Discovery of ransomware processes using last-interacted metadata tagging
One method includes tagging data with metadata that identifies a last process that interacted with the data, detecting an error that occurs when another process attempts to interact with the data that has been tagged with the metadata, in response to detecting the error, performing a query to identify the last process, and taking an action with respect to the last process. The query includes examining the metadata to identify the last process.
1 . A method, comprising:
backing up data at a production site as a snapshot and locking the snapshot including the data at a storage site, wherein the storage site is air-gapped with respect to the production site, wherein an inode journal operating in a kernel space of the production site tags the snapshot with metadata about a last process that lastly interacted with the data at the production site;
copying the locked snapshot to a sandbox within the storage site, wherein the locked snapshot is analyzed for malware using a machine learning algorithm, wherein the sandbox is marked as deleted in a case where no malware is detected in the locked snapshot;
detecting an error, at the production site, in the data during an interaction with the data that was tagged in the snapshot;
in response to detecting the error, performing a query over the metadata associated with the data at the storage site to identify the last process that interacted with the data at the production site; and
taking, at the production site, an action with respect to the last process.
2 . The method as recited in claim 1 , wherein the last process is identified as a suspected ransomware process.
3 . The method as recited in claim 1 , wherein the error indicates that the data was encrypted by the last process.
4 . The method as recited in claim 1 , wherein the storage site is configured for communication with the production site.
5 . The method as recited in claim 1 , wherein the metadata indicates that the last process comprises a write operation directed to the data.
6 . The method as recited in claim 1 , wherein the query comprises querying the storage site where the data is stored and examining the metadata, at the storage site, to identify the last process.
7 . The method as recited in claim 1 , wherein the query is transmitted by the production site to the storage site where the data is backed up and locked.
8 . The method as recited in claim 1 , wherein the action is taken automatically in response to identification of the last process.
9 . The method as recited in claim 1 , wherein the action comprises preventing further write operations by the last process.
10 . A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
backing up data at a production site as a snapshot and locking the snapshot including the data at a storage site, wherein the storage site is air-gapped with respect to the production site, wherein an inode journal operating in a kernel space of the production site tags the snapshot with metadata about a last process that lastly interacted with the data at the production site;
copying the locked snapshot to a sandbox within the storage site, wherein the locked snapshot is analyzed for malware using a machine learning algorithm, wherein the sandbox is marked as deleted in a case where no malware is detected in the locked snapshot;
detecting an error, at the production site, in the data during an interaction with the data that was tagged in the snapshot;
in response to detecting the error, performing a query over the metadata associated with the data at the storage site to identify the last process that interacted with the data at the production site; and
taking, at the production site, an action with respect to the last process.
11 . The non-transitory storage medium as recited in claim 10 , wherein the last process is identified as a suspected ransomware process.
12 . The non-transitory storage medium as recited in claim 10 , wherein the error indicates that the data was encrypted by the last process.
13 . The non-transitory storage medium as recited in claim 10 , wherein the storage site is configured for communication with the production site.
14 . The non-transitory storage medium as recited in claim 10 , wherein the metadata indicates that the last process comprises a write operation directed to the data.
15 . The non-transitory storage medium as recited in claim 10 , wherein performing the query comprises querying the storage site where the data is stored and examining the metadata, at the storage site, to identify the last process.
16 . The non-transitory storage medium as recited in claim 10 , wherein the query is transmitted by the production site to the storage site where the data resides.
17 . The non-transitory storage medium as recited in claim 10 , wherein the action is taken automatically in response to identification of the last process.
18 . The non-transitory storage medium as recited in claim 10 , wherein the action comprises preventing further write operations by the last process.