US 12,265,454 B2
Application dependency based malware recovery
Erin M Farr, Fishkill, NY (US); Yu-Cheng Hsu, Tucson, AZ (US); and Pratik Gupta, Wake, NC (US)
Assigned to INTERNATIONAL BUSINESS MACHINES CORPORATION, Armonk, NY (US)
Filed by International Business Machines Corporation, Armonk, NY (US)
Filed on Jul. 26, 2023, as Appl. No. 18/226,567.
Prior Publication US 2025/0036532 A1, Jan. 30, 2025
Int. Cl. G06F 11/14 (2006.01); G06F 11/36 (2006.01); G06F 16/11 (2019.01)
CPC G06F 11/1469 (2013.01) [G06F 11/3664 (2013.01); G06F 16/122 (2019.01); G06F 16/128 (2019.01); G06F 2201/84 (2013.01)] 14 Claims
OG exemplary drawing
 
1. A computer-implemented method comprising:
identifying a fileset used by an executing application;
generating, at a first time, a first snapshot of the fileset, the first snapshot comprising a first state of the fileset at the first time and a first indicator corresponding to the first state of the fileset;
selecting, at a recovery time later than the first time, from a sequence of snapshots of the fileset including the first snapshot, a recovery snapshot, the recovery snapshot comprising a recovery indicator, wherein the recovery indicator has a difference from the first indicator that is higher than a threshold value;
restoring, using the recovery snapshot, the fileset to a state other than the first state, the restoring resulting in a restored application;
testing the restored application, the testing comprising executing the restored application in a test environment;
determining that the restored application does not meet a test success criterion;
selecting, from the sequence of snapshots of the fileset including the first snapshot, a second recovery snapshot, wherein the recovery snapshot was generated at a second time, wherein the second recovery snapshot was generated at a third time earlier than the second time; restoring, using the second recovery snapshot, the fileset to a state other than the first state, the restoring using the second recovery snapshot resulting in a second restored application; and
retesting the second restored application, the retesting comprising executing the second restored application in the test environment.