Ransomware detection and data pruning management
This application relates to ransomware detection and data pruning management. Ransomware typically involves an I/O heavy process of encrypting data files and/or deleting or renaming the original files. Thus, ransomware attacks may be detected by analyzing the I/O activity in a given file system. In some embodiments, a software module running on a client machine manages copying, archiving, migrating, and/or replicating of primary data and restoring and/or pruning secondary data (e.g., backup copies of the primary data). When a potential ransomware attack is detected, the software module is immediately stopped so that the software module does not prune any data that may need to be restored. Upon receiving user input that indicates that the client machine is not under a ransomware attack, the software module is allowed to resume its operations, including pruning of the secondary data.
1 . A computer-implemented method for detecting file activity anomalies, the computer-implemented method comprising, with one or more computing devices:
monitoring file system operations performed on primary data by a client computing device;
performing at least a first data protection operation that copies at least a portion of the primary data associated with the client computing device to one or more secondary storage devices as part of secondary data associated with the client computing device;
detecting a file activity anomaly based at least on one or more first file system operations of the file system operations performed on the primary data, the one or more first file system operations satisfying one or more threshold conditions; and
subsequent to detecting the file activity anomaly, overriding the detection of the file activity anomaly based at least on second file system operations performed on primary data associated with multiple client computing devices.
2 . The computer-implemented method of claim 1 , wherein overriding the detection of the file activity anomaly prevents disabling of one or more operations associated with the secondary data.
3 . The computer-implemented method of claim 2 , wherein overriding the detection of the file activity anomaly prevents disabling of one or more data removal operations associated with the secondary data.
4 . The computer-implemented method of claim 1 , further comprising determining based on at least the second file system operations that the detected file system anomaly is a false positive.
5 . The computer-implemented method of claim 4 , wherein the determining comprises identifying a pattern based on at least the second file system operations and determining that the one or more first file system operations are consistent with the pattern.
6 . The computer-implemented method of claim 1 , wherein overriding the detection of the file activity anomaly prevents notifying a user about the detected file activity anomaly.
7 . The computer-implemented method of claim 1 , wherein the one or more file system operations comprise at least one of write operations, create operations, rename operations, or delete operations.
8 . A system comprising:
one or more computing devices comprising computer hardware and configured to perform one or more file system operations within a file system residing on at least one computing device of the one or more computing devices; and
one or more secondary storage devices comprising computer hardware and configured to store secondary data associated with the at least one computing device, wherein the secondary data is a copy of primary data stored on one or more primary storage devices associated with the at least one computing device,
wherein the one or more computing devices are configured to:
detect a file activity anomaly based at least on one or more first file system operations of the one or more file system operations performed on the primary data; and
subsequent to detecting the file activity anomaly, override the detection of the file activity anomaly based at least on second file system operations performed on primary data associated with multiple computing devices.
9 . The system of claim 8 wherein the override of the detection of the file activity anomaly prevents disabling of one or more operations associated with the secondary data.
10 . The system of claim 9 wherein the override of the detection of the file activity anomaly prevents disabling of one or more data removal operations associated with the secondary data.
11 . The system of claim 8 , wherein the one or more computing devices are further configured to determine based on at least the second file system operations that the detected file activity anomaly is a false positive.
12 . The system of claim 11 , wherein the determination that the file activity anomaly is a false positive comprises identifying a pattern based on at least the second file system operations and determining that the one or more first file system operations are consistent with the pattern.
13 . The system of claim 8 , wherein the override of the detection of the file activity anomaly prevents notifying a user about the detected file activity anomaly.
14 . The system of claim 8 , wherein the one or more file system operations comprise at least one of write operations, create operations, rename operations, or delete operations.