Ransomware mitigation using versioning and entropy delta-based recovery

1 . A method of mitigating a ransomware attack on data stored in a data store, comprising:

versioning data in the data store as a set of versions identified in a data tree, wherein new writes of data to the data store manipulate the data tree by only creating one or more new version(s) in the data tree, and wherein the versioning further implements a multifactor modification security policy which requires a collaboration across multiple user accounts to manipulate the data tree, and wherein the collaboration requires the multiple user accounts to provide respective shares of a secret decryption key to decrypt at least an encrypted portion of the data tree before manipulation of the data tree;

following a ransomware attack that has encrypted one or more versions of the set of versions identified in the data tree, wherein one or more versions of the set of versions in the data tree remain unencrypted, identifying an encrypted version of the set with a highest entropy value;

performing an entropy delta analysis that compares the highest entropy value to respective entropy values of each version of the set that remains unencrypted;

based on the performed entropy delta analysis, identifying a given version of the set that remains unencrypted, wherein the given version has a lowest relative entropy value as compared to the highest entropy value; and

initiating a restore operation with respect to the identified given version.

2 . The method as described in claim 1 further including enforcing one or more access controls at one or more defined points in the data tree.

3 . The method as described in claim 2 wherein the access control is one of: a role-based access control on the data tree, an access control list on the data tree, an attribute-based access control on the data tree, and a policy that enables manipulation of the data tree only by a set of collaborating entities.

4 . The method as described in claim 1 wherein the data store is one of: a database, a file-based data store, and a cloud object data store.

5 . The method as described in claim 1 wherein the identified given version is a latest unencrypted version of the data.

6 . The method as described in claim 1 wherein initiating the restore operation is an operation that is one of: retrieving the identified given version to a new location in the data store, moving the identified given version to be at a top of the data tree, and clearing the version tree of the one or more versions that are encrypted.

7 . The method as described in claim 1 wherein the entropy delta analysis is a relative entropy computation.

8 . An apparatus, comprising:

a processor;

computer memory holding computer program instructions executed by the processor to mitigate a ransomware attack on data stored in a data store as a set of versions, the set of versions identified in a data tree, the computer program instructions comprising program code configured to:

version data in the data store as a set of versions identified in a data tree, wherein new writes of data to the data store manipulate the data tree by only creating one or more new version(s) in the data tree, and wherein versioning the data further implements a multifactor modification security policy which requires a collaboration across multiple user accounts to manipulate the data tree, and wherein the collaboration requires the multiple user accounts to provide respective shares of a secret decryption key to decrypt at least an encrypted portion of the data tree before manipulation of the data tree;

following a ransomware attack that has encrypted one or more versions of the set of versions identified in the data tree, wherein one or more versions of the set remain unencrypted, identify an encrypted version of the set with a highest entropy value;

perform an entropy delta analysis that compares the highest entropy value to respective entropy values of each version of the set that remains unencrypted;

based on the performed entropy delta analysis, identify a given version of the set that remains unencrypted, wherein the given version has a lowest relative entropy value as compared to the highest entropy value; and

initiate a restore operation with respect to the identified given version.

9 . The apparatus as described in claim 8 wherein the program code is further configured to enforce one or more access controls at one or more defined points in the data tree.

10 . The apparatus as described in claim 9 wherein, with respect to the data tree, the access control is one of: a role-based access control on the data tree, an access control list on the data tree, an attribute-based access control on the data tree, and a policy that enables manipulation of the data tree only by a set of collaborating entities.

11 . The apparatus as described in claim 8 wherein the data store is one of: a database, a file-based data store, and a cloud object data store.

12 . The apparatus as described in claim 8 wherein the identified given version is a latest unencrypted version of the data.

13 . The apparatus as described in claim 8 wherein the program code configured to initiate the restore operation includes program code configured to perform one of: retrieving the identified given version to a new location in the data store, moving the identified given version to be at a top of the data tree, and clearing the version tree of the one or more versions that are encrypted.

14 . The apparatus as described in claim 8 wherein the entropy delta analysis is a relative entropy computation.

15 . A computer program product comprising:

one or more computer-readable storage media; and

program instructions stored on the one or more computer-readable storage media to perform operations which mitigate a ransomware attack on data stored in a data store as a set of versions, the set of versions identified in a data tree, the operations comprising:

versioning data in the data store as a set of versions identified in a data tree, wherein new writes of data to the data store manipulate the data tree by only creating one or more new version(s) in the data tree, and wherein the versioning further implements a multifactor modification security policy which requires a collaboration across multiple user accounts to manipulate the data tree, and wherein the collaboration requires the multiple user accounts to provide respective shares of a secret decryption key to decrypt at least an encrypted portion of the data tree before manipulation of the data tree;

following a ransomware attack that has encrypted one or more versions of the set of versions identified in the data tree, wherein one or more versions of the set remain unencrypted, identifying an encrypted version of the set with a highest entropy value;

performing an entropy delta analysis that compares the highest entropy value to respective entropy values of each version of the set that remains unencrypted;

based on the performed entropy delta analysis, identifying a given version of the set that remains unencrypted, wherein the given version has a lowest relative entropy value as compared to the highest entropy value; and

initiating a restore operation with respect to the identified given version.

16 . The computer program product as described in claim 15 wherein one or more access controls are enforced at one or more defined points in the data tree.

17 . The computer program product as described in claim 16 wherein the access control is one of: a role-based access control on the data tree, an access control list on the data tree, an attribute-based access control on the data tree, and a policy that enables manipulation of the data tree only by a set of collaborating entities.

18 . The computer program product as described in claim 15 wherein the data store is one of: a database, a file-based data store, and a cloud object data store.

19 . The computer program product as described in claim 15 wherein the identified given version is a latest unencrypted version of the data.

20 . The computer program product as described in claim 15 wherein the initiating comprises operations to perform one of: retrieving the identified given version to a new location in the data store, moving the identified given version to be at a top of the data tree, and clearing the version tree of the one or more versions that are encrypted.

21 . The computer program product as described in claim 15 wherein the entropy delta analysis is a relative entropy computation.

22 . A computing system for ransomware attack mitigation, comprising:

a processor set;

one or more computer-readable storage media; and

program instructions stored on the one or more computer-readable storage media to cause the processor set to perform operations comprising:

implementing a versioning mechanism to store data in a data store as a set of versions identified in a data tree, wherein a version in the set of versions can only be updated by writing a new version to the data tree, and to enforce an access control to prevent modification of the data tree, and wherein the versioning mechanism further implements a multifactor modification security policy which requires a collaboration across multiple user accounts to manipulate the data tree, and wherein the collaboration requires the multiple user accounts to provide respective shares of a secret decryption key to decrypt at least an encrypted portion of the data tree before manipulation of the data tree; and

implementing a restore mechanism to execute a restore function that identifies from the data tree a latest clear version of the data, and that initiates a restore operation with respect to the latest clear version, wherein identification of the latest clear version of the data further comprises:

identifying an encrypted version of the set with a highest entropy value;

performing an entropy delta analysis that compares the highest entropy value to respective entropy values of each version of the set that remains unencrypted; and

identifying an unencrypted version of the set with a lowest relative entropy value, as compared to the highest entropy value, as the latest clear version of the data.

23 . The computing system as described in claim 22 wherein the restore operation clears the version tree of the version that is encrypted.

24 . A method operating in a computing system wherein versions of data are identified in a data store in a data tree, and wherein a version can only be updated by writing a new version to the data tree, and wherein manipulation of the data tree requires a collaboration across multiple user accounts where the collaboration requires the multiple user accounts to provide respective shares of a secret decryption key to decrypt at least an encrypted portion of the data tree before manipulation of the data tree, comprising:

responsive to a ransomware attack that has encrypted one or more versions of a set of versions identified in the data tree, identifying an encrypted version of the set with a highest entropy value;

performing an entropy delta analysis that compares the highest entropy value to respective entropy values of each version of the set that remains unencrypted;

based on the performed entropy delta analysis, identify a latest version of the set that remains unencrypted, wherein the latest version has a lowest relative entropy value as compared to the highest entropy value; and

initiate a restore operation with respect to the latest version.