Detecting clean backups and snapshots for subsequent data recovery operations

1 . A computer-implemented method, in a data processing system, for identifying clean backups of a monitored computing system, the computer-implemented method comprising:

monitoring access operations of the monitored computing system to detect patterns of access operations indicative of a cyber-attack on the monitored computing system, wherein the access operations are monitored in near real-time as the access operations are executed by the monitored computing system;

generating logged alert data dynamically based on the monitoring indicating a match of the monitored access operations to the patterns of access operations indicative of the cyber-attack;

generating a backup of a state of the monitored computing system; and

based on the generating of the backup:

accessing a data storage to retrieve the logged alert data associated with the monitored computing system;

executing, by a classification engine, a classification operation on the logged alert data to determine whether the logged alert data of the data storage indicates that the state of the monitored computing system was a target of the cyber-attack within a predetermined period of time prior to a time the backup was generated;

in a case where the classification operation indicates that the monitored computing system was the target of the cyber-attack, generating a first tag for the backup indicating the backup to be corrupted;

in a case where the classification operation indicates that the monitored computing system was not the target of the cyber-attack, generating a second tag for the backup indicating the backup to be clean; and

storing one of the first tag or the second tag in association with the backup to thereby indicate the backup to be either corrupted or clean.

2 . The computer-implemented method of claim 1 , wherein the backup is indicated to be either corrupted or clean without performing a scan of the backup.

3 . The computer-implemented method of claim 1 , further comprising:

executing a full scan of the backup based on signatures, patterns, or fingerprints of known cyber-attacks; and

based on the full scan of the backup indicating a different result from results of the classification operation, providing feedback data regarding the different result to the classification engine for further training of the classification engine.

4 . The computer-implemented method of claim 1 , wherein

the monitoring of the access operations and the generating of the logged alert data are performed between backups of the state of the monitored computing system, and

the backups of the state include the backup.

5 . The computer-implemented method of claim 1 , wherein the monitoring of the access operations comprises collecting real-time metric information or statistical measures of real-time metric information, and wherein the real-time metric information comprises counts of at least one of read, write, delete, rename, move-from, or move-to access operations.

6 . The computer-implemented method of claim 1 , wherein the classification operation comprises determining whether a number of alerts within the predetermined period is equal to or greater than a threshold number of alerts.

7 . The computer-implemented method of claim 1 , wherein the classification engine comprises one or more machine learning computer models that are trained through a machine learning process on training data, and wherein the training data comprises training backups and training alert data to classify the training backups as to whether the training backups are clean or not clean.

8 . The computer-implemented method of claim 1 , further comprising:

generating a graphical user interface specifying a listing of backups of the monitored computing system, wherein

the listing of backups of the monitored computing system comprises the backup,

each backup in the listing of backups has a cleanliness representation specifying whether a corresponding backup in the listing of backups is clean or corrupted, and

a setting of the cleanliness representation is set based on whether the first tag or the second tag is associated with the corresponding backup.

9 . The computer-implemented method of claim 8 , wherein the graphical user interface further comprises:

for each backup in the listing of backups whose cleanliness representation indicates a clean state, a restore graphical user interface element that is user selectable to cause a restore of the monitored computing system to a previous state corresponding to the corresponding backup, and

based on a user selecting the restore graphical user interface element, the monitored computing system is restored to the previous state using the corresponding backup.

10 . A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to:

monitor access operations of a monitored computing system to detect patterns of access operations indicative of a cyber-attack on the monitored computing system, wherein the access operations are monitored in near real-time as the access operations are executed by the monitored computing system;

generate logged alert data dynamically based on the monitored access operations that indicate a match of the monitored access operations to the patterns of access operations indicative of the cyber-attack;

generate a backup of a state of the monitored computing system; and

based on the generation of the backup:

access a data storage to retrieve the logged alert data associated with the monitored computing system;

execute, by a classification engine, a classification operation on the logged alert data to determine whether the logged alert data of the data storage indicates that the state of the monitored computing system was a target of the cyber-attack within a predetermined period of time prior to a time the backup was generated;

in a case where the classification operation indicates that the monitored computing system was the target of the cyber-attack, generate a first tag for the backup indicating the backup to be corrupted;

in a case where the classification operation indicates that the monitored computing system was not the target of the cyber-attack, generate a second tag for the backup indicating the backup to be clean; and

store one of the first tag or the second tag in association with the backup to thereby indicate the backup to be either corrupted or clean.

11 . The computer program product of claim 10 , wherein the backup is indicated to be either corrupted or clean without performing a scan of the backup.

12 . The computer program product of claim 10 , wherein the computer readable program further causes the computing device to:

execute a full scan of the backup based on signatures, patterns, or fingerprints of known cyber-attacks; and

based on the full scan of the backup indicating a different result from results of the classification operation, provide feedback data regarding the different result to the classification engine for further training of the classification engine.

13 . The computer program product of claim 10 , wherein

the the access operations are monitored and the logged alert data is generated between backups of the state of the monitored computing system, and

the backups of the state include the backup.

14 . The computer program product of claim 10 , wherein the monitor of the access operations comprises collection of real-time metric information or statistical measures of real-time metric information, and wherein the real-time metric information comprises counts of at least one of read, write, delete, rename, move-from, or move-to access operations.

15 . The computer program product of claim 10 , wherein the classification operation comprises determination of whether a number of alerts within the predetermined period is equal to or greater than a threshold number of alerts.

16 . The computer program product of claim 10 , wherein the classification engine comprises one or more machine learning computer models that are trained through a machine learning process on training data, and wherein the training data comprises training backups and training alert data to classify the training backups as to whether the training backups are clean or not clean.

17 . The computer program product of claim 10 , wherein the computer readable program further causes the computing device to:

generate a graphical user interface that specifying a listing of backups of the monitored computing system, wherein

the listing of backups of the monitored computing system comprises the backup,

each backup in the listing of backups has a cleanliness representation specifying whether a corresponding backup in the listing of backups is clean or corrupted, and

a setting of the cleanliness representation is set based on whether the first tag or the second tag is associated with the corresponding backup.

18 . An apparatus, comprising:

at least one processor; and

at least one memory coupled to the at least one processor, wherein the at least one memory comprises instructions which, when executed by the at least one processor, cause the at least one processor to:

monitor access operations of a monitored computing system to detect patterns of access operations indicative of a cyber-attack on the monitored computing system, wherein the access operations are monitored in near real-time as the access operations are executed by the monitored computing system;

generate logged alert data dynamically based on the monitored access data that indicates a match of the monitored access operations to the patterns of access operations indicative of the cyber-attack;

generate a backup of a state of the monitored computing system; and

based on the generation of the backup:

access a data storage to retrieve the logged alert data associated with the monitored computing system;

execute, by a classification engine, a classification operation on the logged alert data to determine whether the logged alert data of the data storage indicates that the state of the monitored computing system was a target of the cyber-attack within a predetermined period of time prior to a time the backup was generated;

in a case where the classification operation indicates that the monitored computing system was the target of the cyber-attack, generate a first tag for the backup indicating the backup to be corrupted;

in a case where the classification operation indicates that the monitored computing system was not the target of the cyber-attack, generate a second tag for the backup indicating the backup to be clean; and

store one of the first tag or the second tag in association with the backup to thereby indicate the backup to be either corrupted or clean.