Patent ID: 11960606
Assignee: CHECK POINT SOFTWARE TECHNOLOGIES LTD.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 16:
17. A non-transitory computer readable memory having software embodied thereon for detecting and mitigating a storage attack at the block level when the software is executed by processor circuitry, wherein the executing of the software causes the processor circuitry to:
generate a backup by detecting modifications in memory blocks of the memory and storing a memory block backup of memory blocks that have been modified, wherein the memory includes multiple memory blocks at the physical level and electronic files and metadata for the electronic files are stored in one or more of the memory blocks;
designate one or more of the memory blocks as canary blocks, such that an operating system does not use the canary blocks for storing the electronic files;
detect the storage attack by monitoring the canary blocks to identify as a modified canary block a modified one of the canary blocks; and
when the storage attack is detected by the identification of the modified canary block, mitigate the storage attack by:
identifying a malicious process that caused the modification to the modified canary block;
identifying modified memory blocks that were also modified by the identified malicious process; and
restoring from the backup the memory block backup of the identified modified memory blocks, such that the electronic files and the metadata stored in the modified memory blocks are restored.