US 12,462,036 B2
Efficient vulnerability analysis over backups
Gaurav Maheshwari, Jaipur (IN); Haritha Elango, Bangalore (IN); Anuj Mittal, Mathura (IN); Prakhar Kumar, Mountain View, CA (US); Ranjan Kathuria, Bhiwani (IN); Rahul Das, Jamshedpur (IN); Partha Dhar, Noida (IN); and Siddharth Rakesh, Roorkee (IN)
Assigned to Rubrik, Inc., Palo Alto, CA (US)
Filed by Rubrik, Inc., Palo Alto, CA (US)
Filed on May 19, 2022, as Appl. No. 17/748,834.
Prior Publication US 2023/0376605 A1, Nov. 23, 2023
Int. Cl. G06F 21/57 (2013.01)
CPC G06F 21/577 (2013.01) [G06F 2221/033 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A method for data management comprising:
processing a backup snapshot that is generated by a virtual machine of a virtual machine host that hosts a plurality of virtual machines, wherein the backup snapshot represents a state of the virtual machine and data associated with the virtual machine;
generating, based at least in part on processing the backup snapshot of the virtual machine, an index of software packages installed on the virtual machine and software versions of the software packages installed on the virtual machine;
comparing the index of software packages and the software versions to a list of vulnerabilities to identify a security vulnerability at the virtual machine based on the backup snapshot of the virtual machine;
obtaining, in response to identifying the security vulnerability and from a datastore, a set of indexes of software packages for the plurality of virtual machines of the virtual machine host, wherein a respective index of the set of indexes indicates a respective list of installed software packages and a corresponding version of the installed software packages included in a previously processed backup snapshot of a corresponding virtual machine, and wherein the set of indexes are obtained without reprocessing previously obtained backup snapshots and without obtaining new backup snapshots corresponding to the plurality of virtual machines, and wherein the set of indexes are generated prior to obtaining the backup snapshot that is generated by the virtual machine;
processing, in response to identifying the security vulnerability, the set of indexes of software packages;
identifying, based at least in part on processing the set of indexes, a location, a timing, or both associated with introduction of the security vulnerability to the virtual machine host; and
triggering a notification that is indicative of a result of comparing the index of software packages and the software versions to the list of vulnerabilities, wherein the notification comprises an indication of the location, the timing, or both.