Recovery of compromised snapshots

1 . A method comprising:

identifying, by a data platform implemented by a computing system, a baseline snapshot from a plurality of snapshots of protected data, wherein the baseline snapshot comprises one or more files that each exhibits no indication of compromise;

for each file in an anomalous snapshot of the plurality of snapshots, identifying, by the data platform, in a secure environment, from one or more intermediate snapshots between the anomalous snapshot and the baseline snapshot in the plurality of snapshots, a clean version of the file;

storing, by the data platform, a clean snapshot comprising the respective clean versions of the respective files identified for the files in the anomalous snapshot;

obtaining, by one or more machine learning models of the data platform, using a natural language, registration information related to the secure environment; and

initiating, by the data platform using the registration information, a registration process for the secure environment.

2 . The method of claim 1 , wherein the anomalous snapshot is compromised by malware, the method further comprising:

analyzing, by the data platform and using one or more machine learning models, one or more of: the malware or a type of data affected by the malware.

3 . The method of claim 1 , wherein the anomalous snapshot comprises a most recent snapshot determined to be compromised.

4 . The method of claim 1 , further comprising:

training, by the data platform, the one or more machine learning models with a data set including at least a secure environment knowledge base.

5 . The method of claim 1 , further comprising:

deleting, by the data platform, the secure environment in response to receiving a delete request from a user.

6 . The method of claim 1 , further comprising:

restoring, by the data platform, based on the clean snapshot, at least a portion of the protected data.

7 . The method of claim 1 , wherein the protected data comprises a first application workload, the method further comprising:

predicting, by one or more machine learning models of the data platform, criticality of the first application workload;

obtaining, by the data platform, user feedback indicative of accuracy of the criticality prediction; and

providing, by the data platform, the user feedback to the one or more machine learning models to generate revised one or more machine learning models.

8 . The method of claim 7 , wherein the protected data comprises a second application workload, the method further comprising:

predicting, by the revised one or more machine learning models of the data platform, criticality of the second application workload, wherein the revised one or more machine learning models incorporate the user feedback indicative of accuracy of the criticality prediction of the first application workload into a prediction of the criticality of the second application workload.

9 . The method of claim 1 , wherein for each file in the anomalous snapshot, identifying the clean file comprises:

iterating through the one or more intermediate snapshots and, when a corresponding file for the file in the anomalous snapshot exists in one of the intermediate snapshot, verifying an integrity of the corresponding file.

10 . The method of claim 1 , wherein the baseline snapshot does not include any files that exhibit an indication of compromise.

11 . A computing system comprising:

a memory storing instructions; and

processing circuitry that executes the instructions to:

identify a baseline snapshot from a plurality of snapshots of protected data, wherein the baseline snapshot comprises one or more files that each exhibits no indication of compromise;

for each file in an anomalous snapshot of the plurality of snapshots, identify, in a secure environment, from one or more intermediate snapshots between the anomalous snapshot and the baseline snapshot in the plurality of snapshots, a clean version of the file;

store a clean snapshot comprising the respective clean versions of the respective files identified for the files in the anomalous snapshot;

obtain, by one or more machine learning models, using a natural language, registration information related to the secure environment; and

initiate, using the registration information, a registration process for the secure environment.

12 . The computing system of claim 11 , wherein the anomalous snapshot is compromised by malware, and the processing circuitry further executes the instructions to:

analyze, using one or more machine learning models, one or more of: the malware or a type of data affected by the malware.

13 . The computing system of claim 11 , wherein the anomalous snapshot comprises a most recent snapshot determined to be compromised.

14 . The computing system of claim 11 , wherein the processing circuitry further executes the instructions to:

train the one or more machine learning models with a data set including at least a secure environment knowledge base.

15 . The computing system of claim 11 , wherein the processing circuitry further executes the instructions to:

delete the secure environment in response to receiving a delete request from a user.

16 . Non-transitory computer-readable media comprising instructions that, when executed, cause processing circuitry of a computing system to:

identify a baseline snapshot from a plurality of snapshots of protected data, wherein the baseline snapshot comprises one or more files that each exhibits no indication of compromise;

for each file in an anomalous snapshot of the plurality of snapshots, identify, in a secure environment, from one or more intermediate snapshots between the anomalous snapshot and the baseline snapshot in the plurality of snapshots, a clean version of the file;

store a clean snapshot comprising the respective clean versions of the respective files identified for the files in the anomalous snapshot;

obtain, by one or more machine learning models, using a natural language, registration information related to the secure environment; and

initiate, by the data platform using the registration information, a registration process for the secure environment.