Patent ID: 11960606
Assignee: CHECK POINT SOFTWARE TECHNOLOGIES LTD.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. An electronic device for detecting and mitigating a storage attack at the block level, the electronic device comprising:
a memory including multiple memory blocks at the physical level, wherein electronic files and metadata for the electronic files are stored in one or more of the memory blocks;
processor circuitry configured to:
generate a backup by detecting modifications in the memory blocks and storing a memory block backup of memory blocks that have been modified;
designate one or more of the memory blocks as canary blocks, such that an operating system does not use the canary blocks for storing the electronic files;
detect the storage attack by monitoring the canary blocks to identify as a modified canary block a modified one of the canary blocks; and
when the storage attack is detected by the identification of the modified canary block, mitigating the storage attack by:
identifying a malicious process that caused the modification to the modified canary block;
identifying modified memory blocks that were also modified by the identified malicious process; and
restoring from the backup the memory block backup of the identified modified memory blocks, such that the electronic files and the metadata stored in the modified memory blocks are restored.