SMART RECOVERY OF BACKUP COPIES BASED ON THREAT ANALYSIS
After completion of a backup job, the illustrative system performs a threat analysis of the freshly generated backup copies. Each copy is restored at a secure storage area. The system scans the restored data using, preferably, a signature-based malware scanning engine. If the scan finds malware infection or some other unsafe condition, a tracking index is updated to indicate that the copy is unsafe, and the secondary copy is quarantined. The quarantine prevents the copy from being restored to the production environment, and from acting as a source for other copies. The system iterates, scanning preceding versions of the copy, updating the index, and quarantining, until a clean or uninfected copy is found. The clean copy is so indexed. Responsive to a restore request, the illustrative system automatically restores the clean copy and skips over the infected copy/copies, preferably without asking the requesting user for input or approval.
1 . A system comprising:
one or more computer hardware processors;
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more computer hardware processors, cause the system to:
maintain, in an index, results of malware analysis performed on a plurality of backup copies corresponding to a data object, the index indicating whether each backup copy is malware-infected;
receive, from a user, a restore request for a most-recent version of the data object; indicated to be as malware-infected;
without prompting the user to choose the most-recent clean backup copy over a newer backup copy that is malware-infected, restore the most-recent clean backup copy into a primary data format at a target storage location; and
generate a new backup copy from the target storage location.
2 . The system of claim 1 , wherein the target storage location is distinct from a client computing device that generated the data object.
3 . The system of claim 1 , wherein restoring the most-recent clean backup copy into a primary data format comprises transforming the data object from a proprietary backup format into the primary data format, which is native to an application that generated the data object.
4 . The system of claim 1 , wherein the computer-executable instructions further cause the system to automatically suppress display of malware-infected backup copies in a user interface for restore selection to prevent accidental restoration of infected data.
5 . A system comprising:
one or more computer hardware processors;
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more computer hardware processors, cause the system to:
perform a backup operation that generates one or more backup copies of a primary data, which are stored at a secondary storage resource;
restore a backup copy, which is newly generated by the backup operation, into a secure storage area that is isolated from a production environment;
execute a malware detection program to scan the backup copy, in a restored data format, for malware;
determine, based on output of the malware detection program, whether the backup copy in the restored data format is malware-infected;
update a tracking index to record a malware status of the backup copy, wherein the tracking index comprises one or more indicators identifying the backup copy as malware-infected or uninfected; and
quarantine each of the one or more backup copies that were determined to be malware-infected to prevent a malware-infected backup copy from one or more of: being restored into the production environment, and being used as a source for further backup operations.
6 . The system of claim 5 , wherein the secure storage area is configured to temporarily store the backup copy in the restored data format for threat analysis.
7 . The system of claim 5 , wherein the malware detection program comprises a signature-based malware scanner that is maintained with regularly updated threat definitions.
8 . The system of claim 5 , wherein updating the tracking index comprises associating, to a backup copy that is malware-infected, metadata identifying one or more of: a malware family, a malware variant, and a file offset corresponding to a storage location of the backup copy at the secondary storage resource.
9 . The system of claim 5 , wherein the computer-executable instructions further cause the system to notify a storage manager component of the system that: a malware condition is associated with one or more of: a client computing device that generated the primary data, and a workload that generated the primary data.
10 . The system of claim 9 , wherein the storage manager component is configured to: update a management database to flag the client computing device as malware-infected; and cause further backup operations for the client computing device to be suspended until a remediation is completed.
11 . The system of claim 5 , wherein the computer-executable instructions further cause the system to: iteratively perform malware scans on one or more preceding backup copies of the primary data until a clean backup copy is identified; and mark the clean backup copy as safe in the tracking index.
12 . A system comprising:
one or more computer hardware processors;
one or more non-transitory computer-readable media carrying computer-executable instructions, which, when executed by the one or more computer hardware processors, configure the system to:
at a first time, generate a first backup copy of a first data object from a client computing device;
restore the first backup copy into a first restored data object, and determine that the first restored data object is not malware-infected;
based on determining that the first restored data object is not malware-infected, update a data structure to indicate that the first backup copy is not malware-infected;
at a second time after the first time, generate a second backup copy of the first data object;
restore the second backup copy into a second restored data object, and determine that the second restored data object is malware-infected;
based on determining that the second restored data object is malware-infected, update the data structure to indicate that the second backup copy is not safe to use;
at a user interface of the system, indicate, based on the data structure, that the second backup copy is not safe to restore and further indicate that the first backup copy is safe to restore;
responsive to a restore request from a user, restore the first backup copy into a restored first data object; and
transmit a notification to a storage manager computing device that a data object generated at the client computing device is malware-infected;
wherein the storage manager computing device is configured to: responsive to the notification, update a management database to indicate that the client computing device comprises data in which malware was detected.
13 . The system of claim 12 , wherein the computer-executable instructions further configure the system to: responsive to the restore request, select the first backup copy over the second backup copy without prompting the user to choose between the first backup copy and the second backup copy.
14 . The system of claim 12 , wherein the computer-executable instructions further configure the system to: cause the storage manager computing device to communicatively isolate the client computing device within the system.
15 . The system of claim 12 , wherein the computer-executable instructions further configure the system to: based on the management database indicating that the client computing device comprises data in which malware was detected, prevent a backup of primary data that is generated at the client computing device.
16 . The system of claim 12 , wherein the computer-executable instructions further configure the system to: based on determining that the second restored data object is malware-infected, cause an application that generated the first data object to be disabled.
17 . The system of claim 12 , wherein to restore the first backup copy into the first restored data object, the computer-executable instructions further configure the system to:
convert the second backup copy from a backup format to a primary data format of the second restored data object;
store the second restored data object at a data storage area configured at a first computing device, wherein the first computing device is distinct from the client computing device that generated the first data object; and
execute a malware detection program at the first computing device that is configured to determine whether the second restored data object is malware-infected.
18 . The system of claim 17 , wherein the computer-executable instructions further configure the system to: delete the second restored data object from the data storage area after determining that the second restored data object is malware-infected.
19 . The system of claim 12 , wherein the computer-executable instructions configured the system to perform a threat analysis job of a given backup copy, based on a completion of a backup job that generated the given backup copy, wherein the threat analysis job includes: restoring the given backup copy into a corresponding restored data object, making a determination whether the corresponding restored data object is malware-infected, updating a data structure to indicate whether the given backup copy is malware-infected, and transmit a notification to the storage manager computing device that data generated at the client computing device is malware-infected.