarchy.
15. The system of claim 10 , wherein the string prefix for the subgraph of the system file structure of the backup file set has a fixed length.
16. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
identify, at the computing device, a presence of a backup file set; and
perform, at the computing device, a security action comprising:
detecting, based on a scan of the backup file set, malware in the backup file set;
determining, based on a location of the malware in a system file structure of the backup file set, a subgraph of the system file structure of the backup file set that includes the malware;
identifying a string prefix for the subgraph of the system file structure of the backup file set;
using an index to cross-reference the string prefix to a pointer identifying a subgraph of an original file set; and
scanning a file in the subgraph of the original file set for the malware.
17. The non-transitory computer-readable medium of claim 16 , further comprising computer-executable instructions that, when executed by the at least one processor, cause the computing device to:
scan the backup file set to identify the subgraph of the system file structure of the backup file set; and
add information describing the subgraph of the system file structure of the backup file set to a structural graph describing a system file structure of the backup file set.
18. The non-transitory computer-readable medium of claim 16 , further comprising computer-executable instructions that, when executed by the at least one processor, cause the computing device to:
scan the original file set to identify the subgraph of the system file structure of the original file set; and
add information describing the subgraph of the system file structure of the original file set to a structural graph describing a system file structure of the original file set.
19. The non-transitory computer-readable medium of claim 16 , further comprising computer-executable instructions that, when executed by the at least one processor, cause the computing device to:
add, to the index, the string prefix for the subgraph of the system file structure of the backup file set; and
add, to the index, the pointer.
20. The non-transitory computer-readable medium of claim 16 , wherein the string prefix for the subgraph of the system file structure of the backup file set has a fixed length.